PspGetBaseTrapFrame(x64)

来源:互联网 发布:毒品是谁发明的知乎 编辑:程序博客网 时间:2024/05/16 03:16
typedef struct _KERNEL_STACK_SEGMENT{ULONG_PTR StackBase;ULONG_PTR StackLimit;ULONG_PTR KernelStack;ULONG_PTR InitialStack;ULONG_PTR ActualLimit;} KERNEL_STACK_SEGMENT, *PKERNEL_STACK_SEGMENT;typedef struct _KERNEL_STACK_CONTROL{union {XMM_SAVE_AREA32 XmmSaveArea;struct {UCHAR Fill[sizeof(XMM_SAVE_AREA32) - 2 * sizeof(KERNEL_STACK_SEGMENT)];KERNEL_STACK_SEGMENT Current;KERNEL_STACK_SEGMENT Previous;};};} KERNEL_STACK_CONTROL, *PKERNEL_STACK_CONTROL;typedef struct _KTHREAD {DISPATCHER_HEADER Header;LIST_ENTRY MutantListHead;PVOID InitialStack;PVOID StackLimit;PVOID KernelStack;} KTHREAD, *PKTHREAD, *PRKTHREAD;typedef struct _ETHREAD {KTHREAD Tcb;} ETHREAD, *PETHREAD;#define KERNEL_STACK_CONTROL_LENGTH sizeof(KERNEL_STACK_CONTROL)#define KTRAP_FRAME_LENGTH sizeof(KTRAP_FRAME)FORCEINLINE PKTRAP_FRAME PspGetBaseTrapFrame(PETHREAD Thread){ULONG64 InitialStack;PKERNEL_STACK_CONTROL StackControl;InitialStack = (ULONG64)Thread->Tcb.InitialStack;StackControl = (PKERNEL_STACK_CONTROL)InitialStack;while (StackControl->Previous.StackBase != 0){InitialStack = StackControl->Previous.InitialStack;StackControl = (PKERNEL_STACK_CONTROL)InitialStack;}return (PKTRAP_FRAME)(InitialStack - KTRAP_FRAME_LENGTH);}

0 0
原创粉丝点击