I'm registering a callback for a module loading notification via PsSetLoadImageNotifyRoutine(). As the documentation states, the callback is called in PASSIVE_LEVEL, sometimes with special kernel APCs disabled. I need to calculate the MD5 of backing file of the module that is loaded, and this operation must be synchronous. I cannot post it to a user-space agent to do it for me(i.e. asynchronous). My question is,
I'm checking whether APCs are disabled in my callback using:
If they are indeed disable, I'm issuing a work item to a queue using:
The callback itself is now waiting for the system worker to run my work-item routine,
KeWaitForSingleObject(..., Executive, KernelMode, FALSE, NULL);
The routine that is called on this work item shall trigger an event, that will notify the callback that the MD5 is calculated by the worker routine.
My question is, is it Ok to wait with a non-alertable state in this callback? I think this callback is called in the context of process that the image is being loaded to, so i'm actually deferring user APCs... but i think it's fine since waiting is not forever. Eventually the worker routine will signal the event regardless of a successful MD5 computing or not. Also, i'm not checking the return value for KeWaitForSingleObject(), since i provide no timeout, i wait on a non-alertable state in KernelMode so no user-APC can preempt the waiting, and also no alerts can be sent.