读书笔记-QueueUserApc/NtQueueAPCThread APC注入I

QueueUserApc/NtQueueAPCThread

    APC等待状态
        SleepEx
            https://docs.microsoft.com/zh-cn/windows/desktop/api/synchapi/nf-synchapi-sleepex
            Suspends the current thread until the specified condition is met. Execution resumes when one of the following occurs:

   *  An I/O completion callback function is called.
   *  An asynchronous procedure call (APC) is queued to the thread.
   *  The time-out interval elapses.

 [popexizhi:

 sleepEx 是当前线程在等待条件满足前自己挂起自己了，这里可以唤醒这个挂起的条件如下:

   *     I/O 完成，回调可运行通知
   *   APC 队列中这个线程排到自己了
   *   等待超过设定的超时时间

   这里看来应该是线程在CPU分到时间片后的，依然锁定自己等待触发条件的过程，这个在APC队列中排列到自己，这个好奇怪，不是太理解场景，本来是自己挂起自己了，这个恢复时自己又排队轮到自己了？又什么应用场景呢？

 ]
        SignalObjectAndWait
            https://docs.microsoft.com/en-us/windows/desktop/api/synchapi/nf-synchapi-signalobjectandwait
            Signals one object and waits on another object as a single operation.

 [popexizhi: 这个一定是要挂起自己了，都给被人发信号等待另外的通知信号了]
        MsgWaitForMultipleObjectsEx
            https://docs.microsoft.com/en-us/windows/desktop/api/Winuser/nf-winuser-msgwaitformultipleobjectsex
            Waits until one or all of the specified objects are in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses. The array of objects can include input event objects, which you specify using the dwWakeMask parameter.



 [popexizhi:

 这个和SleepEx应该是单复数的关系吧？！:)

 等待一个或多个指定对象的信号，I/O 调用完成或者APC队列轮到这个线程，再或者设置时间超时。

 当你指定了 dwWakeMask 参数后，参数可以指定 event objects 事件对象

 ]
        WaitForSingleObjectEx
            https://docs.microsoft.com/zh-cn/windows/desktop/api/synchapi/nf-synchapi-waitforsingleobjectex
            Waits until the specified object is in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses.

 [popexizhi:

 这个和WaitForMultipleObjectsEx是多个和单个的关系

 ]
        WaitForMultipleObjectsEx
            https://docs.microsoft.com/zh-cn/windows/desktop/api/synchapi/nf-synchapi-waitformultipleobjectsex
            Waits until one or all of the specified objects are in the signaled state, an I/O completion routine or asynchronous procedure call (APC) is queued to the thread, or the time-out interval elapses.



 [popexizhi:

 之前有个疑问就是这个WaitForSingle/MutipleObjectsEx和MsgWaitForMultipleObjectsEx的区别，现在知道了，这里没有Msg所以就没有dwWakeMask的参数，Msg和Single还是有差别的。

 ]
        APC-队列触发状态
            https://docs.microsoft.com/zh-cn/windows/desktop/Sync/asynchronous-procedure-calls
            The ReadFileEx, SetWaitableTimer, SetWaitableTimerEx, and WriteFileEx functions are implemented using an APC as the completion notification callback mechanism.
[popexizhi:
可以触发APC队列执行的方法，这里应该是使线程进入了alertable wait state

ReadFileEx
WriteFileEx
SetWaitableTimer
SetWaitableTimerEx

这里的除了特殊定义的SetWaittable，就是直接和IO读写相关了；
之前和他人交流说这个APC队列在进程初始化时一定是被执行的，这个过程按之前的推理应该是进程初始化时，从硬盘读取数据是一个过程会有APC，还有就是windows默认是分配数据为虚拟硬盘，执行时分配真实物理内存，这个过程是一定有IO的，这两个机会都是APC的队列执行位置。
]
            If you are using a thread pool, note that APCs do not work as well as other signaling mechanisms because the system controls the lifetime of thread pool threads, so it is possible for a thread to be terminated before the notification is delivered. Instead of using an APC-based signaling mechanism such as the pfnCompletionRoutine parameter of SetWaitableTimer or SetWaitableTimerEx, use a waitable object such as a timer created with CreateThreadpoolTimer. For I/O, use an I/O completion object created with CreateThreadpoolIo or an hEvent-based OVERLAPPED structure where the event can be passed to the SetThreadpoolWait function.

[popexizhi:标准线程池的使用对APC的执行影响很大，这里要特殊处理使用对应的CreateThreadpoolIo 和 CreateThreadpoolTimer  ]