KeStackAttachProcess
VOID *__stdcall KeStackAttachProcess(_EPROCESS *PROCESS, PRKAPC_STATE ApcState){
_ETHREAD *CurrentThread;
VOID *result;
UINT8 CurrentIrql;
struct _KPRCB *CurrentPrcb;
_DWORD *SchedulerAssist;
UINT64 SpinCount;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
LODWORD(result) = KeGetPcr()->Prcb.DpcRequestSummary;
if( ((unsigned int)result & 0x10001) != 0 || (PROCESS->Pcb._bf_0 & 0x400) != 0 )
KeBugCheckEx(
5u,
PROCESS,
CurrentThread->Tcb.ApcState.Process,
(PVOID)CurrentThread->Tcb.ApcStateIndex,
(PVOID)(KeGetPcr()->Prcb._bf_0 & 0x10001));
if( CurrentThread->Tcb.ApcState.Process == PROCESS )
{
ApcState->Process = (_EPROCESS *)1;
}
else
{
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
LODWORD(SpinCount) = 0;
while( _interlockedbittestandset64((volatile signed __int32 *)&CurrentThread->Tcb.ThreadLock, 0i64) )
{
do
KeYieldProcessorEx(&SpinCount);
while( CurrentThread->Tcb.ThreadLock );
SchedulerAssist = CurrentPrcb->SchedulerAssist;
if( SchedulerAssist && CurrentPrcb->NestingLevel <= 1u )
++SchedulerAssist[6];
}
if( CurrentThread->Tcb.ApcStateIndex )
{
KiAttachProcess(&CurrentThread->Tcb, &PROCESS->Pcb, CurrentIrql, 0i64, ApcState);
}
else
{
KiAttachProcess(&CurrentThread->Tcb, &PROCESS->Pcb, CurrentIrql, 0i64, &CurrentThread->Tcb.SavedApcState);
ApcState->Process = 0i64;
}
}
return result;
}Referenced by:
CmpStartCLFSLog
DbgkpPostFakeThreadMessages
EtwpEnableGuid
KiLogUserCetSetContextIpValidationFailureWorker
MiDeleteAllHardwareEnclaves
MmQueryVirtualMemory
NtFreeUserPhysicalPages
NtGetWriteWatch
NtInitializeEnclave
NtLoadEnclaveData
NtLockVirtualMemory
NtProtectVirtualMemory
NtPssCaptureVaSpaceBulk
NtQueryInformationProcess
NtResetWriteWatch
NtSetInformationProcess
NtSetInformationVirtualMemory
NtUnlockVirtualMemory
PfSnAppLaunchScenarioControl
PsCreateMinimalProcess
PspAllocateProcess
PspApplyWorkingSetLimits
PspCatchCriticalBreak
PspProcessDynamicEnforcedAddressRanges
PspQueryQuotaLimits
PspSetQuotaLimits