news 2026/5/25 15:56:38

hal!KfLowerIrql函数分析和全局变量数组hal!HalpIRQLtoTPR和hal!_HalpVectorToIRQL和APIC_TPR寄存器的关系

作者头像

张小明

前端开发工程师

1.2k 24
文章封面图
hal!KfLowerIrql函数分析和全局变量数组hal!HalpIRQLtoTPR和hal!_HalpVectorToIRQL和APIC_TPR寄存器的关系

hal!KfLowerIrql函数分析和nt!KeRaiseIrql函数分析

hal!HalpIRQLtoTPR

hal!_HalpVectorToIRQL

ds:[FFFE0080h]

ifdef _APIC_TPR_

APIC_TPR equ dword ptr ds:0FFFE0080h

0: kd> x hal!_HalpVectorToIRQL
804fa21c hal!HalpVectorToIRQL = unsigned char [] ""
804fa21c hal!_HalpVectorToIRQL = 0x00 ''
0: kd> db 804fa21c
804fa21c 00 ff ff 01 02 ff 05 06-07 08 09 0a 1b 1c 1d 1e ................
804fa22c 00 00 00 00 00 00 00 00-08 10 00 00 00 00 00 00 ................
804fa23c 00 00 00 00 00 00 00 00-00 00 80 00 00 00 00 00 ................
804fa24c 00 00 00 00 00 00 00 00-02 00 00 00 02 00 00 00 ................
804fa25c e0 51 4f 80 00 00 00 00-00 00 00 00 00 00 00 00 .QO.............
804fa26c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
804fa27c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
804fa28c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................

0: kd> x hal!HalpIRQLtoTPR
804edbb8 hal!HalpIRQLtoTPR = unsigned char [] ""
0: kd> db 804edbb8
804edbb8 00 3d 41 41 51 61 71 81-91 a1 b1 b1 b1 b1 b1 b1 .=AAQaq.........
804edbc8 b1 b1 b1 b1 b1 b1 b1 b1-b1 b1 b1 c1 d1 e1 ef ff ................
804edbd8 0f b6 d1 0f b6 8a b8 db-4e 80 a1 80 00 fe ff 89 ........N.......
804edbe8 0d 80 00 fe ff c1 e8 04-0f b6 80 1c a2 4f 80 c3 .............O..
804edbf8 8b 15 80 00 fe ff c7 05-80 00 fe ff 41 00 00 00 ............A...
804edc08 c1 ea 04 0f b6 82 1c a2-4f 80 c3 90 8b 15 80 00 ........O.......
804edc18 fe ff c7 05 80 00 fe ff-c1 00 00 00 c1 ea 04 0f ................
804edc28 b6 82 1c a2 4f 80 c3 90-33 c0 8a c1 8b 0d 80 00 ....O...3.......

cPublicFastCall KfLowerIrql ,1
cPublicFpo 0,0

xor eax, eax
mov al, cl ; get new irql value

if DBG
;
; Make sure we are not lowering to ABOVE current level
;

mov ecx, dword ptr APIC[LU_TPR] ; (ebx) = Old Priority
shr ecx, 4
movzx ecx, _HalpVectorToIRQL[ecx] ; get IRQL for Old Priority
cmp al, cl
jbe short KliDbg
push ecx ; new irql for debugging
push eax ; old irql for debugging
stdCall _KeBugCheck, <IRQL_NOT_LESS_OR_EQUAL>
KliDbg:
endif
xor ecx, ecx ; Avoid a partial stall
mov cl, _HalpIRQLtoTPR[eax] ; get TPR value corresponding to IRQL
mov dword ptr APIC[LU_TPR], ecx

;
; We have to ensure that the requested priority is set before
; we return. The caller is counting on it.
;
mov eax, dword ptr APIC[LU_TPR]

if DBG
cmp ecx, eax ; Verify IRQL read back is same as
je short @f ; set value
int 3
@@:
endif
fstRET KfLowerIrql
fstENDP KfLowerIrql


参考：c语言版

KIRQL
FORCEINLINE
KeGetCurrentIrql (
VOID
)
{
ULONG tprValue;
KIRQL currentIrql;

tprValue = *APIC_TPR;
currentIrql = HalpVectorToIRQL[ tprValue / 16 ];
return currentIrql;
}

VOID
FORCEINLINE
KfLowerIrql (
IN KIRQL NewIrql
)
{
ULONG tprValue;

ASSERT( NewIrql <= KeGetCurrentIrql() );

tprValue = HalpIRQLToTPR[NewIrql];
KeMemoryBarrier();
*APIC_TPR = tprValue;
*APIC_TPR;
KeMemoryBarrier();
}
参考：c语言版

0: kd> p
eax=00000000 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc32 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x2:
804edc32 8ac1 mov al,cl
0: kd> kc
#
00 hal!KfLowerIrql
01 nt!KeInsertQueueDpc
02 USBPORT!USBPORT_InterruptService
03 nt!KiInterruptDispatch
04 hal!WRITE_PORT_UCHAR
05 PCIIDEX!BmArm
06 atapi!IdeReadWrite
07 atapi!IdeSendCommand
08 atapi!AtapiStartIo
09 atapi!IdeStartIoSynchronized
0a nt!KeSynchronizeExecution
0b atapi!IdePortAllocateAccessToken
0c PCIIDEX!BmReceiveScatterGatherList
0d hal!HalBuildScatterGatherList
0e hal!HalGetScatterGatherList
0f PCIIDEX!BmSetup
10 atapi!IdePortStartIo
11 nt!IoStartPacket
12 atapi!IdePortDispatch
13 nt!IofCallDriver
14 CLASSPNP!SubmitTransferPacket
15 CLASSPNP!ServiceTransferRequest
16 CLASSPNP!ClassReadWrite
17 nt!IofCallDriver
18 PartMgr!PmReadWrite
19 nt!IofCallDriver
1a ftdisk!FtDiskReadWrite
1b nt!IofCallDriver
1c volsnap!VolSnapWrite
1d nt!IofCallDriver
1e Ntfs!NtfsSingleAsync
1f Ntfs!NtfsNonCachedIo
20 Ntfs!NtfsCommonWrite
21 Ntfs!NtfsFsdWrite
22 nt!IofCallDriver
23 nt!IoSynchronousPageWrite
24 nt!MiFlushSectionInternal
25 nt!MmFlushSection
26 nt!CcFlushCache
27 Ntfs!NtfsCheckpointVolume
28 Ntfs!NtfsCheckpointAllVolumes
29 nt!ExpWorkerThread
2a nt!PspSystemThreadStartup
2b nt!KiThreadStartup
0: kd> kv 5
# ChildEBP RetAddr Args to Child
00 f78cdcb8 80a36622 89620bb0 898d4608 105ee601 hal!KfLowerIrql+0x2 (FPO: [0,0,0]) [d:\srv03rtm\base\hals\halmps\i386\mpirql.asm @ 319]
01 f78cdcd4 baed5f37 018d4608 898d460c 00000000 nt!KeInsertQueueDpc+0x19e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\dpcobj.c @ 439]
02 f78cdcf0 80b003ed 89620bb0 898d4030 00010007 USBPORT!USBPORT_InterruptService+0x93 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\int.c @ 106]
03 f78cdcf0 804f4d71 89620bb0 898d4030 00010007 nt!KiInterruptDispatch+0x8d (FPO: [0,2] TrapFrame @ f78cdd14) [d:\srv03rtm\base\ntos\ke\i386\intsup.asm @ 777]
04 f78cdd84 f73a91bb 000010c0 00000001 8948cf14 hal!WRITE_PORT_UCHAR+0x9 (FPO: [2,0,0]) [d:\srv03rtm\base\hals\halx86\i386\xxioacc.asm @ 241]

#define PASSIVE_LEVEL 0 // Passive release level
#define LOW_LEVEL 0 // Lowest interrupt level
#define APC_LEVEL 1 // APC interrupt level
#define DISPATCH_LEVEL 2 // Dispatcher level

#define PROFILE_LEVEL 27 // timer used for profiling.
#define CLOCK1_LEVEL 28 // Interval clock 1 level - Not used on x86
#define CLOCK2_LEVEL 28 // Interval clock 2 level
#define IPI_LEVEL 29 // Interprocessor interrupt level
#define POWER_LEVEL 30 // Power failure level
#define HIGH_LEVEL 31 // Highest interrupt level


KeRaiseIrql(HIGH_LEVEL, &OldIrql); 比时钟中断的优先级还要高！！！

BOOLEAN
KeInsertQueueDpc (
IN PRKDPC Dpc,
IN PVOID SystemArgument1,
IN PVOID SystemArgument2
)
{

KeRaiseIrql(HIGH_LEVEL, &OldIrql); OldIrql=eax=00000007


KeLowerIrql(OldIrql); OldIrql=eax=00000007
return Inserted;
}


VOID
KeRaiseIrql (
IN KIRQL NewIrql,
OUT PKIRQL OldIrql
)
{
*OldIrql = KfRaiseIrql (NewIrql);
}

KIRQL
FORCEINLINE
KfRaiseIrql (
IN KIRQL NewIrql
)
{
KIRQL oldIrql;
ULONG tprValue;

oldIrql = KeGetCurrentIrql();
ASSERT( NewIrql >= oldIrql );

tprValue = HalpIRQLToTPR[NewIrql];

KeMemoryBarrier();
*APIC_TPR = tprValue;
KeMemoryBarrier();

return oldIrql;
}


0: kd> p
eax=00000002 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608
eip=80a3661c esp=f78cdcc0 ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeInsertQueueDpc+0x198:
80a3661c ff150431a080 call dword ptr [nt!_imp_KfLowerIrql (80a03104)] ds:0023:80a03104={hal!KfLowerIrql (804edc30)}
0: kd> t
eax=00000002 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc30 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql:
804edc30 33c0 xor eax,eax
0: kd> p
eax=00000000 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc32 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x2:
804edc32 8ac1 mov al,cl

0: kd> p
eax=00000007 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608 OldIrql=eax=00000007
eip=804edc34 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x4:
804edc34 8b0d8000feffmov ecx,dword ptr ds:[0FFFE0080h] ds:0023:fffe0080=000000ff
0: kd> p
eax=00000007 ebx=ffdff120 ecx=000000e1 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc3a esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0xa:
804edc3a c1e904shr ecx,4
0: kd> x hal!HalpIRQLtoTPR
804edbb8 hal!HalpIRQLtoTPR = unsigned char [] ""
0: kd> db 804edbb8
804edbb8 00 3d 41 41 51 61 71 81-91 a1 b1 b1 b1 b1 b1 b1 .=AAQaq.........
804edbc8 b1 b1 b1 b1 b1 b1 b1 b1-b1 b1 b1 c1 d1 e1 ef ff ................
804edbd8 0f b6 d1 0f b6 8a b8 db-4e 80 a1 80 00 fe ff 89 ........N.......
804edbe8 0d 80 00 fe ff c1 e8 04-0f b6 80 1c a2 4f 80 c3 .............O..
804edbf8 8b 15 80 00 fe ff c7 05-80 00 fe ff 41 00 00 00 ............A...
804edc08 c1 ea 04 0f b6 82 1c a2-4f 80 c3 90 8b 15 80 00 ........O.......
804edc18 fe ff c7 05 80 00 fe ff-c1 00 00 00 c1 ea 04 0f ................
804edc28 b6 82 1c a2 4f 80 c3 90-33 c0 8a c1 8b 0d 80 00 ....O...3.......
0: kd> p
eax=00000007 ebx=ffdff120 ecx=0000000e edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc3d esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!KfLowerIrql+0xd:
804edc3d 0fb6891ca24f80movzx ecx,byte ptr hal!_HalpVectorToIRQL (804fa21c)[ecx] ds:0023:804fa22a=1d
0: kd> db 804fa21c
804fa21c 00 ff ff 01 02 ff 05 06-07 08 09 0a 1b 1c 1d 1e ................
804fa22c 00 00 00 00 00 00 00 00-08 10 00 00 00 00 00 00 ................
804fa23c 00 00 00 00 00 00 00 00-00 00 80 00 00 00 00 00 ................
804fa24c 00 00 00 00 00 00 00 00-02 00 00 00 02 00 00 00 ................
804fa25c e0 51 4f 80 00 00 00 00-00 00 00 00 00 00 00 00 .QO.............
804fa26c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
804fa27c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
804fa28c 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0: kd> p
eax=00000007 ebx=ffdff120ecx=0000001dedx=00000002 esi=ffdff980 edi=898d4608
eip=804edc44 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!KfLowerIrql+0x14:
804edc44 38c8 cmp al,cl
0: kd> p
eax=00000007 ebx=ffdff120 ecx=0000001d edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc46 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000293
hal!KfLowerIrql+0x16:
804edc46 760a jbe hal!KfLowerIrql+0x22 (804edc52) [br=1]
0: kd> p
eax=00000007 ebx=ffdff120 ecx=0000001d edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc52 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000293
hal!KfLowerIrql+0x22:
804edc52 33c9 xor ecx,ecx
0: kd> p
eax=00000007 ebx=ffdff120 ecx=00000000 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc54 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x24:
804edc54 8a88b8db4e80 mov cl,byte ptr hal!HalpIRQLtoTPR (804edbb8)[eax] ds:0023:804edbbf=81
0: kd> db 804edbb8
804edbb8 00 3d 41 41 51 61 71 81-91 a1 b1 b1 b1 b1 b1 b1 .=AAQaq.........
804edbc8 b1 b1 b1 b1 b1 b1 b1 b1-b1 b1 b1 c1 d1 e1 ef ff ................
804edbd8 0f b6 d1 0f b6 8a b8 db-4e 80 a1 80 00 fe ff 89 ........N.......
804edbe8 0d 80 00 fe ff c1 e8 04-0f b6 80 1c a2 4f 80 c3 .............O..
804edbf8 8b 15 80 00 fe ff c7 05-80 00 fe ff 41 00 00 00 ............A...
804edc08 c1 ea 04 0f b6 82 1c a2-4f 80 c3 90 8b 15 80 00 ........O.......
804edc18 fe ff c7 05 80 00 fe ff-c1 00 00 00 c1 ea 04 0f ................
804edc28 b6 82 1c a2 4f 80 c3 90-33 c0 8a c1 8b 0d 80 00 ....O...3.......
0: kd> p
eax=00000007 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc5a esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x2a:
804edc5a 890d8000feff mov dword ptr ds:[0FFFE0080h],ecx ds:0023:fffe0080=000000ff
0: kd> p
eax=00000007 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc60 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x30:
804edc60 a18000feff mov eax,dword ptr ds:[FFFE0080h] ds:0023:fffe0080=000000ff
0: kd> p
eax=00000081 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc65 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x35:
804edc65 3bc8 cmp ecx,eax
0: kd> p
eax=00000081 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc67 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x37:
804edc67 7401 je hal!KfLowerIrql+0x3a (804edc6a) [br=1]
0: kd> p
eax=00000081 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=804edc6a esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!KfLowerIrql+0x3a:
804edc6a c3 ret
0: kd> p
eax=00000081 ebx=ffdff120 ecx=00000081 edx=00000002 esi=ffdff980 edi=898d4608
eip=80a36622 esp=f78cdcc0 ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeInsertQueueDpc+0x19e:
80a36622 8a450b mov al,byte ptr [ebp+0Bh] ss:0010:f78cdcdf=01

版权声明: 本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若内容造成侵权/违法违规/事实不符，请联系邮箱：809451989@qq.com进行投诉反馈，一经查实，立即删除！
网站建设 2026/5/26 3:28:13

层合板多层损伤投影叠加后处理工具

一般我们做仿真&#xff0c;往往前处理工作占40%&#xff0c;后处理工作占40%。中间搞本构的时间反而没那么久。对于一些特殊仿真工况来说&#xff0c;尤其是模拟多工况&#xff0c;一些参数需要在不同工况之前传递。这可能需要同时用到前处理和后处理方法。除此之外&#xff0…

作者头像 李华
网站建设 2026/5/26 6:54:41

超实用 U 盘启动盘制作教程：2 种工具 + 详细步骤，小白也能上手

U 盘启动盘是电脑应急必备工具&#xff0c;不管是系统崩溃重装、丢失数据抢救&#xff0c;还是硬件故障排查&#xff0c;都能派上大用场。下面分享 2 款常用工具的制作方法&#xff0c;步骤精简易懂&#xff0c;新手也能快速掌握。 一、U 盘启动盘的核心作用 系统重装&#x…

作者头像 李华
网站建设 2026/5/25 12:35:21

R语言实现流动性覆盖率（LCR）动态监控（附完整代码）

第一章&#xff1a;流动性覆盖率&#xff08;LCR&#xff09;与金融风险管理流动性覆盖率&#xff08;Liquidity Coverage Ratio, LCR&#xff09;是巴塞尔协议III中引入的关键监管指标&#xff0c;旨在衡量金融机构在压力情景下能否依靠高流动性资产满足未来30天的净现金流出。…

作者头像 李华
网站建设 2026/5/25 7:32:18

刷到 “网安月薪 3 万” 就心动？先打住！这 4 个坑一定要绕开！

前几天收到个私信&#xff0c;大二学生说 “跟风报了网安培训班&#xff0c;学了半年只会跑 Nessus 扫漏洞&#xff0c;投简历全石沉大海”—— 其实不是他学得差&#xff0c;是一开始就踩了入行误区。 现在网上的说法&#xff0c;很容易让人脑子一热就扎进来&#xff0c;但真…

作者头像 李华