KiHwPolicyFindDriverImage
VOID *__stdcall KiHwPolicyFindDriverImage(_LOADER_PARAMETER_BLOCK *LoaderBlock){
_LIST_ENTRY *p_BootDriverListHead;
_LIST_ENTRY *i;
_LIST_ENTRY *Flink;
_UNICODE_STRING String2;
*(_QWORD *)&String2.Length = 1703960i64;
p_BootDriverListHead = &LoaderBlock->BootDriverListHead;
String2.Buffer = L"hwpolicy.sys";
for( i = LoaderBlock->BootDriverListHead.Flink; ; i = i->Flink )
{
if( i == p_BootDriverListHead )
return 0i64;
Flink = i[3].Flink;
if( Flink )
{
if( SLODWORD(i[3].Blink) >= 0 && !RtlCompareUnicodeString((const _UNICODE_STRING *)&Flink[5].Blink, &String2, 1u) )
break;
}
}
return Flink[3].Flink;
}Referenced by:
KeHwPolicyLocateResource