HANDLE hSystemThread,hMyThread;
PsCreateSystemThread(&hSystemThread,NULL,NULL,NULL,NULL,ThreadSystemStart,NULL);
PsCreateSystemThread(&hMyThread,NULL,NULL,NtCurrentProcess(),NULL,ThreadUserStart,NULL);
ZwClose(hSystemThread);
ZwClose(hMyThread);
//系统线程
VOID ThreadSystemStart( IN PVOID StartContext)
{
#if DBG
_asm int 3
#endif
PEPROCESS pEProcess=IoGetCurrentProcess();
PTSTR ProcessName=(PTSTR)((ULONG)pEProcess+0x164);
DbgPrint("ThreadSystemStart run in %s process!\n",ProcessName);
//结束线程
PsTerminateSystemThread(STATUS_SUCCESS);
return;
}
//用户线程
VOID ThreadUserStart( IN PVOID StartContext )
{
#if DBG
_asm int 3
#endif
PEPROCESS pEProcess=IoGetCurrentProcess();
PTSTR ProcessName=(PTSTR)((ULONG)pEProcess+0x164); //2003系统是这个
DbgPrint("ThreadUserStart run in %s process!\n",ProcessName);
//结束线程
PsTerminateSystemThread(STATUS_SUCCESS); //结束线程
return;
}
NTSTATUS HelloDDKControl(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp)
{
#if DBG
_asm int 3
#endif
NTSTATUS status=STATUS_SUCCESS;
//获取当前堆栈
PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(pIrp);
//得到IOCTL控制码
ULONG code=stack->Parameters.DeviceIoControl.IoControlCode;
switch (code)
{
case IOCTL_TEST1: //缓冲区方式IOCTL
{
HANDLE hSystemThread,hMyThread;
PsCreateSystemThread(&hSystemThread,NULL,NULL,NULL,NULL,ThreadSystemStart,NULL);
PsCreateSystemThread(&hMyThread,NULL,NULL,NtCurrentProcess(),NULL,ThreadUserStart,NULL);
ZwClose(hSystemThread);
ZwClose(hMyThread);
}
break;
default:
status=STATUS_INVALID_VARIANT;
}
//设置IRP的完成状态
pIrp->IoStatus.Status=status;
pIrp->IoStatus.Information=0;
IoCompleteRequest(pIrp,IO_NO_INCREMENT);
return status;
}