NTSTATUS NTAPI INIT_FUNCTION PspLookupKernelUserEntryPoints(VOID) { NTSTATUS Status; /* Get user-mode APC trampoline */ Status = PspLookupSystemDllEntryPoint("KiUserApcDispatcher", &KeUserApcDispatcher); if (!NT_SUCCESS(Status)) return Status; /* Get user-mode exception dispatcher */ Status = PspLookupSystemDllEntryPoint("KiUserExceptionDispatcher", &KeUserExceptionDispatcher); if (!NT_SUCCESS(Status)) return Status; /* Get user-mode callback dispatcher */ Status = PspLookupSystemDllEntryPoint("KiUserCallbackDispatcher", &KeUserCallbackDispatcher); if (!NT_SUCCESS(Status)) return Status; /* Get user-mode exception raise trampoline */ Status = PspLookupSystemDllEntryPoint("KiRaiseUserExceptionDispatcher", &KeRaiseUserExceptionDispatcher); if (!NT_SUCCESS(Status)) return Status; /* Get user-mode SLIST exception functions for page fault rollback race hack */ Status = PspLookupSystemDllEntryPoint("ExpInterlockedPopEntrySListEnd", &KeUserPopEntrySListEnd); if (!NT_SUCCESS(Status)) { DPRINT1("this not found\n"); return Status; } Status = PspLookupSystemDllEntryPoint("ExpInterlockedPopEntrySListFault", &KeUserPopEntrySListFault); if (!NT_SUCCESS(Status)) { DPRINT1("this not found\n"); return Status; } Status = PspLookupSystemDllEntryPoint("ExpInterlockedPopEntrySListResume", &KeUserPopEntrySListResume); if (!NT_SUCCESS(Status)) { DPRINT1("this not found\n"); return Status; } /* On x86, there are multiple ways to do a system call, find the right stubs */ #if defined(_X86_) /* Check if this is a machine that supports SYSENTER */ if (KeFeatureBits & KF_FAST_SYSCALL) { /* Get user-mode sysenter stub */ SharedUserData->SystemCall = (PsNtosImageBase >> (PAGE_SHIFT + 1)); Status = PspLookupSystemDllEntryPoint("KiFastSystemCall", (PVOID)&SharedUserData-> SystemCall); if (!NT_SUCCESS(Status)) return Status; /* Get user-mode sysenter return stub */ Status = PspLookupSystemDllEntryPoint("KiFastSystemCallRet", (PVOID)&SharedUserData-> SystemCallReturn); if (!NT_SUCCESS(Status)) return Status; }
NTSTATUS PspLookupKernelUserEntryPoints ( VOID ) /*++ Routine Description: The function locates the address of the exception dispatch and user APC delivery routine in the system DLL and stores the respective addresses in the PCR. Arguments: None. Return Value: NTSTATUS --*/ { NTSTATUS Status; PSZ EntryName; // // Lookup the user mode "trampoline" code for exception dispatching // EntryName = "KiUserExceptionDispatcher"; Status = PspLookupSystemDllEntryPoint(EntryName, (PVOID *)&KeUserExceptionDispatcher); if (NT_SUCCESS(Status) == FALSE) { KdPrint(("Ps: Cannot find user exception dispatcher address\n")); return Status; } // // Lookup the user mode "trampoline" code for APC dispatching // EntryName = "KiUserApcDispatcher"; Status = PspLookupSystemDllEntryPoint(EntryName, (PVOID *)&KeUserApcDispatcher); if (NT_SUCCESS(Status) == FALSE) { KdPrint(("Ps: Cannot find user apc dispatcher address\n")); return Status; } // // Lookup the user mode "trampoline" code for callback dispatching. // EntryName = "KiUserCallbackDispatcher"; Status = PspLookupSystemDllEntryPoint(EntryName, (PVOID *)&KeUserCallbackDispatcher); if (NT_SUCCESS(Status) == FALSE) { KdPrint(("Ps: Cannot find user callback dispatcher address\n")); return Status; } // // Lookup the user mode "trampoline" code for raising a usermode exception // EntryName = "KiRaiseUserExceptionDispatcher"; Status = PspLookupSystemDllEntryPoint(EntryName, (PVOID *)&KeRaiseUserExceptionDispatcher); if (NT_SUCCESS(Status) == FALSE) { KdPrint(("Ps: Cannot find raise user exception dispatcher address\n")); return Status; } return Status; }