366.7 KB - Evernote
366.7 KB - Evernote
366.7 KB - Evernote
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
APCTEST - Current IRQL: 0x1<br />
APCTEST - Caller address: 0X8181F2F7<br />
APCTEST - Trap frame: 00000000<br />
APCTEST - Reserved: 00000000<br />
APCTEST - PreviousMode: 0<br />
APCTEST - Thread: 0X84E96030<br />
APCTEST - Thread K APC pending: 1<br />
APCTEST - Thread K APC list empty: 0<br />
APCTEST - Thread U APC pending: 0<br />
APCTEST - Thread U APC list empty: 1<br />
APCTEST - KERNEL ROUTINE trace<br />
APCTEST - Thread: 0X84E96030<br />
APCTEST - Thread K APC pending: 0<br />
APCTEST - Thread K APC list empty: 1<br />
APCTEST - Thread U APC pending: 0<br />
APCTEST - Thread U APC list empty: 1<br />
APCTEST - TRACE MESSAGE: Returned from KeLowerIrql<br />
APCTEST - Thr: 0X84E96030; WaitCycles = 243152<br />
Trace With APC Interrupt Not Outstanding<br />
The second type of trace is similar to the first sample, where the context switch did occur, but shows<br />
an interesting difference.<br />
In all the traces, the nt!SwapContext data also include whether an APC interrupt is pending at the<br />
time of the call. This is done in order to confirm that nt!SwapContext is actually called while the APC<br />
interrupt is still outstanding.<br />
For this type of trace, however, we see nt!SwapContext being called, with the pending APC, but<br />
without the interrupt:<br />
APCTEST - Thr: 0X85145388; APC initialized: 0X850AF0EC<br />
APCTEST - SWAP CONTEXT trace<br />
APCTEST - Current IRQL: 0x1b<br />
APCTEST - Current thread: 0X85145388<br />
APCTEST - Current thread K APC pending: 1 the APC is pending<br />
APCTEST - Current thread K APC list empty: 0<br />
APCTEST - Current thread U APC pending: 0<br />
APCTEST - Current thread U APC list empty: 1<br />
APCTEST - New thread: 0X84D689F0<br />
APCTEST - New thread K APC pending: 0<br />
37
Change language