Thread Scheduling monitoring

Next, let's talk about the last small topic.
The last time I mentioned that SwapContex was not selected because I wanted to use a hard-coding solution. Later I thought that SwapContex would not need hard-coding, but I used other methods, hook SwapContex is no longer implemented. It was rare to have a holiday two days ago. I wrote it to check the effect.
First, go to SwapContext in 2000 to see what it has done.

0008: 8040422C or cl, CL
0008: 8040422E mov byte ptr es: [ESI + 2D], 02
0008: 80404233 PUSHFD // ESP + 4-> EFLAGS
0008: 80404234 mov ecx, [EBX]
0008: 80404236 cmp dword ptr [EBX + 0000080C], 00
0008: 8040423D push ecx // ESP-> exception list
0008: 8040423E JNZ 80404338
0008: 80404244 mov ebp, CR0
0008: 80404247 mov edx, EBP
0008: 80404249 mov cl, [ESI + 2C]
0008: 80401_c MOV [EBX + 50], CL
0008: 8040366f CLI
0008: 80404250 MOV [EDI + 28], ESP // save ESP to the KernelStack of KTHREAD
0008: 80404253 mov eax, [ESI + 18]
0008: 80404256 mov ecx, [ESI + 1C]
......
Obviously, the ESP + 8 is the return address of the SwapContex function called in the KiSwapThread, which can be used to obtain the SwapContex function address, but it is not necessary to directly hook the address in the KiSwapThread.
The following problem is to find out a non-current thread accessible by the KernelStack, which is very easy. Sample code snippet (tested in 2000/XP ):

PCHAR GetSwapAddr ()
{
PCHAR res = 0;
NTSTATUS Status;
PETHREAD Thread;

If (* NtBuildNumber <= 2195)
Status = PsLookupThreadByThreadId (PVOID) 4, & Thread );
Else
Status = PsLookupThreadByThreadId (PVOID) 8, & Thread );

If (NT_SUCCESS (Status ))
{
If (MmIsAddressValid (Thread ))
Res = (PCHAR) * PULONG (PCHAR (Thread) + 0x28 );
If (MmIsAddressValid (res + 8 ))
Res = (PCHAR) * PULONG (res + 8 );
Else
Res = 0;
}

Return res;
}

PBYTE GoBackAddr = 0;
_ Declspec (naked) VOID HookSwap ()
{
Dbuplint ("% 08x", KeGetCurrentThread ());
_ Asm mov eax, GoBackAddr
_ Asm jmp eax
}

HookSwapFunc ()
{
......
PCHAR SwapAddr = GetSwapAddr ();
If (SwapAddr)
GoBackAddr = HookFunction (SwapAddr, HookSwap );
......
}

The specific implementation of HookFunction code is naturally benevolent.
The following are some results:

4.343 Default SwapAddr = 80404141
4.343 Default 813b8c00
4.343 Default fe995480
4.359 Default 81429660
4.359 Default 81429260
4.359 Default 805e5520
4.359 Default 813e15c0
4.359 Default 8139f500
4.359 Default 8139f260
4.375 Default 805e5520
4.375 Default 812ea140
4.390 Default 805e5520
4.390 Default 8139f500
4.390 Default 8139f260
4.406 Default 805e5520
4.422 Default 805e5520
4.422 Default fe995480
4.422 Default fe995480
4.422 Default fe995480
4.422 Default 8139f500
4.422 Default 8139f260
4.422 Default 813a66e0

You may be wrong if you don't think about it carefully.

Http://www.blogcn.com/user17/pjf/blog/4331410.htm