1개월 전 · Jul 11, 2026 9:38 PM
How to spawn a background worker thread in ring0:
C
HANDLE hThread;
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
NTSTATUS status = PsCreateSystemThread(
&hThread,
THREAD_ALL_ACCESS,
&objAttr,
NULL,
NULL,
(PKSTART_ROUTINE)KernelWorkerRoutine,
NULL
);
if (NT_SUCCESS(status)) {
ZwClose(hThread); // Close handle, thread continues running in system space
}Ensure your worker routine checks a termination atomic flag before driver unload to avoid orphan thread crashes.