53 L"\\Registry\\Machine\\System\\CurrentControlSet\\"
110 DPRINT1(
"Couldn't open \\Device\\PhysicalMemory\n");
118 Status = ZwMapViewOfSection(PhysMemHandle,
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
IN CINT OUT PVOID IN ULONG OUT PULONG ReturnLength
#define EXCEPTION_EXECUTE_HANDLER
#define OBJ_KERNEL_HANDLE
#define OBJ_CASE_INSENSITIVE
void __cdecl _disable(void)
__INTRIN_INLINE void __writeeflags(uintptr_t Value)
__INTRIN_INLINE unsigned long __readcr4(void)
__INTRIN_INLINE uintptr_t __readeflags(void)
__INTRIN_INLINE void __writecr4(unsigned int Data)
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwOpenSection(_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
struct _KEY_VALUE_BASIC_INFORMATION KEY_VALUE_BASIC_INFORMATION
@ KeyValueBasicInformation
#define SECTION_ALL_ACCESS
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define NtCurrentProcess()
_In_ ULONG _In_ ULONG Offset
_In_ ULONGLONG _In_ ULONGLONG _In_ BOOLEAN Enable
BOOLEAN KeI386VirtualIntExtensions
NTSTATUS NTAPI VdmpStartExecution(VOID)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define RTL_CONSTANT_STRING(s)
#define RtlMoveMemory(Destination, Source, Length)
#define STATUS_INVALID_PARAMETER
VOID NTAPI Ki386VdmEnablePentiumExtentions(IN BOOLEAN Enable)
NTSTATUS NTAPI NtVdmControl(IN ULONG ControlCode, IN PVOID ControlData)
NTSTATUS NTAPI VdmpInitialize(PVOID ControlData)
VOID NTAPI KeI386VdmInitialize(VOID)
_In_opt_ PETWENABLECALLBACK _In_opt_ PVOID _Out_ PREGHANDLE RegHandle
_IRQL_requires_same_ typedef _In_ ULONG ControlCode