366.7 KB - Evernote

A detailed explanation of how this is achieved can be found in [1] in the section titled APC
Environments. I did not revise this material for Windows Vista, however, all the APC control variables
described there are still present and used in the rest of the Vista APC implementation. Below is a
summary of the Environments section
Windows maintains the state of APCs waiting to execute in the _KAPC_STATE data structure, shown
below (output from the WinDbg dt command):
kd> dt nt!_KAPC_STATE
+0x000 ApcListHead : [2] _LIST_ENTRY
+0x010 Process : Ptr32 _KPROCESS
+0x014 KernelApcInProgress : UChar
+0x015 KernelApcPending : UChar
+0x016 UserApcPending : Uchar
The main kernel data structure _KTHREAD has two members of type _KAPC_STATE, named
ApcState and SavedApcState, which are called APC environments. ApcState is the environment for
APCs targeted at the current thread context: regardless of whether the thread is attached to its own
process, or another one, this member contains APCs for the current process context and therefore
deliverable ones. SavedApcState stores APCs for the context which is not current and that must wait.
For instance, if the thread is attached to a process other than its owner and there are APCs for the
owner process, they go into SavedApcState and have to wait until the thread detaches from the other
process.
From the explanation above, we can understand that when a thread attaches itself to another
process, ApcState is copied into SavedApcState and re-initialized. When the thread detaches itself,
ApcState is restored from SavedApcState, which is then emptied. Also, we can see that the kernel
components responsible for dispatching APCs, always look into ApcState for delivarable ones.
The _KTHREAD structure also stores an array of 2 pointers called ApcStatePointer, whose members
hold the addresses of ApcState and SavedApcState (that is, they point inside _KTHREAD itself). The
kernel updates these pointers so that the first one always points to the APC environment for the
thread owning process and the second one points to the environment for an eventual process the
thread is attached to.
For instance, if the thread is not attached to another process, the Environment for the owning process
is also currently active, therefore it is stored into ApcState and ApcStatePointer[0] holds the address
of ApcState.
Finally, _KTHREAD.ApcStateIndex stores the index of the pointer to ApcState, i. e. the active
environment. Thus, if the thread is attached to another process, the owning process environment is
into SavedApcState, ApsStatePointer[0] points to SavedApcState, because it always points to the
owning process environment. In turn, ApcStatePointer[1] points to ApcState, because it always points
to the attached process environment. Finally, ApcStateIndex is set to 1, because it is
ApcStatePointer[1] which is pointing to the active environment.
When we schedule an APC, we can specify that we want to add it to the environment for the owning
process (i. e. the one pointed by ApcStatePointer[0]), to the secondary one (ApcStatePointer[1]) or to
whichever environment is currently active (i. e. the one at ApcState, no matter what).
APC Types
APCs come in three kinds.
5