366.7 KB - Evernote

If NormalRoutine is not 0 and ApcMode is set to 1, this is a user mode APC, which will therefore call
the NormalRoutine in user mode.
For user mode APCs, nt!KeInitializeApc sets the _KAPC.ApcMode and _KAPC.NormalContext
members to the value of its corresponding input parameters.
The NormalContext field is passed to both the kernel routine and the normal routine when they are
called.
SystemArgument1 and 2 are not set by nt!KeInitializeApc. Instead, they are set when an APC is
scheduled and they are passed to the callback routines as well. We will see this process in much
more detail later.
ApcStateIndex determines the environment the APC is for and will later be used as an index into the
ApcStatePointer array of the thread, to select the _KAPC_STATE where to store the APC. If it has
any value other than 2, nt!KeInitializeApc stores this value in the corresponding _KAPC field. If it is 2,
the function sets _KAPC.ApcStateIndex to the value of _KTHREAD. ApcStateIndex for the input
thread. Thus, the value 2 means: schedule the APC for whatever environment is current when
nt!KeInitializeApc is called.
Finally, the Inserted field is set to 0 by nt!KeInitializeApc and this represents the fact that this APC has
not been queued to its thread yet. nt!KeInsertQeueueApc, which is used to schedule APCs, will set
this field to 1.
Initial APC Scheduling
All kinds of APCs are queued to their thread by calling nt!KeInsertQueueApc. The steps performed by
this function are the same, regardless of the type of APC for which it is called.
This function takes as input 4 stack parameters:
• A pointer to the _KAPC structure for the APC.
• Two user-defined values SystemArgument1 and SystemArgument2
• A priority increment
nt!KeInsertQueueApc begins by acquiring a spinlock stored in the _KTHREAD for the target thread
and raising the IRQL to 0x1b, i. e. profile level. Thus the rest of its operation can be interrupted only
by the clock and IPI interrupts.
Afterwards, it looks into a bit field at offset 0xb0 of the _KTHREAD for the target thread, to see if bit 6,
i. e. ApcQueueable is set. If it’s not, it aborts returning 0 (i. e. FALSE) to its caller.
The function then checks whether the Inserted field of the input _KAPC is already set to 1 and, if so,
returns FALSE.
If the two checks above are successful, the APC is actually scheduled as follows.
The function copies the input SystemArgument1 and 2 into the corresponding fields of _KAPC. These
value will be passed to the APC callbacks and offer a way to pass them context information when
scheduling the APC, in contrast with NormalContext, whose value is set at _KAPC initialization time.
Afterwards, it sets _KAPC.Inserted to 1 and calls nt!KiInsertQueueApc with edx set to the input
priority increment and ecx set to the address of the _KAPC.
8