DbgkpMarkProcessPeb

VOID __stdcall DbgkpMarkProcessPeb(_EPROCESS *Process){
  _EX_RUNDOWN_REF *p_RundownProtect; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  _KAPC_STATE ApcState; 

  memset(&ApcState, 0, sizeof(ApcState));
  p_RundownProtect = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) )
  {
    if( Process->Peb )
    {
      KiStackAttachProcess(Process, 0i64, &ApcState);
      ExAcquireFastMutex(&DbgkpProcessDebugPortMutex);
      Process->Peb->BeingDebugged = Process->DebugPort != 0i64;
      WoW64Process = Process->WoW64Process;
      if( WoW64Process )
      {
        Machine = WoW64Process->Machine;
        if( Machine == 332 || Machine == 452 )
        {
          if( WoW64Process->Peb )
            *((_BYTE *)WoW64Process->Peb + 2) = Process->Peb->BeingDebugged;
        }
      }
      KeReleaseGuardedMutex(&DbgkpProcessDebugPortMutex);
      KiUnstackDetachProcess(&ApcState, 0i64);
    }
    ExReleaseRundownProtection(p_RundownProtect);
  }
}

Referenced by: