KiShadowProcessorAllocation
NTSTATUS __stdcall KiShadowProcessorAllocation(INT64 a1, CHAR *a2){
int v4;
unsigned __int64 v6;
_DWORD *v7;
unsigned int v8;
if( !KiKvaShadow )
return 1;
if( MmCreateShadowMapping(a2, 20480i64) )
{
v4 = 0;
if( !MmCreateShadowMapping((VOID *)(a1 + 36480), 4096i64) )
goto LABEL_11;
v4 = 1;
if( !*(_DWORD *)(a1 + 36) )
{
LODWORD(v6) = RtlImageNtHeader(0x140000000ui64);
v7 = (_DWORD *)RtlSectionTableFromVirtualAddress(
v6,
0x140000000i64,
(unsigned int)KiDivideErrorFaultShadow - 0x40000000);
v8 = v7[2];
if( v8 <= v7[4] )
v8 = v7[4];
if( !MmCreateShadowMapping((VOID *)(0x140000000i64 + (unsigned int)v7[3]), (v8 + 4095) & 0xFFFFF000) )
{
LABEL_11:
MmDeleteShadowMapping(a2, 0x5000ui64);
if( v4 )
MmDeleteShadowMapping((VOID *)(a1 + 36480), 0x1000ui64);
return 0;
}
}
return 1;
}
return 0;
}Referenced by:
KeWriteProtectProcessorState
KiEnableKvaShadowing