Developer knowledge network · moderated exchange

UnreliableCode Topluluğu

Geliştirici Araştırması, Tersine Mühendislik ve Kodlama Topluluğu

Knowledge indexCanlı
4Categories
919Threads
2.8KGönderiler
Alt forumlar Liderlik tablosu Mesaj göndermek için giriş yapın
Guide

Creating stealthy system threads in kernel mode with PsCreateSystemThread

kernel_komrade
Driver Dev
MEMBER
Temsilci: 145
Katılım Tarihi: Feb 2019
Gönderiler: 26
Teşekkürler: 45
1 ay önce · Jul 8, 2026 7:46 AM
#1

How to spawn a background worker thread in ring0:

C
HANDLE hThread;
OBJECT_ATTRIBUTES objAttr;
InitializeObjectAttributes(&objAttr, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

NTSTATUS status = PsCreateSystemThread(
    &hThread,
    THREAD_ALL_ACCESS,
    &objAttr,
    NULL,
    NULL,
    (PKSTART_ROUTINE)KernelWorkerRoutine,
    NULL
);
if (NT_SUCCESS(status)) {
    ZwClose(hThread); // Close handle, thread continues running in system space
}

Ensure your worker routine checks a termination atomic flag before driver unload to avoid orphan thread crashes.

stack_smasher
Kernel Explorer
MEMBER
Temsilci: 111
Katılım Tarihi: Feb 2019
Gönderiler: 30
Teşekkürler: 18
1 ay önce · Jul 8, 2026 1:46 PM
#2

To avoid anti-cheat stack scanners flagging thread start addresses outside valid modules, consider hijacking a suspended thread in a legitimate system driver.

val_driver_guy
Driver Dev
MEMBER
Temsilci: 42
Katılım Tarihi: May 2019
Gönderiler: 24
Teşekkürler: 37
1 ay önce · Jul 8, 2026 6:17 PM
#3

Clean usage of OBJ_KERNEL_HANDLE.