21.driverbase-多线程PsCreateSystemThread

最新推荐文章于 2021-03-10 10:26:23 发布

花熊

最新推荐文章于 2021-03-10 10:26:23 发布

阅读量514

点赞数

分类专栏：驱动基础

本文链接：https://blog.csdn.net/hgy413/article/details/77330198

版权

驱动基础专栏收录该内容

26 篇文章 3 订阅

订阅专栏

NTKERNELAPI
NTSTATUS
PsCreateSystemThread(
    __out PHANDLE ThreadHandle,// 得到新创建的线程句柄
    __in ULONG DesiredAccess,// 创建的权限
    __in_opt POBJECT_ATTRIBUTES ObjectAttributes,// 线程属性，一般设为NULL
    __in_opt  HANDLE ProcessHandle,//为NULL表示创建系统线程，为进程句柄，则新创建的线程属于这个指定的进程，
    __out_opt PCLIENT_ID ClientId,
    __in PKSTART_ROUTINE StartRoutine,// 新线程进行起始地址
    __in_opt PVOID StartContext// 新线程接收的参数
    );

如：

#pragma PAGEDCODE
VOID SystemThread(IN PVOID pContext)
{
    PEPROCESS pEProcess = IoGetCurrentProcess();
    PTSTR ProcessName = (PTSTR)((ULONG)pEProcess+0x174);
    KdPrint(("This SystemThread run in %s process",ProcessName));
    PsTerminateSystemThread(STATUS_SUCCESS);
}

#pragma PAGEDCODE
VOID MyProcessThread(IN PVOID pContext)
{
    PEPROCESS pEProcess = IoGetCurrentProcess();
    PTSTR ProcessName = (PTSTR)((ULONG)pEProcess+0x174);
    KdPrint(("This MyProcessThread run in %s process",ProcessName));
    PsTerminateSystemThread(STATUS_SUCCESS);
}

#pragma PAGEDCODE
VOID CreateThread_Test()
{
    HANDLE hSystemThread,hMyThread;
    NTSTATUS status = PsCreateSystemThread(&hSystemThread,0,NULL,NULL,NULL,SystemThread,NULL);
    status = PsCreateSystemThread(&hMyThread,0,NULL,NtCurrentProcess(),NULL,MyProcessThread,NULL);
}