KeStackAttachProcess routine

The KeStackAttachProcess routine attaches the current thread to the address space of the target process.

Caution  Use this routine with extreme caution. (See the note in the Remarks section.)
 

Syntax


VOID KeStackAttachProcess(
  _Inout_ PRKPROCESS   Process,
  _Out_   PRKAPC_STATE ApcState
);

Parameters

Process [in, out]

Pointer to the target process object. This parameter can be a PEPROCESS pointer returned by IoGetCurrentProcess or PsGetCurrentProcess.

ApcState [out]

An opaque pointer to a KAPC_STATE structure. The caller must allocate storage for this structure either from nonpaged pool or from the caller's own thread stack.

Return value

None

Remarks

KeStackAttachProcess attaches the current thread to the address space of the process pointed to by the Process parameter. If the current thread was already attached to another process, the ApcState parameter receives the current APC state before KeStackAttachProcess attaches to the new process.

Every call to KeStackAttachProcess must be matched by a subsequent call to KeUnstackDetachProcess.

Note   Attaching a thread to a different process can prevent asynchronous I/O operations from completing and can potentially cause deadlocks. In general, the lines of code between the call to KeStackAttachProcess and the call to KeUnstackDetachProcess should be very simple and should not call complex routines or send IRPs to other drivers.
 

For more information about using system threads and managing synchronization within a nonarbitrary thread context, see Driver Threads, Dispatcher Objects, and Resources.

Requirements

Target platform

Universal

Version

This routine is available on Microsoft Windows 2000 and later.

Header

Ntifs.h (include Ntifs.h or Fltkernel.h)

Library

NtosKrnl.lib

DLL

NtosKrnl.exe

IRQL

< DISPATCH_LEVEL

See also

IoGetCurrentProcess
IoGetRequestorProcess
IoThreadToProcess
KeGetCurrentIrql
KeGetCurrentThread
KeUnstackDetachProcess
PsGetCurrentProcess
PsGetCurrentThread

 

 

Send comments about this topic to Microsoft

Show: