当前位置： 首页 > news >正文

ExpTimerApcRoutine函数分析之作用是ActiveTimerListHead里面移除定时器_etimer

news 2025/7/1 17:12:30


第一部分：
VOID
ExpTimerApcRoutine (
    IN PKAPC Apc,
    IN PKNORMAL_ROUTINE *NormalRoutine,
    IN PVOID *NormalContext,
    IN PVOID *SystemArgument1,
    IN PVOID *SystemArgument2
    )

/*++

Routine Description:

    This function is the special APC routine that is called to remove
    a timer from the current thread's active timer list.

Arguments:

    Apc - Supplies a pointer to the APC object used to invoke this routine.

    NormalRoutine - Supplies a pointer to a pointer to the normal routine
        function that was specified when the APC was initialized.

    NormalContext - Supplies a pointer to a pointer to an arbitrary data
        structure that was specified when the APC was initialized.

    SystemArgument1, SystemArgument2 - Supplies a set of two pointers to
        two arguments that contain untyped data.

Return Value:

    None.

--*/

{

    PETHREAD ExThread;
    PETIMER ExTimer;
    KIRQL OldIrql1;
    ULONG DerefCount;

    UNREFERENCED_PARAMETER (NormalContext);
    UNREFERENCED_PARAMETER (SystemArgument1);
    UNREFERENCED_PARAMETER (SystemArgument2);

    //
    // Get address of executive timer object and the current thread object.
    //

    ExThread = PsGetCurrentThread();
    ExTimer = CONTAINING_RECORD(Apc, ETIMER, TimerApc);

    //
    // If the timer is still in the current thread's active timer list, then
    // remove it if it is not a periodic timer and set APC associated FALSE.
    // It is possible for the timer not to be in the current thread's active
    // timer list since the APC could have been delivered, and then another
    // thread could have set the timer again with another APC. This would
    // have caused the timer to be removed from the current thread's active
    // timer list.
    //
    // N. B. The spin locks for the timer and the active timer list must be
    //  acquired in the order: 1) timer lock, 2) thread list lock.
    //

    DerefCount = 1;
    ExAcquireSpinLock(&ExTimer->Lock, &OldIrql1);
    ExAcquireSpinLockAtDpcLevel(&ExThread->ActiveTimerListLock);
    if ((ExTimer->ApcAssociated) && (&ExThread->Tcb == ExTimer->TimerApc.Thread)) {
        if (ExTimer->Period == 0) {
            RemoveEntryList(&ExTimer->ActiveTimerListEntry);
            ExTimer->ApcAssociated = FALSE;
            DerefCount++;
        }

    } else {
        *NormalRoutine = (PKNORMAL_ROUTINE)NULL;
    }

    ExReleaseSpinLockFromDpcLevel(&ExThread->ActiveTimerListLock);
    ExReleaseSpinLock(&ExTimer->Lock, OldIrql1);

    ObDereferenceObjectEx(ExTimer, DerefCount);

    return;
}


1: kd> dv
            Apc = 0x893b13b0
  NormalRoutine = 0xba30ed48
  NormalContext = 0xba30ed3c
SystemArgument1 = 0xba30ed40
SystemArgument2 = 0xba30ed44
       OldIrql1 = 0x89 ''
     DerefCount = 0x3d


1: kd> dt kapc 893b13b0
CSRSRV!KAPC
   +0x000 Type             : 0n18
   +0x002 Size             : 0n48
   +0x004 Spare0           : 0x220
   +0x008 Thread           : 0x896d9da0 _KTHREAD
   +0x00c ApcListEntry     : _LIST_ENTRY [ 0x896d9ddc - 0x896d9ddc ]
   +0x014 KernelRoutine    : 0x80af2e9a     void  nt!ExpTimerApcRoutine+0
   +0x018 RundownRoutine   : (null)
   +0x01c NormalRoutine    : 0x7340a79a     void  +7340a79a
   +0x020 NormalContext    : (null)
   +0x024 SystemArgument1  : 0x3218d5d4 Void
   +0x028 SystemArgument2  : 0x01db94bc Void
   +0x02c ApcStateIndex    : 0 ''
   +0x02d ApcMode          : 1 ''
   +0x02e Inserted         : 0x1 ''


    ExTimer = CONTAINING_RECORD(Apc, ETIMER, TimerApc);


//
// Executive timer object structure definition.
//

typedef struct _ETIMER {
    KTIMER KeTimer;
    KAPC TimerApc;
    KDPC TimerDpc;
    LIST_ENTRY ActiveTimerListEntry;
    KSPIN_LOCK Lock;
    LONG Period;
    BOOLEAN ApcAssociated;
    BOOLEAN WakeTimer;
    LIST_ENTRY WakeTimerListEntry;
} ETIMER, *PETIMER;

1: kd> dt _etimer 893b13b0-28
nt!_ETIMER
   +0x000 KeTimer          : _KTIMER
   +0x028 TimerApc         : _KAPC
   +0x058 TimerDpc         : _KDPC
   +0x078 ActiveTimerListEntry : _LIST_ENTRY [ 0x896d9f8c - 0x896d9f8c ]
   +0x080 Lock             : 0
   +0x084 Period           : 0n0
   +0x088 ApcAssociated    : 0x1 ''
   +0x089 WakeTimer        : 0 ''
   +0x08c WakeTimerListEntry : _LIST_ENTRY [ 0x0 - 0x5000000 ]
1: kd> dx -id 0,0,89601250 -r1 (*((ntkrnlmp!_KAPC *)0x893b13b0))
(*((ntkrnlmp!_KAPC *)0x893b13b0))                 [Type: _KAPC]
    [+0x000] Type             : 18 [Type: short]
    [+0x002] Size             : 48 [Type: short]
    [+0x004] Spare0           : 0x220 [Type: unsigned long]
    [+0x008] Thread           : 0x896d9da0 [Type: _KTHREAD *]
    [+0x00c] ApcListEntry     [Type: _LIST_ENTRY]
    [+0x014] KernelRoutine    : 0x80af2e9a [Type: void (*)(_KAPC *,void (**)(void *,void *,void *),void * *,void * *,void * *)]
    [+0x018] RundownRoutine   : 0x0 [Type: void (*)(_KAPC *)]
    [+0x01c] NormalRoutine    : 0x7340a79a [Type: void (*)(void *,void *,void *)]
    [+0x020] NormalContext    : 0x0 [Type: void *]
    [+0x024] SystemArgument1  : 0x3218d5d4 [Type: void *]
    [+0x028] SystemArgument2  : 0x1db94bc [Type: void *]
    [+0x02c] ApcStateIndex    : 0 [Type: char]
    [+0x02d] ApcMode          : 1 [Type: char]
    [+0x02e] Inserted         : 0x0 [Type: unsigned char]
1: kd> dx -id 0,0,89601250 -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x893b1400))
(*((ntkrnlmp!_LIST_ENTRY *)0x893b1400))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x896d9f8c [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x896d9f8c [Type: _LIST_ENTRY *]

0x896d9f8c-0x896d9da0=0x1ec


第二部分：    ExAcquireSpinLockAtDpcLevel(&ExThread->ActiveTimerListLock);之后

ExAcquireSpinLockAtDpcLevel(&ExThread->ActiveTimerListLock);之前
1: kd> dt eTHREAD 896d9da0
ntdll!ETHREAD
   +0x000 Tcb              : _KTHREAD
   +0x1c8 CreateTime       : _LARGE_INTEGER 0x0edca5e1`45f8e6e0
   +0x1c8 NestedFaultCount : 0y00
   +0x1c8 ApcNeeded        : 0y0
   +0x1d0 ExitTime         : _LARGE_INTEGER 0x896d9f70`896d9f70
   +0x1d0 LpcReplyChain    : _LIST_ENTRY [ 0x896d9f70 - 0x896d9f70 ]
   +0x1d0 KeyedWaitChain   : _LIST_ENTRY [ 0x896d9f70 - 0x896d9f70 ]
   +0x1d8 ExitStatus       : 0n0
   +0x1d8 OfsChain         : (null)
   +0x1dc PostBlockList    : _LIST_ENTRY [ 0x896d9f7c - 0x896d9f7c ]
   +0x1e4 TerminationPort  : 0xe15ae778 _TERMINATION_PORT
   +0x1e4 ReaperLink       : 0xe15ae778 _ETHREAD
   +0x1e4 KeyedWaitValue   : 0xe15ae778 Void
   +0x1e8 ActiveTimerListLock : 0
   +0x1ec ActiveTimerListHead : _LIST_ENTRY [ 0x893b1400 - 0x893b1400 ]

ExAcquireSpinLockAtDpcLevel(&ExThread->ActiveTimerListLock);之后

1: kd> dt eTHREAD 896d9da0
ntdll!ETHREAD
   +0x000 Tcb              : _KTHREAD
 
   +0x1e8 ActiveTimerListLock : 0x896d9da1

第三部分：RemoveEntryList(&ExTimer->ActiveTimerListEntry);之后


RemoveEntryList(&ExTimer->ActiveTimerListEntry);之前

1: kd> dt eTHREAD 896d9da0
ntdll!ETHREAD
   +0x000 Tcb              : _KTHREAD
   +0x1c8 CreateTime       : _LARGE_INTEGER 0x0edca5e1`45f8e6e0
   +0x1c8 NestedFaultCount : 0y00
   +0x1c8 ApcNeeded        : 0y0
   +0x1d0 ExitTime         : _LARGE_INTEGER 0x896d9f70`896d9f70
   +0x1d0 LpcReplyChain    : _LIST_ENTRY [ 0x896d9f70 - 0x896d9f70 ]
   +0x1d0 KeyedWaitChain   : _LIST_ENTRY [ 0x896d9f70 - 0x896d9f70 ]
   +0x1d8 ExitStatus       : 0n0
   +0x1d8 OfsChain         : (null)
   +0x1dc PostBlockList    : _LIST_ENTRY [ 0x896d9f7c - 0x896d9f7c ]
   +0x1e4 TerminationPort  : 0xe15ae778 _TERMINATION_PORT
   +0x1e4 ReaperLink       : 0xe15ae778 _ETHREAD
   +0x1e4 KeyedWaitValue   : 0xe15ae778 Void
   +0x1e8 ActiveTimerListLock : 0
   +0x1ec ActiveTimerListHead : _LIST_ENTRY [ 0x893b1400 - 0x893b1400 ]

1: kd> dx -id 0,0,89601250 -r1 (*((ntkrnlmp!_LIST_ENTRY *)0x893b1400))
(*((ntkrnlmp!_LIST_ENTRY *)0x893b1400))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x896d9f8c [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x896d9f8c [Type: _LIST_ENTRY *]


RemoveEntryList(&ExTimer->ActiveTimerListEntry);之后

1: kd> dt eTHREAD 896d9da0
ntdll!ETHREAD
   +0x000 Tcb              : _KTHREAD

   +0x1e8 ActiveTimerListLock : 0x896d9da1
   +0x1ec ActiveTimerListHead : _LIST_ENTRY [ 0x896d9f8c - 0x896d9f8c ]


1: kd> dx -id 0,0,89601250 -r1 (*((ntdll!_LIST_ENTRY *)0x896d9f8c))
(*((ntdll!_LIST_ENTRY *)0x896d9f8c))                 [Type: _LIST_ENTRY]
    [+0x000] Flink            : 0x896d9f8c [Type: _LIST_ENTRY *]
    [+0x004] Blink            : 0x896d9f8c [Type: _LIST_ENTRY *]

第四部分：    ExReleaseSpinLockFromDpcLevel(&ExThread->ActiveTimerListLock);之后
1: kd> dt eTHREAD 896d9da0
ntdll!ETHREAD
   +0x000 Tcb              : _KTHREAD

   +0x1e8 ActiveTimerListLock : 0

第五部分：      ExReleaseSpinLock(&ExTimer->Lock, OldIrql1);之后
1: kd> dt _etimer 893b13b0-28
nt!_ETIMER
   +0x000 KeTimer          : _KTIMER
   +0x028 TimerApc         : _KAPC
   +0x058 TimerDpc         : _KDPC
   +0x078 ActiveTimerListEntry : _LIST_ENTRY [ 0x896d9f8c - 0x896d9f8c ]
   +0x080 Lock             : 0x896d9da1
   +0x084 Period           : 0n0
   +0x088 ApcAssociated    : 0 ''
   +0x089 WakeTimer        : 0 ''
   +0x08c WakeTimerListEntry : _LIST_ENTRY [ 0x0 - 0x5000000 ]

    ExReleaseSpinLock(&ExTimer->Lock, OldIrql1);之后

1: kd> dt _etimer 893b13b0-28
nt!_ETIMER
   +0x000 KeTimer          : _KTIMER
   +0x028 TimerApc         : _KAPC
   +0x058 TimerDpc         : _KDPC
   +0x078 ActiveTimerListEntry : _LIST_ENTRY [ 0x896d9f8c - 0x896d9f8c ]
   +0x080 Lock             : 0
   +0x084 Period           : 0n0
   +0x088 ApcAssociated    : 0 ''
   +0x089 WakeTimer        : 0 ''
   +0x08c WakeTimerListEntry : _LIST_ENTRY [ 0x0 - 0x5000000 ]

http://www.dtcms.com/a/97107.html

相关文章：

  • dockerfile构建镜像方式
  • 前端解决方案：实现网页截图并导出PDF功能
  • 深入解析 JSON-RPC：从基础到高级应用（附调用示例）
  • 第十二章——位运算
  • 通用人工智能（AGI）的发展路径（人工智能通识）
  • 任意文件读取漏洞
  • knowledge-vscode中配置java环境(JDK-8下载，配置 Maven 并创建项目)
  • 图像(numpy)与Base64互转
  • vue create创建 Vue-router 工程
  • AI赋能SEO关键词智能优化
  • VMware虚拟机 ubuntu22.04无法与共享粘贴板和拖拽文件的解决方案
  • 细说AGV叉车的导航,如何精准定位并选取最优路径?
  • NX二次开发刻字功能——预览功能
  • 盈亏平衡分析
  • SWEET-RL：基于训练时信息的多轮LLM代理强化学习框架
  • 计算机二级WPS Office第十二套WPS演示
  • LIMS系统如何构筑染料质检的防线 质检LIMS系统在染料生产企业的应用
  • 在学校图书馆知识库中进行论文检索报告生成
  • 【Kafka】深入探讨 Kafka 如何保证一致性
  • 《白帽子讲 Web 安全》之服务端请求伪造（SSRF）深度剖析：从攻击到防御
  • 【云成本优化案例】K8s计费探针让跨境电商企业节省30%云预算
  • 视频编码器的抉择：x264、x265、libaom、vvenc 对比测试实验
  • 用Python插入Excel表格到Word文档
  • 【linux】常用命令
  • 一次与chatgpt关于VO的深入讨论。
  • 3. 无重复字符的最长子串
  • DeepSeek-V3新版本DeepSeek-V3-0324
  • Android 中隐藏标题栏和状态栏的方法
  • QCW模式：准连续波驱动在VCSEL激光器中的技术解析与应用价值
  • Transformer MHA KV-Cache技术小结（MHA,GQA,MQA,MLA)