KeRestoreSupervisorState
VOID __fastcall KeRestoreSupervisorState(INT64 a1, INT64 a2){
INT64 v2;
if( a1 )
{
v2 = a2 & 0x100;
if( (KeFeatureBits & 0x800000) != 0 && KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures )
RtlXRestoreS((_QWORD *)(a1 - 512), a2 & KUSER_SHARED_DATA.XState.EnabledSupervisorFeatures);
if( (_DWORD)KiIptMsrMask )
{
if( v2 )
KiRestoreIptState((UINT64 *)(a1
+ KUSER_SHARED_DATA.XState.AllFeatureSize
- (unsigned __int64)KUSER_SHARED_DATA.XState.Size
+ 64));
}
}
}Referenced by:
IopLiveDumpProcessCorralStateChange
KdExitDebugger
KiFreezeTargetExecution