MiCopyTopLevelMappings
VOID __stdcall MiCopyTopLevelMappings(_EPROCESS *Process, _MMPTE *TargetPxe){
__int64 v4;
union {unsigned __int64 Long;volatile unsigned __int64 VolatileLong;_MMPTE_HARDWARE Hard;_MMPTE_PROTOTYPE Proto;_MMPTE_SOFTWARE Soft;_MMPTE_TIMESTAMP TimeStamp;_MMPTE_TRANSITION Trans;_MMPTE_SUBSECTION Subsect;_MMPTE_LIST List;} v5;
_MM_SESSION_SPACE *Session;
memmove(&TargetPxe[256], &MmGetPml4eBase()[256], 8 * (((*(&stru_140C4DB30 + 937) >> 39) & 0x1FF) - 256));
MiShadowTopLevelPxes();
v4 = ((unsigned int)(*(&stru_140C4DB30 + 175) >> 39) & 0x1FF) + 1;
memmove(&TargetPxe[v4], &MmGetPml4eBase()[v4], 8 * (512 - v4));
v5.Long = 0i64;
Session = Process->Session;
if( Session )
v5.Long = *(_QWORD *)((unsigned __int64)Session + 816);
TargetPxe[((unsigned __int64)qword_140C4DB18 >> 39) & 0x1FF] = (_MMPTE)v5.Long;
}Referenced by:
MiCreateNewProcessTopLevelMappings
MiUpdateSystemPdes