Developer knowledge network · moderated exchange

Zajednica UnreliableCode

Zajednica za istraživanje, obrnuti inženjering i programiranje programera

Knowledge indexŽivjeti
4Categories
919Threads
2.8KPostovi
Podforumi Leaderboard Prijavite se za objavljivanje
Guide

Creating stealthy system threads in kernel mode with PsCreateSystemThread [v2.4 Technical Discussion]

kernel_komrade
Driver Dev
MEMBER
Rep: 145
Datum pridruživanja: Feb 2019
Postovi: 26
Hvala: 45
prije 1 mjeseci · Jul 11, 2026 9:38 PM
#1

How to spawn a background worker thread in ring0:

C
HANDLE hThread;
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

NTSTATUS status = PsCreateSystemThread(
    &hThread,
    THREAD_ALL_ACCESS,
    &objAttr,
    NULL,
    NULL,
    (PKSTART_ROUTINE)KernelWorkerRoutine,
    NULL
);
if (NT_SUCCESS(status)) {
    ZwClose(hThread); // Close handle, thread continues running in system space
}

Ensure your worker routine checks a termination atomic flag before driver unload to avoid orphan thread crashes.

stack_smasher
Kernel Explorer
MEMBER
Rep: 111
Datum pridruživanja: Feb 2019
Postovi: 30
Hvala: 18
prije 1 mjeseci · Jul 12, 2026 1:23 AM
#2

To avoid anti-cheat stack scanners flagging thread start addresses outside valid modules, consider hijacking a suspended thread in a legitimate system driver.

val_driver_guy
Driver Dev
MEMBER
Rep: 42
Datum pridruživanja: May 2019
Postovi: 24
Hvala: 37
prije 1 mjeseci · Jul 12, 2026 12:26 PM
#3

Clean usage of OBJ_KERNEL_HANDLE.