KeDelayExecutionThread does not work in user mode

Question

the function KeDelayExecutionThread does not work is user mode with the DeviceIoControl, but it works in kernel because it delays some period of time in the DebugView:

some code in kernel is:

LARGE_INTEGER l;

    l = RtlConvertLongToLargeInteger(-10 * 1000 * 1000 * 5); // 5 seconds

    NTSTATUS r = KeDelayExecutionThread(KernelMode, FALSE,(PLARGE_INTEGER) &l);

the code in user mode is:

BOOL r6 = DeviceIoControl(hFile,
            ioctl_d_in_io4,
            NULL,
            NULL,
            NULL,
            NULL,
            &br,
            NULL);

        printf("%i\n%i\n", (int)r6,(int)br);

       system("PAUSE");

so the text of system("PAUSE") with the printf are rendered directly without delaying (=0second).

the question is why, why the delaying occurs in kernel but not in user mode, and how to do the delaying in user mode via kernel mode?

Answer 1

Since you don't want Alertable, the first question is why do you want to use UserMode?   Take a look at https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/waits-and-apcs most kernel developers rarely use UserMode.

---

Don Burn Windows Driver Consulting Website: http://www.windrvr.com