MiWriteValidPteNewProtection
CHAR __fastcall MiWriteValidPteNewProtection(INT64 *a1, INT64 a2){
INT64 v3;
_ETHREAD *CurrentThread;
v3 = a2 ^ (a2 ^ *a1) & 0x7F00000000000000i64;
LODWORD(CurrentThread) = MiPteInShadowRange((UINT64)a1);
if( (_DWORD)CurrentThread )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (*(_DWORD *)(*((_QWORD *)CurrentThread + 23) + 2172i64) & 0x1000) != 0 && (v3 & 1) != 0 )
{
LOBYTE(CurrentThread) = 0;
v3 |= 0x8000000000000000ui64;
}
}
*a1 = v3;
return(char)CurrentThread;
}Referenced by:
MiActOnPte
MiBuildForkPte
MiDbgCopyMemoryTarget
MiDecommitHardwareEnclavePages
MiDemoteCombinedPte
MiDirtySystemCachePte
MiFlushDirtyBitsToPfn
MiLargePageFault
MiMakeCombineCandidateClean
MiMakePteClean
MiMarkBootKernelStack
MiMarkPteDirty
MiPerformSafePdeWrite
MiProtectAweRegion
MiProtectSharedUserPage
MiReplacePageTablePage
MiRevokeExecutePte
MiSetSystemCodeProtection
MiTrimSharedPageFromViews
MiUnlockNestedPageTableWritePte
MiValidFault
MiWriteEnclavePte
MmProtectMdlSystemAddress
MmProtectPool
MmSetAddressRangeModifiedEx
MmSetPageProtection
MxCreatePfns