NTSTATUS
PsCreateSystemThread(
OUT PHANDLE ThreadHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes, /* optional */
IN HANDLE ProcessHandle, /* optional */
OUT PCLIENT_ID ClientId, /* optional */
IN PKSTART_ROUTINE StartRoutine,
IN PVOID StartContext
);
PsCreateSystemThread creates a system thread that executes in kernel mode and returns a handle for the thread.
PsCreateSystemThread returns STATUS_SUCCESS if the thread was created.
Drivers that create device-dedicated threads call this routine, either when they initialize or when I/O requests begin to come in to such a driver’s Dispatch routines. For example, a driver might create such a thread when it receives an asynchronous device control request.
PsCreateSystemThread creates a kernel-mode thread that begins a separate thread of execution within the system. Such a system thread has no TEB or user-mode context and runs only in kernel mode.
If the input ProcessHandle is NULL, the created thread is associated with the system process. Such a thread continues running until either the system is shut down or the thread terminates itself by calling PsTerminateSystemThread.
Callers of this routine must be running at IRQL PASSIVE_LEVEL.
KeSetBasePriorityThread, KeSetPriorityThread, PsTerminateSystemThread, ZwSetInformationThread