Suspending Kernel Mode Threads...

Hello,

Try ZwSuspendThread / ZwResumeThread (Kernel mode Counterpart of SuspendThread & ResumeThread).

I don't know if it will works on Kernel mode thread created with PsCreateSystemThread for example...

If this is one of your drivers, you should use Kernel events (as user-mode events) :

KeSetEvent and KeWaitxxx or KeWaitForSingleObject (or KeWaitForMultipleObjects).

There's also some timer routines like KeInitializeTimer(Ex) and KeSetTimer.

As usual, you should be carefull about differents IRQL required by those routines.

Hope it could help.

Regards, Neitsa.

[omidgl]

Let me describe exactly what I want.

I'm about to suspend some protection threads in XTreme protector kernel-driver, to make another Ring-0 dumper be able to dump the process memory.

Regards
OMID

are these threads spawned by the driver (PsCreateSystemThread) or by the EXE application (which, afaik, as elevated privileges and has access to some ring-0 memory pages such as the IDT & the Xprotector driver).

Perhaps you could look into patching the driver directly or hooking PsCreateSystemThread.

This snippet will lower the IRQL (not nec unless in DISPATCH_MODE or greater, but safe if you're not sure). Create an event and then wait for it (infinitely). As the event never gets triggered, the thread will never run again *sniff ;(, poor thread*. If you do want it to run at a later time, simply trigger the event.

LARGE_INTEGER TotalTime = {0,0};
KeLowerIrql(0);
KeInitializeEvent(&NonEvent, NotificationEvent, FALSE);
status = KeWaitForSingleObject(
&NonEvent,
Executive, //Suspended,
KernelMode,
TRUE,
&TotalTime
);

Hope this helps, WCFF