PsCreateSystemThread

HANDLE hSystemThread,hMyThread;
PsCreateSystemThread(&hSystemThread,NULL,NULL,NULL,NULL,ThreadSystemStart,NULL);
PsCreateSystemThread(&hMyThread,NULL,NULL,NtCurrentProcess(),NULL,ThreadUserStart,NULL);
ZwClose(hSystemThread);
ZwClose(hMyThread);
//系统线程
VOID ThreadSystemStart( IN PVOID  StartContext)
{
#if DBG
	_asm int 3
#endif

	PEPROCESS pEProcess=IoGetCurrentProcess();
	PTSTR ProcessName=(PTSTR)((ULONG)pEProcess+0x164);
	DbgPrint("ThreadSystemStart run in %s process!\n",ProcessName);

	//结束线程
	PsTerminateSystemThread(STATUS_SUCCESS);
	return;
}

//用户线程
VOID ThreadUserStart( IN PVOID  StartContext )														
{
#if DBG
	_asm int 3
#endif

	PEPROCESS pEProcess=IoGetCurrentProcess();
	PTSTR ProcessName=(PTSTR)((ULONG)pEProcess+0x164);					//2003系统是这个
	DbgPrint("ThreadUserStart run in %s process!\n",ProcessName);

	//结束线程
	PsTerminateSystemThread(STATUS_SUCCESS);										//结束线程
	return;
}

 

NTSTATUS HelloDDKControl(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp)
{
#if DBG
	_asm int 3
#endif

	NTSTATUS status=STATUS_SUCCESS;
	//获取当前堆栈
	PIO_STACK_LOCATION stack=IoGetCurrentIrpStackLocation(pIrp);

	//得到IOCTL控制码
	ULONG code=stack->Parameters.DeviceIoControl.IoControlCode;
	switch (code)
	{
	case IOCTL_TEST1:	//缓冲区方式IOCTL
		{
				HANDLE hSystemThread,hMyThread;
				PsCreateSystemThread(&hSystemThread,NULL,NULL,NULL,NULL,ThreadSystemStart,NULL);
				PsCreateSystemThread(&hMyThread,NULL,NULL,NtCurrentProcess(),NULL,ThreadUserStart,NULL);
				ZwClose(hSystemThread);
				ZwClose(hMyThread);
		}
		break;
	default:
		status=STATUS_INVALID_VARIANT;
	}

	//设置IRP的完成状态
	pIrp->IoStatus.Status=status;
	pIrp->IoStatus.Information=0;
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	return status;
}