关于RundownProtect到底是什么东西

RundownProtect这个字段相信只要是读过WRK源码的都会看过这个东西，这个字段在进程和线程的结构中都存在。最典型的例子就是对进程要进行什么操作的时候会先引用这个字段进行加保护，等操作结束后再进行解保护。但是一直没搞懂这个到底在保护什么和保护是怎么实现的。这里正好来看一下，首先是结构

   

    EX_RUNDOWN_REF RundownProtect;

这是ETHREAD的一部分，可见是一个EX_RUNDOWN_REF结构。我们来看一下EX_RUNDOWN_REF是什么样子的。

typedef struct _EX_RUNDOWN_REF
{
     union
     {
          ULONG Count;
          PVOID Ptr;
     };
} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF;

这里结构都是基于Vista内核的。看的出来，所谓的EX_RUNDOWN_REF结构其实就是一个整数而已。关键是怎么使用的这个结构，想知道这一点得看一下ExAcquireRundownProtection()函数，这个函数是经常调用来给进程加保护的。我在WRK找到了这个函数的代码，如下

NTKERNELAPI
BOOLEAN
FORCEINLINE
FASTCALL
ExAcquireRundownProtection (
     __inout PEX_RUNDOWN_REF RunRef
     )
{
    ULONG_PTR Value, NewValue;

    Value = ReadForWriteAccess(&RunRef->Count) & ~EX_RUNDOWN_ACTIVE;
    NewValue = Value + EX_RUNDOWN_COUNT_INC;
    NewValue = (ULONG_PTR) InterlockedCompareExchangePointerAcquire (&RunRef->Ptr,
                                                                     (PVOID) NewValue,
                                                                     (PVOID) Value);
    if (NewValue == Value) {
        return TRUE;
    } else {
        return ExfAcquireRundownProtection (RunRef);
    }
}

下面是ExfAcquireRundownProtection的代码

NTKERNELAPI
BOOLEAN
FASTCALL
ExfAcquireRundownProtection (
     __inout PEX_RUNDOWN_REF RunRef
     )
/*++

Routine Description:

    Reference a rundown block preventing rundown occurring if it hasn't already started
    This routine is NON-PAGED because it is being called on the paging path.

Arguments:

    RunRef - Rundown block to be referenced

Return Value:

    BOOLEAN - TRUE - rundown protection was acquired, FALSE - rundown is active or completed

--*/
{
    ULONG_PTR Value, NewValue;

    Value = RunRef->Count;
    do {
        //
        // If rundown has started return with an error
        //
        if (Value & EX_RUNDOWN_ACTIVE) {
            return FALSE;
        }

        //
        // Rundown hasn't started yet so attempt to increment the unsage count.
        //
        NewValue = Value + EX_RUNDOWN_COUNT_INC;

        NewValue = (ULONG_PTR) InterlockedCompareExchangePointer (&RunRef->Ptr,
                                                                  (PVOID) NewValue,
                                                                  (PVOID) Value);
        if (NewValue == Value) {
            return TRUE;
        }
        //
        // somebody else changed the variable before we did. Either a protection call came and went or rundown was
        // initiated. We just repeat the whole loop again.
        //
        Value = NewValue;
    } while (TRUE);
}