PsCreateSystemThread函数有个可选参数ProcessHandle
ddk定义如下:
Specifies an open handle for the process in whose address space the thread is to be run. The caller’s thread must have PROCESS_CREATE_THREAD access to this process. If this parameter is not supplied, the thread will be created in the initial system process. This value should be NULL for a driver-created thread. Use the NtCurrentProcess macro to specify the current process.
再翻翻wrk看看实现就更清楚了
NTSTATUS PsCreateSystemThread{...
ProcessPointer = NULL;
if (ARGUMENT_PRESENT(ProcessHandle)) {
SystemProcess = ProcessHandle;
} else {
SystemProcess = NULL;
ProcessPointer = PsInitialSystemProcess;
}
PspCreateThread(...)
...}
PspCreateThread再对ProcessHandle(SystemProcess )作检查，如果你给了这个参数，那么就增加这个ps对象的计数，可见你创建的线程就是在 这个ps地址里运行的，如果没给就给ProcessPointer (PsInitialSystemProcess)增加计数，ProcessPointer 就是system process
建议lz先看看ddk再来问问题，很多东西都是能查到的，翻翻wrk什么的就清楚了
