当前位置：首页 > news >正文

nt!KeWaitForMultipleObjects函数分析之一个例子ExpWorkerThreadBalanceManager

news 来源：原创 2025/5/16 10:35:14

第一部分：
1: kd> dt kTHREAD 8999c8a0

+0x02c State : 0x2 ''

+0x054 WaitBlockList : 0x8999c940 _KWAIT_BLOCK

第一个_KWAIT_BLOCK：

1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c940)
((CSRSRV!_KWAIT_BLOCK *)0x8999c940)                 : 0x8999c940 [Type: _KWAIT_BLOCK *]
    [+0x000] WaitListEntry    [Type: _LIST_ENTRY]
    [+0x008] Thread           : 0x8999c8a0 [Type: _KTHREAD *]
    [+0x00c] Object           : 0xf78fad78 [Type: void *]
    [+0x010] NextWaitBlock    : 0x8999c958 [Type: _KWAIT_BLOCK *]
    [+0x014] WaitKey          : 0x0 [Type: unsigned short]
    [+0x016] WaitType         : 0x1 [Type: unsigned short]

第二个_KWAIT_BLOCK：

1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c958)
((CSRSRV!_KWAIT_BLOCK *)0x8999c958)                 : 0x8999c958 [Type: _KWAIT_BLOCK *]
    [+0x000] WaitListEntry    [Type: _LIST_ENTRY]
    [+0x008] Thread           : 0x8999c8a0 [Type: _KTHREAD *]
    [+0x00c] Object           : 0x80bf5c60 [Type: void *]               //80bf5c60          nt!ExpThreadSetManagerEvent = struct _KEVENT
    [+0x010] NextWaitBlock    : 0x8999c970 [Type: _KWAIT_BLOCK *]
    [+0x014] WaitKey          : 0x1 [Type: unsigned short]
    [+0x016] WaitType         : 0x1 [Type: unsigned short]

1: kd> x nt!ExpThreadSetManagerEvent
80bf5c60 nt!ExpThreadSetManagerEvent = struct _KEVENT

第三个_KWAIT_BLOCK：
1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c970)
((CSRSRV!_KWAIT_BLOCK *)0x8999c970)                 : 0x8999c970 [Type: _KWAIT_BLOCK *]
    [+0x000] WaitListEntry    [Type: _LIST_ENTRY]
    [+0x008] Thread           : 0x8999c8a0 [Type: _KTHREAD *]
    [+0x00c] Object           : 0x80bf5c50 [Type: void *]               //80bf5c50          nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT
    [+0x010] NextWaitBlock    : 0x8999c940 [Type: _KWAIT_BLOCK *]           //返回到   NextWaitBlock    : 0x8999c940结束
    [+0x014] WaitKey          : 0x2 [Type: unsigned short]
    [+0x016] WaitType         : 0x1 [Type: unsigned short]

1: kd> x nt!ExpThreadSetManagerShutdownEvent
80bf5c50 nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT

第二部分：
1: kd> dt ktimer 0xf78fad78                           //Object           : 0xf78fad78
CSRSRV!KTIMER
   +0x000 Header           : _DISPATCHER_HEADER
   +0x010 DueTime          : _ULARGE_INTEGER 0x00002707`bbe04df6
   +0x018 TimerListEntry   : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x020 Dpc              : (null)
   +0x024 Period           : 0n0
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0xf78fad78))
(*((CSRSRV!_DISPATCHER_HEADER *)0xf78fad78))                 [Type: _DISPATCHER_HEADER]
    [+0x000] Type             : 0x8 [Type: unsigned char]
    [+0x001] Absolute         : 0x0 [Type: unsigned char]
    [+0x002] Size             : 0xa [Type: unsigned char]
    [+0x003] Inserted         : 0x0 [Type: unsigned char]
    [+0x003] DebugActive      : 0x0 [Type: unsigned char]
    [+0x000] Lock             : 655368 [Type: long]
    [+0x004] SignalState      : 1 [Type: long]       //定时器到期SignalState      : 1
    [+0x008] WaitListHead     [Type: _LIST_ENTRY]

DueTime.QuadPart = - THREAD_SET_INTERVAL;

#define THREAD_SET_INTERVAL (1 * 1000 * 1000 * 10)

1: kd> dt kevent 0x80bf5c60               80bf5c60          nt!ExpThreadSetManagerEvent = struct _KEVENT
CSRSRV!KEVENT
   +0x000 Header           : _DISPATCHER_HEADER
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c60))
(*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c60))                 [Type: _DISPATCHER_HEADER]
    [+0x000] Type             : 0x1 [Type: unsigned char]
    [+0x001] Absolute         : 0x0 [Type: unsigned char]
    [+0x002] Size             : 0x4 [Type: unsigned char]
    [+0x003] Inserted         : 0x0 [Type: unsigned char]
    [+0x003] DebugActive      : 0x0 [Type: unsigned char]
    [+0x000] Lock             : 262145 [Type: long]
    [+0x004] SignalState      : 0 [Type: long]
    [+0x008] WaitListHead     [Type: _LIST_ENTRY]

1: kd> dt kevent 0x80bf5c50           //80bf5c50          nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT
CSRSRV!KEVENT
   +0x000 Header           : _DISPATCHER_HEADER
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c50))
(*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c50))                 [Type: _DISPATCHER_HEADER]
    [+0x000] Type             : 0x1 [Type: unsigned char]
    [+0x001] Absolute         : 0x0 [Type: unsigned char]
    [+0x002] Size             : 0x4 [Type: unsigned char]
    [+0x003] Inserted         : 0x0 [Type: unsigned char]
    [+0x003] DebugActive      : 0x0 [Type: unsigned char]
    [+0x000] Lock             : 262145 [Type: long]
    [+0x004] SignalState      : 0 [Type: long]
    [+0x008] WaitListHead     [Type: _LIST_ENTRY]

第三部分：
VOID
ExpWorkerThreadBalanceManager (
IN PVOID StartContext
)

{
    KTIMER PeriodTimer;
    LARGE_INTEGER DueTime;
    PVOID WaitObjects[MaximumBalanceObject];
    NTSTATUS Status;

PAGED_CODE();

UNREFERENCED_PARAMETER (StartContext);

    //
    // Raise the thread priority to just higher than the priority of the
    // critical work queue.
    //

KeSetBasePriorityThread (KeGetCurrentThread(),
CRITICAL_WORK_QUEUE_PRIORITY + 1);

    //
    // Initialize the periodic timer and set the manager period.
    //

KeInitializeTimer (&PeriodTimer);
DueTime.QuadPart = - THREAD_SET_INTERVAL;

    //
    // Initialize the wait object array.
    //

    WaitObjects[TimerExpiration] = (PVOID)&PeriodTimer;
    WaitObjects[ThreadSetManagerEvent] = (PVOID)&ExpThreadSetManagerEvent;
    WaitObjects[ShutdownEvent] = (PVOID)&ExpThreadSetManagerShutdownEvent;

    //
    // Loop forever processing events.
    //

while (TRUE) {

        //
        // Set the timer to expire at the next periodic interval.
        //

KeSetTimer (&PeriodTimer, DueTime, NULL);

        //
        // Wake up when the timer expires or the set manager event is
        // signalled.
        //

        Status = KeWaitForMultipleObjects (MaximumBalanceObject,
                                           WaitObjects,
                                           WaitAny,
                                           Executive,
                                           KernelMode,
                                           FALSE,
                                           NULL,
                                           NULL);

switch (Status) {

case TimerExpiration:

                //
                // Periodic timer expiration - go see if any work queues
                // are deadlocked.
                //

ExpDetectWorkerThreadDeadlock ();
break;

case ThreadSetManagerEvent:

                //
                // Someone has asked us to check some metrics to determine
                // whether we should create another worker thread.
                //

ExpCheckDynamicThreadCount ();
break;

case ShutdownEvent:

                //
                // Time to exit...
                //

KeCancelTimer (&PeriodTimer);

ASSERT (ExpLastWorkerThread);

                //
                // Wait for the last worker thread to terminate
                //

                KeWaitForSingleObject (ExpLastWorkerThread,
                                       Executive,
                                       KernelMode,
                                       FALSE,
                                       NULL);

ObDereferenceObject (ExpLastWorkerThread);

PsTerminateSystemThread(STATUS_SYSTEM_SHUTDOWN);

break;
}

        //
        // Special debugger support.
        //
        // This checks if special debugging routines need to be run on the
        // behalf of the debugger.
        //

if (ExpDebuggerWork == 1) {

             ExInitializeWorkItem(&ExpDebuggerWorkItem, ExpDebuggerWorker, NULL);
             ExpDebuggerWork = 2;
             ExQueueWorkItem(&ExpDebuggerWorkItem, DelayedWorkQueue);
        }
    }
}

第四部分：case TimerExpiration:分支

#define STATUS_KERNEL_APC 0x100

//
// Define balance set wait object types.
//

typedef enum _BALANCE_OBJECT {
    TimerExpiration,
    ThreadSetManagerEvent,
    ShutdownEvent,
    MaximumBalanceObject
} BALANCE_OBJECT;

switch (Status) {

case TimerExpiration:

                //
                // Periodic timer expiration - go see if any work queues
                // are deadlocked.
                //

ExpDetectWorkerThreadDeadlock ();
break;

第五部分：ExpDetectWorkerThreadDeadlock
//
// Worker Thread
//

typedef enum _WORK_QUEUE_TYPE {
    CriticalWorkQueue,
    DelayedWorkQueue,
    HyperCriticalWorkQueue,
    MaximumWorkQueue
} WORK_QUEUE_TYPE;

1: kd> x nt!ExWorkerQueue
80bf5c80          nt!ExWorkerQueue = struct _EX_WORK_QUEUE [3]
80bf5c80          nt!ExWorkerQueue = struct _EX_WORK_QUEUE []
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE (*)[3])0x80bf5c80))
(*((ntkrnlmp!_EX_WORK_QUEUE (*)[3])0x80bf5c80))                 [Type: _EX_WORK_QUEUE [3]]
    [0]              [Type: _EX_WORK_QUEUE]
    [1]              [Type: _EX_WORK_QUEUE]
    [2]              [Type: _EX_WORK_QUEUE]
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5c80))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5c80))                 [Type: _EX_WORK_QUEUE]
    [+0x000] WorkerQueue      [Type: _KQUEUE]
    [+0x028] DynamicThreadCount : 0x0 [Type: unsigned long]
    [+0x02c] WorkItemsProcessed : 0x240 [Type: unsigned long]
    [+0x030] WorkItemsProcessedLastPass : 0x23f [Type: unsigned long]
    [+0x034] QueueDepthLastPass : 0x0 [Type: unsigned long]
    [+0x038] Info             [Type: EX_QUEUE_WORKER_INFO]
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cbc))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cbc))                 [Type: _EX_WORK_QUEUE]
    [+0x000] WorkerQueue      [Type: _KQUEUE]
    [+0x028] DynamicThreadCount : 0x0 [Type: unsigned long]
    [+0x02c] WorkItemsProcessed : 0x16c [Type: unsigned long]
    [+0x030] WorkItemsProcessedLastPass : 0x16a [Type: unsigned long]
    [+0x034] QueueDepthLastPass : 0x0 [Type: unsigned long]
    [+0x038] Info             [Type: EX_QUEUE_WORKER_INFO]
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cf8))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cf8))                 [Type: _EX_WORK_QUEUE]
    [+0x000] WorkerQueue      [Type: _KQUEUE]
    [+0x028] DynamicThreadCount : 0x0 [Type: unsigned long]
    [+0x02c] WorkItemsProcessed : 0x7a [Type: unsigned long]
    [+0x030] WorkItemsProcessedLastPass : 0x79 [Type: unsigned long]
    [+0x034] QueueDepthLastPass : 0x0 [Type: unsigned long]
    [+0x038] Info             [Type: EX_QUEUE_WORKER_INFO]