Suspending Kernel Mode Threads...

[omidgl]

Let me describe exactly what I want.

I'm about to suspend some protection threads in XTreme protector kernel-driver, to make another Ring-0 dumper be able to dump the process memory.

Regards
OMID

are these threads spawned by the driver (PsCreateSystemThread) or by the EXE application (which, afaik, as elevated privileges and has access to some ring-0 memory pages such as the IDT & the Xprotector driver).

Perhaps you could look into patching the driver directly or hooking PsCreateSystemThread.

This snippet will lower the IRQL (not nec unless in DISPATCH_MODE or greater, but safe if you're not sure). Create an event and then wait for it (infinitely). As the event never gets triggered, the thread will never run again *sniff ;(, poor thread*. If you do want it to run at a later time, simply trigger the event.

LARGE_INTEGER TotalTime = {0,0};
KeLowerIrql(0);
KeInitializeEvent(&NonEvent, NotificationEvent, FALSE);
status = KeWaitForSingleObject(
&NonEvent,
Executive, //Suspended,
KernelMode,
TRUE,
&TotalTime
);

Hope this helps, WCFF