MiSetImageHotPatchAllowed
INT64 __fastcall MiSetImageHotPatchAllowed(UINT64 a1){
_ETHREAD *CurrentThread;
__int64 v3;
INT64 v4;
INT64 v5;
unsigned int v6;
int v7;
__int64 v8;
unsigned int v9;
INT64 v10;
INT64 v11;
unsigned int v12;
INT64 v14;
LODWORD(v14) = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = MiObtainReferencedVadEx(a1, 0, &v14);
v4 = v3;
if( !v3 )
return(unsigned int)v14;
if( (*(_DWORD *)(v3 + 48) & 0x70) != 32 || (unsigned int)MiVadDeleted(v3) )
goto LABEL_12;
if( !MiImageVadHotPatchEligible(v5) )
{
v6 = -1073741637;
LABEL_13:
MiUnlockAndDereferenceVad((PVOID)v4);
return v6;
}
if( a1 != (*(unsigned int *)(v4 + 24) | ((unsigned __int64)*(unsigned __int8 *)(v4 + 32) << 32)) << 12 )
{
LABEL_12:
v6 = -1073741800;
goto LABEL_13;
}
v7 = *(_DWORD *)(v4 + 48);
if( (v7 & 0x100000) == 0 && (v7 & 0x70) == 32 && (v7 & 0x400000) != 0 )
{
v6 = 255;
goto LABEL_13;
}
MiSetVadFlags(v4, 4, 1);
v8 = ***(_QWORD ***)(v4 + 72);
v9 = *(_DWORD *)(*(_QWORD *)(v8 + 56) + 60i64);
v10 = _InterlockedCompareExchange64((volatile signed __int64 *)(v8 + 24), -1i64, -1i64);
MiUnlockVad((__int64)CurrentThread, v4);
MiHotPatchImage(v11, v10, v4, v9);
v6 = v12;
MiLockVadShared((INT64)CurrentThread, v4);
MiUnlockAndDereferenceVadShared((PVOID)v4);
return v6;
}Referenced by:
NtSetInformationVirtualMemory