DbgkUnMapViewOfSection
VOID __stdcall DbgkUnMapViewOfSection(_EPROCESS *Process, VOID *BaseAddress){
_ETHREAD *CurrentThread;
_ETHREAD *v5;
_TEB *Teb;
_DBGKM_APIMSG ApiMsg[68];
memset(ApiMsg, 0i64, sizeof(ApiMsg));
if( KeGetCurrentThread()->PreviousMode )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
if( (CurrentThread->CrossThreadFlags & 4) == 0 )
{
if( Process->DebugPort )
{
v5 = (_ETHREAD *)KeGetCurrentThread();
if( (v5->Tcb._bf_0 & 0x400) != 0 || v5->Tcb.ApcStateIndex == 1 )
Teb = 0i64;
else
Teb = (_TEB *)v5->Tcb.Teb;
if( !Teb || Process != CurrentThread->Tcb.Process || !(unsigned int)DbgkpSuppressDbgMsg(Teb) )
{
*(_QWORD *)&ApiMsg[12] = BaseAddress;
ApiMsg[0] = 3670032;
ApiMsg[1] = 8;
ApiMsg[10] = 6;
DbgkpSendApiMessage(Process, 1ui64, ApiMsg);
}
}
}
}
}Referenced by:
MiFreeEnclaveModules
MiUnmapViewOfSection