Windows Internals covering windows server 2008 and windows vista- P5: In this chapter, we’ll introduce the key Microsoft Windows operating system concepts and terms we’ll be using throughout this book, such as the Windows API, processes, threads, virtual memory, kernel mode and user mode, objects, handles, security, and the registry. | Because there are certain operations that drivers should not perform when special kernel APCs are disabled it makes sense to call KeGetCurrentIrql to check whether the IRQL is APC level or not which is the only way special kernel APCs could have been disabled. However because the memory manager makes use of guarded mutexes instead this check fails because guarded mutexes do not raise IRQL. Drivers should therefore call KeAreAllApcsDisabled for this purpose. This function checks whether special kernel APCs are disabled and or whether the IRQL is APC level the sure-fire way to detect both guarded mutexes and fast mutexes. Executive Resources Executive resources are a synchronization mechanism that supports shared and exclusive access and like fast mutexes they require that normal kernel-mode APC delivery be disabled before they are acquired. They are also built on dispatcher objects that are only used when there is contention. Executive resources are used throughout the system especially in filesystem drivers. Threads waiting to acquire a resource for shared access wait for a semaphore associated with the resource and threads waiting to acquire a resource for exclusive access wait for an event. A semaphore with unlimited count is used for shared waiters because they can all be woken and granted access to the resource when an exclusive holder releases the resource simply by signaling the semaphore. When a thread waits for exclusive access of a resource that is currently owned it waits on a synchronization event object because only one of the waiters will wake when the event is signaled. Because of the flexibility that shared and exclusive access offers there are a number of functions for acquiring resources ExAcquireResourceSharedLite ExAcquireResourceExclusive-Lite ExAcquireSharedStarveExclusive ExAcquireWaitForExclusive and ExTryToAcquire-ResourceExclusiveLite. These functions are documented in the WDK. EXPERIMENT Listing Acquired executive resources The kernel .
