Geoff Chappell, Software Analyst
This function asks the kernel whether the license data has been tampered with.
BOOLEAN ExGetLicenseTamperState (ULONG *TamperState);
The optional TamperState argument provides the address of a variable that is to receive the tamper state.
The function returns TRUE if the license data has been tampered with, else FALSE.
The function stores the tamper state at the address given by the TamperState argument, if this address is not NULL. The function returns TRUE if the tamper state is not zero, else FALSE.
The ExGetLicenseTamperState function is exported by name from the kernel in version 6.0 and higher.
The only known use by Microsoft is in SPSYS.SYS and in the kernel itself.
The internal use is in a timer that recurs approximately every hour. If the tamper state is found to be 4, then Windows stops. The bug check code is SYSTEM_LICENSE_VIOLATION (0x9A), with 0x1B as the first argument.