This snippet will lower the IRQL (not nec unless in DISPATCH_MODE or greater, but safe if you're not sure). Create an event and then wait for it (infinitely). As the event never gets triggered, the thread will never run again *sniff ;(, poor thread*. If you do want it to run at a later time, simply trigger the event.
LARGE_INTEGER TotalTime = {0,0};
KeLowerIrql(0);
KeInitializeEvent(&NonEvent, NotificationEvent, FALSE);
status = KeWaitForSingleObject(
&NonEvent,
Executive, //Suspended,
KernelMode,
TRUE,
&TotalTime
);
Hope this helps, WCFF
|