MiPrepareDriverPatchState
NTSTATUS __stdcall MiPrepareDriverPatchState(INT64 a1){
VOID *Pool;
Pool = MiAllocatePool(64i64, (unsigned int)(*(_DWORD *)(a1 + 16) + 7) >> 3, 0x4D425044ui64);
if( !Pool )
return -1073741670;
*(_QWORD *)(a1 + 24) = *(unsigned int *)(a1 + 16);
*(_QWORD *)(a1 + 32) = Pool;
*(_DWORD *)(a1 + 56) = 0;
if( MI_IS_PHYSICAL_ADDRESS(*(VOID **)(*(_QWORD *)a1 + 48i64)) )
*(_DWORD *)(a1 + 56) = 2;
return 0;
}Referenced by:
MiApplyDriverHotPatch
MiLockAndMapEntireDriver
MiUnapplyDriverHotPatch
MmWriteSystemImageTracepoint