366.7 KB - Evernote

NTKERNELAPI VOID KeInitializeApc (
IN PRKAPC Apc,
IN PKTHREAD Thread,
IN KAPC_ENVIRONMENT Environment,
IN PKKERNEL_ROUTINE KernelRoutine,
IN PKRUNDOWN_ROUTINE RundownRoutine OPTIONAL,
IN PKNORMAL_ROUTINE NormalRoutine OPTIONAL,
IN KPROCESSOR_MODE ApcMode,
IN PVOID NormalContext
);
This prototype was published in [1] and is still valid for Windows Vista SP1.
Calling nt!KeInitializeApc does not schedule the APC yet: it just fills the members of the _KAPC. To
actually schedule the APC one more step will be required.
Ke InitializeApc sets the Type field to a constant value (0x12) which identifies this structure as a
_KAPC and the Size field to 0x30, i.e. the size of the structure rounded up to a multiple of 4.
The Thread field is set to the corresponding function parameter and contains a pointer to the
_KTHREAD for the thread the APC is intended for.
The ApcListEntry is not set by nt!KeInitializeApc. Rather, it is used when the APC is actually
scheduled, to chain it to a list of pending APCs for the thread.
The KernelRoutine field, taken from the function input parameter, stores a pointer to the function to be
called when the APC is dispatched. This is the actual code which will be executed in the context of
the thread targeted by the APC. Every APC has a KernelRoutine and, depending on its type it can
have a NormalRoutine as well.
The function pointed by KernelRoutine is called at APC IRQL.
The NormalRoutine and ApcMode function parameters determine the type of the APC.
If NormalRoutine is 0, this is a special kernel mode APC.
For this kind of APCs nt!KeInitializeApc sets _KAPC.ApcMode to 0, which stands for kernel mode
and _KAPC.NormalContext to 0. The corresponding function parameters are ignored.
If NormalRoutine is not 0 and ApcMode is set to 0, this is a regular kernel mode APC;
_KAPC.ApcMode and _KACP.NormalContext are set from the function parameters.
This kind of APC will still execute kernel mode code, as denoted by ApcMode = 0, but it is less
privileged than a special one, which means it can be executed only under certain conditions, which
will be detailed later. NormalRoutine is stored in the corresponding _KAPC member and is the
address of a function which will be called when the APC is delivered.
When such an APC is serviced, the KernelRoutine is called first, at APC IRQL. Afterwards, the
NormalRoutine is called at PASSIVE IRQL. Both functions execute in kernel mode.
As we will see in more detail later, the KernelRoutine has a chance to prevent the execution of the
NormalRoutine or to change the address which will be called, before the NormalRoutine comes into
play.
7