A forum for reverse engineering, OS internals and malware analysis 

 #30392  by Vrtule
 Wed May 31, 2017 7:15 pm
PsCreateSystemThread can be called only on PASSIVE_LEVEL.

KeLowerIrql SHOULD NOT be used this way.

One of the right ways of doing this is to execute the Zw routine in a workitem (ExInitializeWorkItem/IoAllocateWorkItem, ExQueueWorkItem). The execution is asynchronous.
 #30394  by Vrtule
 Wed May 31, 2017 8:06 pm
It probably depends on what are you trying to accomplish and what causes that the code runts at DISPATCH_LEVEL.

Workitems are a general solution but might not be suitable for all cases. But each of the alternatives means, more or less, implementing your own workitems... sort of.