IoGetLoadedDriverInfo
NTSTATUS __stdcall IoGetLoadedDriverInfo(UINT8 AtBugCheck, UINT64 *lpDriverCount, UINT64 *lpSizeOfStringData){
INT64 v3;
int v4;
int i;
int v9;
NTSTATUS result;
v3 = PsLoadedModuleList;
v4 = 0;
for( i = 0; ; i += v9 + 9 )
{
if( (INT64 *)v3 == &PsLoadedModuleList )
{
*(_DWORD *)lpDriverCount = v4;
result = 0;
*(_DWORD *)lpSizeOfStringData = i;
return result;
}
if( AtBugCheck
&& (!KiIsAddressRangeValid(v3, 160i64)
|| !KiIsAddressRangeValid(*(_QWORD *)(v3 + 96), *(unsigned __int16 *)(v3 + 88))) )
{
break;
}
v9 = *(unsigned __int16 *)(v3 + 88);
++v4;
v3 = *(_QWORD *)v3;
}
return -1073741823;
}Referenced by:
IoFillTriageDumpBuffer
KeCapturePersistentThreadState