KiCheckForFreezeExecution
CHAR __fastcall KiCheckForFreezeExecution(KTRAP_FRAME *a1, KEXCEPTION_FRAME *a2){
struct _KPRCB *CurrentPrcb;
unsigned __int64 v4;
__int64 v5;
_QWORD *v6;
unsigned __int64 v7;
CurrentPrcb = KeGetCurrentPrcb();
if( *((_DWORD *)CurrentPrcb + 2914) != 5 )
return 0;
KiFreezeTargetExecution(a1, a2);
if( KiResumeForReboot && a1 )
{
if( a1->SegCs != 16 )
{
a1->SegCs = 16;
a1->SegSs = 24;
a1->Rsp = *((_QWORD *)CurrentPrcb + 5);
}
a1->EFlags &= ~0x200u;
v4 = __readmsr(0xC0000101);
a1->GsBase = ((unsigned __int64)HIDWORD(v4) << 32) | (unsigned int)v4;
a1->Rip = (unsigned __int64)KiWaitForReboot;
if( (_BYTE)KiKvaShadow )
{
v5 = 7i64;
v6 = (_QWORD *)(*((_QWORD *)CurrentPrcb - 48) + 5168i64);
do
{
v7 = __readcr3();
v6[1] = v7;
*v6 = __readmsr(0xC0000101);
v6 += 64;
--v5;
}
while( v5 );
}
}
return 1;
}Referenced by:
KeBugCheck2
KiProcessNMI