APC Series: KiUserApcDispatcher and Wow64
I recommend to read the previous posts before reading this one:
User APC API: We discussed the user mode API of user APC User APC Internals: We discussed the implementation of user APC in the kernel Letβs continue our discussion about APC internals in windows: This time weβll discuss APC dispatching in user mode and how APC works in Wow64 processes:
The evolution of KiUserApcDispatcher Modifications to APC functions to support Wow64 Wow64 APC injection techniques The evolution of KiUserApcDispatcher NTDLL contains a set of entry points that the kernel uses to run code in user mode like: KiUserExceptionDispatcher, KiUserCallbackDispatcher, β¦