| 519 | namespace Apc { |
| 520 | _IRQL_requires_max_(APC_LEVEL) |
| 521 | NTSTATUS QueueUserApc(PETHREAD Thread, PKNORMAL_ROUTINE NormalRoutine, PVOID Argument) { |
| 522 | |
| 523 | auto KeInitializeApc = static_cast<_KeInitializeApc>(Importer::GetKernelProcAddress(L"KeInitializeApc")); |
| 524 | auto KeInsertQueueApc = static_cast<_KeInsertQueueApc>(Importer::GetKernelProcAddress(L"KeInsertQueueApc")); |
| 525 | |
| 526 | if (!KeInitializeApc || !KeInsertQueueApc) return STATUS_NOT_IMPLEMENTED; |
| 527 | |
| 528 | // Initializing user APC: |
| 529 | auto UserApc = static_cast<PKAPC>(VirtualMemory::AllocFromPool(sizeof(KAPC))); |
| 530 | KeInitializeApc( |
| 531 | UserApc, |
| 532 | Thread, |
| 533 | OriginalApcEnvironment, |
| 534 | []( |
| 535 | PRKAPC Apc, |
| 536 | PKNORMAL_ROUTINE NormalRoutine, |
| 537 | PVOID NormalContext, |
| 538 | PVOID SystemArgument1, |
| 539 | PVOID SystemArgument2 |
| 540 | ) -> VOID { |
| 541 | UNREFERENCED_PARAMETER(SystemArgument1); |
| 542 | UNREFERENCED_PARAMETER(SystemArgument2); |
| 543 | |
| 544 | if (PsIsThreadTerminating(PsGetCurrentThread())) return; |
| 545 | |
| 546 | #ifdef _AMD64_ |
| 547 | // Fixing APC to Wow64-processes: |
| 548 | using _PsGetCurrentProcessWow64Process = PEPROCESS(NTAPI*)(); |
| 549 | auto GetWow64Process = static_cast<_PsGetCurrentProcessWow64Process>(Importer::GetKernelProcAddress(L"PsGetCurrentProcessWow64Process")); |
| 550 | if (!GetWow64Process || GetWow64Process()) { |
| 551 | PsWrapApcWow64Thread(static_cast<PVOID*>(NormalContext), reinterpret_cast<PVOID*>(NormalRoutine)); |
| 552 | } |
| 553 | #else |
| 554 | UNREFERENCED_PARAMETER(NormalRoutine); |
| 555 | UNREFERENCED_PARAMETER(NormalContext); |
| 556 | #endif |
| 557 | |
| 558 | VirtualMemory::FreePoolMemory(Apc); |
| 559 | }, |
| 560 | NULL, |
| 561 | NormalRoutine, |
| 562 | UserMode, |
| 563 | Argument |
| 564 | ); |
| 565 | |
| 566 | // Enforcing delivery of user APCs: |
| 567 | auto KernelApc = static_cast<PKAPC>(VirtualMemory::AllocFromPool(sizeof(KAPC))); |
| 568 | KeInitializeApc( |
| 569 | KernelApc, |
| 570 | Thread, |
| 571 | OriginalApcEnvironment, |
| 572 | []( |
| 573 | PRKAPC Apc, |
| 574 | PKNORMAL_ROUTINE NormalRoutine, |
| 575 | PVOID NormalContext, |
| 576 | PVOID SystemArgument1, |
| 577 | PVOID SystemArgument2 |
| 578 | ) -> VOID { |
no test coverage detected