Suspending Kernel Mode Threads...

		Exetools > General > General Discussion
Suspending Kernel Mode Threads...

01-12-2005, 03:38

pp2

Friend

Join Date: Jan 2002

Posts: 60

Rept. Given: 1

Rept. Rcvd 2 Times in 2 Posts

Thanks Given: 1

Thanks Rcvd at 16 Times in 12 Posts

You can try to use "rootkit" technics and remove thread from scheduler list (see recent articles at rootkit.com how to do it). If you control scheduler you decide whether system thread is runnable or not now. Anyway suspending some system threads maybe extremely dangerous and cause immediate exception (and BSOD also), so you should check thread's IRQL.

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Switch to Hybrid Mode Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hades:Windows kernel driver lets reverse engineers monitor user and kernel mode code	sh3dow	Source Code	0	05-12-2016 03:15
Use IDA in kernel mode ??	Veyskarami	General Discussion	14	02-23-2013 12:38
How to pass the large data in kernel mode to user mode?	benina	General Discussion	3	03-06-2010 04:50
Kernel-Mode GUI!? (like SoftIce)	Cobi	General Discussion	1	01-21-2005 02:24
Kernel Mode Driver for NT	SPeY	General Discussion	12	04-22-2004 15:34

All times are GMT +8. The time now is 18:00.