View Single Post
  #3  
Old 01-17-2005, 17:56
Opc0de
 
Posts: n/a
If you know the KTHREAD address of those system threads, just
remove it from the internal kernel thread lists like
KiDispatcherReadyListHead and KiWaitListHead.
If you make this, the kernel thread will not get any CPU time

Take a look in the klister source code at www.rootkit.com
and this paper:
http://opensores.thebunker.net/pub/mirrors/blackhat/presentations/bh-usa-03/bh-us-03-rutkowski/bh-us-03-rutkowski.pdf

Regards,
Opc0de
Reply With Quote