MiInitializeKernelCfg
NTSTATUS __stdcall MiInitializeKernelCfg(){
NTSTATUS result;
unsigned __int64 v1;
INT64 v2;
_MMPTE *PteBase;
_ETHREAD *CurrentThread;
PVOID *i;
PVOID v6;
IMAGE_NT_HEADERS *v7;
INT64 v8;
if( (MiFlags & 0x80000) == 0 )
return 0;
v1 = qword_140C4F868;
v2 = MiReservePtes((INT64)&qword_140C4EC80, 0x20ui64);
if( !v2 )
return -1073741670;
PteBase = MmGetPteBase();
result = VslInitializeSecureKernelCfg(v1, ((v2 << 25) - ((_QWORD)PteBase << 25)) >> 16);
if( result >= 0 )
{
qword_140C4C978 = v1;
qword_140C4C970 = 0x100000000000i64;
LODWORD(v8) = 0;
if( (unsigned int)MiMakeZeroedPageTablesEx(
(INT64)PteBase + ((v1 >> 9) & 0x7FFFFFFFF8i64),
(INT64)PteBase + (((v1 + 0x1FFFFFFFFFFi64) >> 9) & 0x7FFFFFFFF8i64),
4ui64,
9i64,
v8) )
{
qword_140C4C980 = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite(&PsLoadedModuleResource, 1u);
for( i = (PVOID *)PsLoadedModuleList; i != &PsLoadedModuleList; i = (PVOID *)*i )
{
if( ((_DWORD)i[13] & 0x2000) == 0 )
{
v6 = i[6];
if( v6 == (PVOID)PsNtosImageBase )
{
v7 = RtlImageNtHeader(v6);
MiMarkKernelImageCfgBits((__int64)i, (__int64)v7);
*((_DWORD *)i + 26) |= 0x2000u;
}
else
{
MiProcessKernelCfgImageLoadConfig((__int64)i, 0i64);
MiProcessKernelCfgImage((INT64)i, 0, 0i64);
}
}
}
MiProcessKernelCfgAddressTakenImports((INT64)PsLoadedModuleList);
ExReleaseResourceLite(&PsLoadedModuleResource);
KeLeaveCriticalRegionThread((__int64)CurrentThread);
guard_icall_bitmap = qword_140C4C978 - 0x3FFFE0000000000i64;
return 0;
}
return -1073741670;
}
return result;
}Referenced by:
MiInitSystem