PspInitPhase2
BOOL __stdcall PspInitPhase2(){
_EPROCESS *v0;
UINT64 UnbiasedInterruptTime;
_QWORD *v2;
unsigned __int8 v3;
unsigned __int8 v4;
BOOL result;
UINT64 Seed;
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation(&dword_140C01AB0);
v0 = (_EPROCESS *)PsInitialSystemProcess;
*((_QWORD *)v0 + 141) = RtlGetSystemTimePrecise();
*((_QWORD *)PsInitialSystemProcess + 288) = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
UnbiasedInterruptTime = KiQueryUnbiasedInterruptTime(1u);
v2 = PsIdleProcess;
*((_QWORD *)PsInitialSystemProcess + 289) = UnbiasedInterruptTime;
v2[141] = *((_QWORD *)PsInitialSystemProcess + 141);
v2[288] = *((_QWORD *)PsInitialSystemProcess + 288);
v2[289] = *((_QWORD *)PsInitialSystemProcess + 289);
RtlGetSystemTimePrecise();
PspWorkOnBehalfEncodingKey = (unsigned __int64)(unsigned int)RtlRandom(&Seed) << 32;
PspWorkOnBehalfEncodingKey = (unsigned int)RtlRandom(&Seed) | (unsigned __int64)PspWorkOnBehalfEncodingKey;
if( PspSehValidationPolicy )
{
if( PspSehValidationPolicy == 2 )
v3 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3 | 8;
else
v3 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3 | 4;
}
else
{
v3 = KUSER_SHARED_DATA.MitigationPolicies & 0xF3;
}
KUSER_SHARED_DATA.MitigationPolicies = v3;
switch( PspCurDirDevicesSkippedForDlls )
{
case 1:
v4 = v3 & 0xCF | 0x10;
break;
case 2:
v4 = v3 & 0xCF | 0x20;
break;
case -1:
v4 = v3 | 0x30;
break;
default:
v4 = v3 & 0xCF;
break;
}
KUSER_SHARED_DATA.MitigationPolicies = v4;
PspInitializeSystemDlls();
result = PspInitializeProtectedProcessParameters((INT64)&PspHostSiloGlobals);
LOBYTE(result) = result >= 0;
return result;
}Referenced by:
PsInitSystem