Suspending Kernel Mode Threads...

Originally Posted by omidgl

Hi.
I know windows driver model (programming).
I know how to suspend user-mode threads.
Can anyone help me about suspending kernel-mode threads.
Thanks

In kernel mode you can create a thread by calling "PsCreateSystemThread" API and then you can suspend it by calling "KeWaitForSingleObject" API .Find more in Microsoft Development Kit (DDK) .
Goodluck

[omidgl]

I don't want to suspend current thread, It's all about to suspend other driver threads so KeWaitForSingleObject can't do anything about it.

If you know the KTHREAD address of those system threads, just
remove it from the internal kernel thread lists like
KiDispatcherReadyListHead and KiWaitListHead.
If you make this, the kernel thread will not get any CPU time

Take a look in the klister source code at www.rootkit.com
and this paper:
http://opensores.thebunker.net/pub/mirrors/blackhat/presentations/bh-usa-03/bh-us-03-rutkowski/bh-us-03-rutkowski.pdf

Regards,
Opc0de