RtlQueueApcWow64Thread - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
/**
* The RtlQueueApcWow64Thread routine queues a user-mode APC to a WOW64 (32-bit) thread from a native (64-bit) process.
*
* \param ThreadHandle A handle to the target WOW64 thread.
* \param ApcRoutine The APC routine to execute in the target thread.
* \param ApcArgument1 An optional first argument passed to the APC routine.
* \param ApcArgument2 An optional second argument passed to the APC routine.
* \param ApcArgument3 An optional third argument passed to the APC routine.
* \return NTSTATUS Successful or errant status.
*/
NTSYSAPI
NTSTATUS
NTAPI
RtlQueueApcWow64Thread(
_In_ HANDLE ThreadHandle,
_In_ PPS_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
);
View code on GitHubQueues a WoW64 user-mode Asynchronous Procedure Call (APC) on the specified thread.
ThreadHandle - a handle the the thread granting the THREAD_SET_CONTEXT access.ApcRoutine - the WoW64 address of the function to invoke.ApcArgument1 - the first argument to pass to the APC routine.ApcArgument2 - the second argument to pass to the APC routine.ApcArgument3 - the third argument to pass to the APC routine.To execute the APC, the thread must first enter an alertable wait via NtDelayExecution (or a similar function) or call NtTestAlert. Note that user APCs on the Native API level have three parameters in contrast with the Win32 APCs that only have one.
To specify the reserve object or use special user-mode APCs, see NtQueueApcThreadEx and NtQueueApcThreadEx2.
Note that user APCs on the Native API level have three parameters in contrast with the Win32 APCs that only have one.
This function uses Wow64EncodeApcRoutine and then calls NtQueueApcThread.