KernelMode Callback UserMode

a snapshot of usrer mode call kernel mode, then kernel mode callback to usermode,
then user mode call kernel mode again, some malware use K callback U trick to
inject code to target process address space.

kd> kb L200
ChildEBP RetAddr  Args to Child             
f97e125c 8090e8b1 00000001 e13ff030 8179d040 nt!ObpCreateHandle
f97e1330 8090f81d e13ff030 00000000 00000000 nt!ObOpenObjectByPointer+0xa8
f97e138c 8082337b ffffffff 00020008 00000000 nt!NtOpenProcessTokenEx+0x92
f97e138c 7c95ed54 ffffffff 00020008 00000000 nt!KiFastCallEntry+0xf8
0078f4e8 7c9517b4 7c968543 ffffffff 00020008 ntdll!KiFastSystemCallRet
0078f4ec 7c968543 ffffffff 00020008 00000200 ntdll!ZwOpenProcessTokenEx+0xc
0078f578 7c94a9be 0078f5a4 7c80c78c 0078fa20 ntdll!RtlFormatCurrentUserKeyPath+0x4b
0078f5b0 7c80c775 02000000 0078f5ec 00000000 ntdll!RtlOpenCurrentUser+0x13
0078f9f4 7c80c84e 0078fa20 00000000 7c80c78c KERNEL32!OpenRegKey+0x3a
0078fc3c 7c8060d1 7c831230 001656e8 00000050 KERNEL32!GetUserInfoFromRegistry+0x40
0078fc64 7c8213eb 00000804 00001014 7c831230 KERNEL32!NlsGetCurrentUserNlsInfo+0x202
0078fc90 7c831218 00000804 00001014 00000820 KERNEL32!GetUserInfo+0x21
0078fd7c 74b0ee71 00000804 00001014 0078fdb8 KERNEL32!GetLocaleInfoW+0x1321
0078fde4 630947fb 00000400 630963c0 00000000 USP10!ScriptRecordDigitSubstitution+0x7f
0078fe9c 63094878 fa092bbc 00000004 00000000 LPK!ReadNLSScriptSettings+0x6b
0078feb4 63093376 01010058 0078ffdc 00000002 LPK!LpkStringAnalyse+0x46
0078ff0c 77beecd8 01010058 0078ffdc 00000002 LPK!LpkGetTextExtentExPoint+0x12c
0078ff48 77bd8175 01010058 0078ffdc 00000002 GDI32!GetTextExtentPointWInternal+0x183
0078ff64 77e5878e 01010058 0078ffdc 00000002 GDI32!GetTextExtentPointW+0x18
0078ff90 7c95ec9e 0078ffa8 0000003c ffffffff USER32!__ClientGetTextExtentPointW+0x3c
0078ffe0 75985001 75988c40 00000000 00000022 ntdll!KiUserCallbackDispatcher+0x2e
f97e1660 8091735b f97e1730 f97e171c 00000001 nt!KiCallUserMode+0x4
f97e16b8 bf933840 00000049 f97e1750 0000003c nt!KeUserModeCallback+0x8f
f97e196c bf9391ac 01010058 bf9b2840 00000002 win32k!xxxClientGetTextExtentPointW+0x141
f97e1990 bf9393bc bc630938 f97e19ac bc630938 win32k!xxxTooltipGetSize+0x68
f97e19b4 bf939602 bc630938 bc630938 bc630938 win32k!xxxShowTooltip+0x5d
f97e19d4 bf811027 bc630938 00000001 bc630938 win32k!xxxTooltipHandleTimer+0x79
f97e1a38 bf8a3d2e bc630938 00000118 00000001 win32k!xxxTooltipWndProc+0xb1
f97e1a68 bf82609a f97e1aa4 00000022 0078fff4 win32k!xxxDispatchMessage+0x1ce
f97e1d30 bf829254 bf9b30e0 00000001 f97e1d54 win32k!xxxDesktopThread+0x3de
f97e1d40 bf87f76c bf9b30e0 f97e1d64 0078fff4 win32k!xxxCreateSystemThreads+0x6a
f97e1d54 8082337b 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
f97e1d54 7c95ed54 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
0078ff90 7c95ec9e 0078ffa8 0000003c ffffffff ntdll!KiFastSystemCallRet
0078ffe0 75985001 75988c40 00000000 00000022 ntdll!KiUserCallbackDispatcher+0x2e
0078ffe8 00000000 00000022 00000004 00000000 winsrv!NtUserCallOneParam+0xc 

by john lan