Developer knowledge network · moderated exchange

UnreliableCode-Community

Community für Entwicklerforschung, Reverse Engineering und Codierung

Knowledge indexLive
4Categories
919Threads
2.8KBeiträge
Unterforen Bestenliste Melden Sie sich an, um zu posten
Guide

Creating stealthy system threads in kernel mode with PsCreateSystemThread [v2.4 Technical Discussion]

kernel_komrade
Driver Dev
MEMBER
Vertreter: 145
Beitrittsdatum: Feb 2019
Beiträge: 26
Danke: 45
Vor 1 Monaten · Jul 11, 2026 9:38 PM
#1

How to spawn a background worker thread in ring0:

C
HANDLE hThread;
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

NTSTATUS status = PsCreateSystemThread(
    &hThread,
    THREAD_ALL_ACCESS,
    &objAttr,
    NULL,
    NULL,
    (PKSTART_ROUTINE)KernelWorkerRoutine,
    NULL
);
if (NT_SUCCESS(status)) {
    ZwClose(hThread); // Close handle, thread continues running in system space
}

Ensure your worker routine checks a termination atomic flag before driver unload to avoid orphan thread crashes.

stack_smasher
Kernel Explorer
MEMBER
Vertreter: 111
Beitrittsdatum: Feb 2019
Beiträge: 30
Danke: 18
Vor 1 Monaten · Jul 12, 2026 1:23 AM
#2

To avoid anti-cheat stack scanners flagging thread start addresses outside valid modules, consider hijacking a suspended thread in a legitimate system driver.

val_driver_guy
Driver Dev
MEMBER
Vertreter: 42
Beitrittsdatum: May 2019
Beiträge: 24
Danke: 37
Vor 1 Monaten · Jul 12, 2026 12:26 PM
#3

Clean usage of OBJ_KERNEL_HANDLE.