[madaboo]

Hi,

Assuming that one driver has created its own thread: (two variants : work item and by psCreateSystemThread) is it possible to suspend this thread from another driver?

Thanks

[Cr4sh]

Don't really shure, but you can try to send APC to your thread.

Hi,

Assuming that one driver has created its own thread: (two variants : work item and by psCreateSystemThread) is it possible to suspend this thread from another driver?

Thanks

[Dmitry Varshavsky]

Hi,

Assuming that one driver has created its own thread: (two variants : work item and by psCreateSystemThread) is it possible to suspend this thread from another driver?

Thanks

There is no documented solution for this, but it's still possible:
1) NtSuspendThread - non-exported, but present in SSDT
2) PsSuspendThread / KeSuspendThread - lower level, also non-exported
3) Manual scheduling of ETHREAD.SuspendAPC with respect to system synchronization primitives