以 InterlockedExchange 为例

由 kernel32.dll 实现的 InterlockedExchange 在文档中有那么一句话:
This function is atomic with respect to calls to other interlocked functions.

具体实现如下:


WDK 的文档中对于 InterlockedExchange 有那么一句话:
A call to InterlockedExchange routine is atomic only with respect to other InterlockedXxx calls.

ntoskrnl.exe 中 InterlockedExchange 的实现如下:


关于 lock 前缀指令, Intel 手册里是那么说的:
Causes the processor’s LOCK# signal to be asserted during execution of the accompanying instruction (turns the instruction into an atomic instruction). In a multiprocessor environment, the LOCK# signal ensures that the processor has exclusive use of any shared memory while the signal is asserted.

The XCHG instruction always asserts the LOCK# signal regardless of the presence or absence of the LOCK prefix.

也就是说实际上两个 InterlockedExchange 都是靠 lock 指令实现的.

然后在下面这个网页里看到了关于 lock 指令的一种说法:
4dcK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4G2k6r3g2E0j5h3g2K6N6s2u0G2i4K6u0W2j5$3!0E0i4K6u0r3M7X3g2$3K9h3g2%4M7#2)9J5c8U0R3`.

All threads and processes accessing the locked memory must ‘play fair’. This means that any one accessing the memory without trying to lock the address will not be protected by other processes locking the same address. For example:
Thread 1: lock inc ptr [edx]
Thread 2: inc ptr [edx]
If the two threads run simultaneously, thread 2 does not assert LOCK#. This means that it doesn’t check if the memory pointed by edx is locked. This means the lock is useless in this matter.

照这样说就变得跟其他一些同步方式一样了, 光自己用别人不用的话也没效果.

那么这个说法到底对吗?

主要是看到了 WDK 文档里关于 InterlockedExchange 的描述中那个 only 让我觉得似乎是在佐证这个说法.

如果对的话是不是意味着 Rootkits 那本书里那些 SSDT HOOK 的宏其实是有点问题的?
还是需要锁住每个核才是相对比较可靠的内核 patch 做法?

谢谢

[培训]科锐逆向工程师培训第53期2025年7月8日开班！