KiStackFault
VOID __stdcall KiStackFault(){
_ETHREAD *CurrentThread;
unsigned __int8 v1;
char v2;
ULONG64 v3;
__int64 v4;
UINT64 v5;
CHAR v6;
void *retaddr;
VOID *v8;
char v9;
__int16 v10;
if( (v9 & 1) != 0 )
{
if( (KiKvaShadow & 1) == 0 )
__swapgs();
_mm_lfence();
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
__writegsqword(0x270u, *(_QWORD *)(*((_QWORD *)CurrentThread + 68) + 2528i64));
__writegsbyte(0x851u, *((_BYTE *)KeGetPcr() + 2128));
__writegsbyte(0x852u, *((_BYTE *)KeGetPcr() + 632));
v1 = *((_BYTE *)KeGetPcr() + 635);
if( *((_BYTE *)KeGetPcr() + 634) != v1 )
{
__writegsbyte(0x27Au, v1);
__writemsr(0x48u, v1);
}
v2 = *((_BYTE *)KeGetPcr() + 632);
if( (v2 & 8) != 0 )
{
__writemsr(0x49u, 1ui64);
v2 = *((_BYTE *)KeGetPcr() + 632);
}
if( (v2 & 2) != 0 )
__flush_rsb();
_mm_lfence();
__writegsbyte(0x853u, 0);
if( *((char *)CurrentThread + 3) < 0 )
{
v3 = __readmsr(0xC0000102);
if( v3 >= MmUserProbeAddress )
v3 = MmUserProbeAddress;
if( *((_QWORD *)CurrentThread + 30) != v3 )
{
v4 = *((_QWORD *)CurrentThread + 62);
*((_DWORD *)CurrentThread + 29) |= 0x100u;
--*((_WORD *)CurrentThread + 243);
*(_QWORD *)(v4 + 128) = v3;
}
}
if( (*((_BYTE *)CurrentThread + 3) & 3) != 0 )
KiSaveDebugRegisterState();
}
else
{
_mm_lfence();
if( (*((_BYTE *)KeGetPcr() + 632) & 1) != 0 )
__writemsr(0x48u, *((unsigned __int8 *)KeGetPcr() + 634));
else
_mm_lfence();
}
_mm_getcsr();
_mm_setcsr(*((_DWORD *)KeGetPcr() + 96));
if( (_BYTE)KeSmapEnabled && (v9 & 1) != 0 )
__stac();
if( (v10 & 0x200) != 0 )
_enable();
v5 = (unsigned __int16)retaddr | 3u;
if( (v9 & 1) == 0 )
v5 = -1i64;
KiExceptionDispatch(3221225477i64, 2i64, v8, v5, v6);
}Referenced by:
KiStackFaultShadow