VMM_GetSystemInitState

include vmm.inc

VMMCall VMM_GetSystemInitState

mov [InitState], eax
 

Retrieves the current system initialization state. Uses EAX, ECX, Flags.

Milestone VMM_GetSystemInitState return value
SYS_CRITICAL_Init is broadcast SYSSTATE_PRESYSCRITINIT (00000000h)
DEVICE_INIT is broadcast SYSSTATE_PREDEVICEINIT (10000000h)
INIT_COMPLETE is broadcast SYSSTATE_PREINITCOMPLETE (20000000h)
  SYSSTATE_VXDINITCOMPLETED (40000000h)
KERNEL32_INITIALIZED is broadcast SYSSTATE_KERNEL32INITED (50000000h)
KERNEL32_SHUTDOWN is broadcast SYSSTATE_KERNEL32TERMINATED (A0000000h)

STATE_PRESYSVMTERMINATE (B0000000h)

SYS_VM_TERMINATE is broadcast SYSSTATE_PRESYSTEMEXIT (E0000000h)
SYSTEM_EXIT is broadcast SYSSTATE_PRESYSTEMEXIT2 (E4000000h)
SYSTEM_EXIT2 is broadcast SYSSTATE_PRESYSCRITEXIT (F0000000h)
SYS_CRITICAL_EXIT is broadcast SYSSTATE_PRESYSCRITEXIT2 (F4000000h)
SYS_CRITICAL_EXIT2 is broadcast  
Return to real mode SYSSTATE_POSTSYSCRITEXIT2 (FFF00000h)
DEVICE_REBOOT_NOTIFY is broadcast (See Device_Reboot_Notify function) SYSSTATE_PREDEVICEREBOOT (0xFFFF0000)
CRIT_REBOOT_NOTIFY is broadcast (See Crit_Reboot_Notify function) SYSSTATE_PRECRITREBOOT (0xFFFFF000)
REBOOT_PROCESSOR is broadcast (See Reboot_Processor function) SYSSTATE_PREREBOOTCPU (0xFFFFFF00)

VMM.H contains the above definitions.

Future versions of Windows may have additional initialization states with values between the ones defined here, which implies that you should use a relational comparison to test the initialized state. Currently, this service returns zero in ECX, but additional information may be returned in this register in the future.