首页
社区
课程
招聘
[madaxian]可恶的wrk。 KeFreezeAllThreads函数如何实现暂停线程?
发表于: 2009-11-15 11:21 7024

[madaxian]可恶的wrk。 KeFreezeAllThreads函数如何实现暂停线程?

2009-11-15 11:21
7024
学会wrk,不做娱乐圈

VOID
KeFreezeAllThreads (
    VOID
    )

/*++

Routine Description:

    This function suspends the execution of all thread in the current
    process except the current thread. If the freeze count overflows
    the maximum suspend count, then a condition is raised.

Arguments:

    None.

Return Value:

    None.

--*/

{

    PKTHREAD CurrentThread;
    PLIST_ENTRY ListHead;
    PLIST_ENTRY NextEntry;
    PKPROCESS Process;
    KLOCK_QUEUE_HANDLE ProcessHandle;
    PKTHREAD Thread;
    KLOCK_QUEUE_HANDLE ThreadHandle;
    ULONG OldCount;

    ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);

    //
    // Set the address of the current thread object and the current process
    // object.
    //

    CurrentThread = KeGetCurrentThread();
    Process = CurrentThread->ApcState.Process;

    //
    // Raise IRQL to SYNCH_LEVEL and acquire the process lock.
    //

    KeAcquireInStackQueuedSpinLockRaiseToSynch(&Process->ProcessLock,
                                               &ProcessHandle);

    //
    // If the freeze count of the current thread is not zero, then there
    // is another thread that is trying to freeze this thread. Unlock the
    // the process lock and lower IRQL to its previous value, allow the
    // suspend APC to occur, then raise IRQL to SYNCH_LEVEL and lock the
    // process lock.
    //

    while (CurrentThread->FreezeCount != 0) {
        KeReleaseInStackQueuedSpinLock(&ProcessHandle);
        KeAcquireInStackQueuedSpinLockRaiseToSynch(&Process->ProcessLock,
                                                   &ProcessHandle);
    }

    KeEnterCriticalRegion();

    //
    // Freeze all threads except the current thread.
    //

    ListHead = &Process->ThreadListHead;
    NextEntry = ListHead->Flink;
    do {

        //
        // Get the address of the next thread.
        //

        Thread = CONTAINING_RECORD(NextEntry, KTHREAD, ThreadListEntry);

        //
        // Acquire the thread APC queue lock.
        //

        KeAcquireInStackQueuedSpinLockAtDpcLevel(&Thread->ApcQueueLock,
                                                 &ThreadHandle);

        //
        // If the thread is not the current thread and APCs are queueable,
        // then attempt to suspend the thread.
        //

        if ((Thread != CurrentThread) && (Thread->ApcQueueable == TRUE)) {

            //
            // Increment the freeze count. If the thread was not previously
            // suspended, then queue the thread's suspend APC.
            //
            // N.B. The APC MUST be queued using the internal interface so
            //      the system argument fields of the APC do not get written.
            //

            OldCount = Thread->FreezeCount;

            ASSERT(OldCount != MAXIMUM_SUSPEND_COUNT);

            Thread->FreezeCount += 1;
            if ((OldCount == 0) && (Thread->SuspendCount == 0)) {
                if (Thread->SuspendApc.Inserted == TRUE) {
                    KiLockDispatcherDatabaseAtSynchLevel();
                    Thread->SuspendSemaphore.Header.SignalState -= 1;
                    KiUnlockDispatcherDatabaseFromSynchLevel();

                } else {
                    Thread->SuspendApc.Inserted = TRUE;
                    KiInsertQueueApc(&Thread->SuspendApc, RESUME_INCREMENT);
                }
            }
        }

        //
        // Release the thread APC queue lock.
        //

        KeReleaseInStackQueuedSpinLockFromDpcLevel(&ThreadHandle);
        NextEntry = NextEntry->Flink;
    } while (NextEntry != ListHead);

    //
    // Release the process lock and exit the scheduler.
    //

    KeReleaseInStackQueuedSpinLockFromDpcLevel(&ProcessHandle);
    KiExitDispatcher(ProcessHandle.OldIrql);
    return;
}


这个wrk的代码 我看了一遍 。恩 发现比尔盖茨很奇怪 。光提高中断请求级就 弄了 XXX多个函数。

KeAcquireInStackQueuedSpinLockRaiseToSynch
 KeReleaseInStackQueuedSpinLock(&ProcessHandle);
        KeAcquireInStackQueuedSpinLockRaiseToSynch(&Process->ProcessLock,
                                                   &ProcessHandle);
  KeEnterCriticalRegion();
 KeAcquireInStackQueuedSpinLockAtDpcLevel(&Thread->ApcQueueLock,
                                                 &ThreadHandle);
  KiLockDispatcherDatabaseAtSynchLevel();
  KiUnlockDispatcherDatabaseFromSynchLevel();
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&ThreadHandle);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&ProcessHandle);
    KiExitDispatcher(ProcessHandle.OldIrql);

要是除去弄那些中断级的。。。貌似就是在修改一下结构中的值。而且是循环的修改 。谁能给解释一下 为什么修改了这些值线程就相当于被暂停了呢? [s:41] 还有哪些锁函数在这里有什么用呢?

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 7651
活跃值: (523)
能力值: ( LV9,RANK:610 )
在线值:
发帖
回帖
粉丝
2
看不懂就说人家可恶,楼主依然很娱乐~
2009-11-15 13:42
0
雪    币: 615
活跃值: (1212)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
3
调试消息.....
2009-11-15 16:08
0
游客
登录 | 注册 方可回帖
返回
//