Question

I am aware that one cannot listen for, detect, and perform some action upon encountering context switches on Windows machines via managed languages such as C#, Java, etc. However, I was wondering if there was a way of doing this using assembly (or some other language, perhaps C)? If so, could you provide a small code snippet that gives an idea of how to do this (as I am relatively new to kernel programming)?

What this code will essentially be designed to do is run in the background on a standard Windows UI and listen for when a particular process is either context switched in or out of the CPU. Upon hearing either of these actions, it will send a signal. To clarify, I am looking to detect only the context switches directly involving a specific process, not any context switches. What I ultimately would like to achieve is to be able to notify another machine (via the internet signal) whenever a specific process begins making use of the CPU, as well as when it ceases doing so.

My first attempt at doing this involved simply calculating the CPU usage percentage of the specific process, but this ultimately proved to be too course-grained to catch the most minute calculations. For example, I wrote a test program that simply performed the operation 2+2 and placed the answer inside of an int. The CPU usage method did not pick up on this. Thus, I am looking for something lower level, hence the origin of this question. If there are potential alternatives, I would be more than happy to field them.

Answer 1

Please see the edits below. In particular #3, ETW appears to be the way to go.

In theory you could install your own trap handler for the old int 2Eh and the new sysenter. However, in practice this isn’t going to be as easy anymore as it used to be because of Patchguard (since Vista) and signing requirements. I’m not aware of any other generic means to detect context switches, meaning you’d have to roll your own. All context switches of the OS go through call gates (the aforementioned trap handlers) and ReactOS allows you to peek behind the scenes if you feel uncomfortable with debugging/disassembling.

However, in either case there shouldn’t be a generic way to install something like this without kernel mode privileges (usually referred to as ring 0) – anything else would be a security flaw in Windows. I’m not aware of a Windows-supplied method to achieve what you want either.

The book “Undocumented Windows NT” has a pretty good chapter about the exact topic (although obviously targeted at the old int 2Eh method).

If you can live with hooking only certain functions, you may be able to get away with some filter driver(s) or user-mode API hooking. Depends on your exact requirements.

Update: reading your updated question, I think you need to read up on the internals, in particular on the concept of IRQLs (not to be confused with IRQs from DOS times) and the scheduler. The problem is that there can – and usually will – be literally hundreds of context switches every second. However, your watcher process (the one watching for context switches) will, like any user-mode process be preemptable. This means that there is no way for you to achieve real-time signaling or anything close to it, which puts a big question mark on the method.

What is it actually that you want to achieve? The number of context switches doesn’t really give you anything. Every single SEH exception will cause a context switch. What is it that you are interested in? Perhaps performance counters cater your needs better?

Update 2: the sheer amount of context switches even for a single thread will be flabbergasting within a single second. So assuming you’d install your own trap handler, you’d still end up (adversely) affecting all other threads on the system (after all you’d catch every context switch and then see whether it’s the process/threads you care about and then do your thing or pass it on).

If you could tell us what you ultimately want to achieve, not with the means already pre-defined, we may be able to suggest alternatives.

Update 3: so apparently I was wrong in one respect here. Windows comes with something on board that signals context switches. And ETW can be harnessed to tap into those. Thanks to Simon for pointing out.