RtlQueueApcWow64Thread - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
NTSYSAPI
NTSTATUS
NTAPI
RtlQueueApcWow64Thread(
_In_ HANDLE ThreadHandle,
_In_ PPS_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcArgument1,
_In_opt_ PVOID ApcArgument2,
_In_opt_ PVOID ApcArgument3
);
View code on GitHubQueues a WoW64 user-mode Asynchronous Procedure Call (APC) on the specified thread.
ThreadHandle - a handle the the thread granting the THREAD_SET_CONTEXT access.ApcRoutine - the WoW64 address of the function to invoke.ApcArgument1 - the first argument to pass to the APC routine.ApcArgument2 - the second argument to pass to the APC routine.ApcArgument3 - the third argument to pass to the APC routine.To execute the APC, the thread must first enter an alertable wait via NtDelayExecution (or a similar function) or call NtTestAlert. Note that user APCs on the Native API level have three parameters in contrast with the Win32 APCs that only have one.
To specify the reserve object or use special user-mode APCs, see NtQueueApcThreadEx and NtQueueApcThreadEx2.
Note that user APCs on the Native API level have three parameters in contrast with the Win32 APCs that only have one.
This function uses Wow64EncodeApcRoutine and then calls NtQueueApcThread.