KiKernelSysretExit
VOID __stdcall KiKernelSysretExit(VOID *a1){
int v1;
unsigned int ShadowFlags;
unsigned __int64 UserDirectoryTableBase;
char v4;
char v5;
ShadowFlags = KeGetPcr()->Prcb.ShadowFlags;
if( (ShadowFlags & 2) == 0 )
{
UserDirectoryTableBase = KeGetCurrentThread()->Process->Pcb.UserDirectoryTableBase;
if( (UserDirectoryTableBase & 1) != 0 )
{
if( (v4 & 1) != 0 )
__writegsdword(0x9018u, KeGetPcr()->Prcb.ShadowFlags & 0xFFFFFFFE);
else
UserDirectoryTableBase |= 0x8000000000000000ui64;
}
__writecr3(UserDirectoryTableBase);
}
if( (v5 & 2) == 0 )
__asm { verw word ptr gs:902Ah }
__swapgs();
__sysretq(a1, v1);
}Referenced by:
KiCallUserMode
KiSystemCall64
KiUmsFastReturnToUser