View Single Post
  #3  
Old 02-14-2017, 21:08
deroko's Avatar
deroko deroko is offline
cr4zyserb
 
Join Date: Nov 2005
Posts: 217
Rept. Given: 13
Rept. Rcvd 30 Times in 14 Posts
Thanks Given: 7
Thanks Rcvd at 33 Times in 16 Posts
deroko Reputation: 30
Well int this case code always works as prior to execution of NtContinue there is call for NtTestAlert which will trigger APCs, and also NtContinue how it is called by LdrInitializeThunk always has Alertable set to 1, so APCs will always get executed in this example.
__________________
http://accessroot.com
Reply With Quote
The Following 2 Users Say Thank You to deroko For This Useful Post:
niculaita (02-15-2017), sh3dow (02-17-2017)