A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #30244  by sima
 Tue Apr 18, 2017 3:35 pm
HI guys!

I'm looking for a reliable way to implement thread context switching callback. I've already tried to do these approaches:
1) Register windows timer for each CPU with minimal period and check if current CPU thread was changed. As I discovered it's unreliable way due to timer accuracy - I miss some context switch events. Also, AFAIK, high resolution timers are significantly increase power demands.
2) Queuing APC to all threads and get APC executed each time a new thread is scheduled. But I need to register new APC to get such event next time and it is impossible in context of an APC execution. Also KeInsertQueueApc could change thread scheduler behaviour and I think it isn't good.

Please give me some advices about this task. Maybe I'm missing something, especially in the second approach?

I really appreciate any help you can provide.