Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

PsCreateSystemThread

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hi,

the description of PsCreateSystemThread says that "Drivers for Windows
2000 must call PsCreateSystemThread only from the system process context".
Is this true for W2KSP4 too and what should happen when I do
PsCreateSystemThread from another context ?

Regards
Else

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hello Else,

    I can't really answer this, but in general functions for w2kSP4 + rollup
    1 are analogous to xp sp2.
    Since fltmgr was added in w2k sp4 urp1, there were major kernel updates,
    however the docs don't
    show this.

    Since you only specified sp4, I would assume the docs are correct. However,
    if you were to install
    URP1, then I'm pretty sure this would change to something a little more
    simular to a current OS.

    I can't pull up the docs on this function now.

    Just something for you to think about.....

    Good Luck,

    Matt


    ----- Original Message -----
    From: "Else Kluger" <[email protected]>
    To: "Windows System Software Devs Interest List" <[email protected]>
    Sent: Tuesday, January 15, 2008 6:14 AM
    Subject: [ntdev] PsCreateSystemThread


    > Hi,
    >
    > the description of PsCreateSystemThread says that "Drivers for Windows
    > 2000 must call PsCreateSystemThread only from the system process context".
    > Is this true for W2KSP4 too and what should happen when I do
    > PsCreateSystemThread from another context ?
    >
    > Regards
    > Else
    >
    >
    > ---
    > NTDEV is sponsored by OSR
    >
    > For our schedule of WDF, WDM, debugging and other seminars visit:
    > http://www.osr.com/seminars
    >
    > To unsubscribe, visit the List Server section of OSR Online at
    > http://www.osronline.com/page.cfm?name=ListServer
    >
  • anton_bassovanton_bassov Member MODERATED Posts: 5,279
    > Drivers for Windows 2000 must call PsCreateSystemThread only
    > from the system process context".

    Nonsense!!! I wrote a code that was creating system threads in response to IOCTLs in context of a calling thread (threads themselves were running in context of a system process, because I had specified NULL for a ProcessHandle). My code was required to work on all service packs of W2K from 0 to 4, as well as on XP SP0 and SP1 (it was the year 2004, so that a retailer version of XP SP2 had not yet been released). The code was working perfectly well everywhere......

    BTW, somewhere on MSDN I saw quite an interesting statement on the topic . It was saying "Drivers for Windows 98/Me/2000 must call PsCreateSystemThread only from the system process context " - it was speaking about W2K as if it was from Win9X family of functions....

    Probably, the above statement holds true for Win9x, but it *definitely* false for W2K......

    Anton Bassov
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    The statement is not correct, system thread can be created in context of a non-system thread
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Well thanks, I saw that statement too, it's the
    reason for my question. As my driver (W2K,XP,Vista) SEEMS to have no
    problem under W2K creating threads from somewhere else. I just want to get
    rid of the "SEEMS".
    Regards
    Else



    |---------+--------------------------------->
    | | [email protected]|
    | | om |
    | | Sent by: |
    | | [email protected]|
    | | sts.osr.com |
    | | |
    | | |
    | | 01/15/2008 02:27 PM |
    | | Please respond to |
    | | "Windows System |
    | | Software Devs Interest|
    | | List" |
    |---------+--------------------------------->
    >-----------------------------------------------------------------------------------------------------------|
    | |
    | To: "Windows System Software Devs Interest List" |
    | cc: |
    | Subject: RE:[ntdev] PsCreateSystemThread |
    >-----------------------------------------------------------------------------------------------------------|




    > Drivers for Windows 2000 must call PsCreateSystemThread only
    > from the system process context".

    Nonsense!!! I wrote a code that was creating system threads in response to
    IOCTLs in context of a calling thread (threads themselves were running in
    context of a system process, because I had specified NULL for a
    ProcessHandle). My code was required to work on all service packs of W2K
    from 0 to 4, as well as on XP SP0 and SP1 (it was the year 2004, so that a
    retailer version of XP SP2 had not yet been released). The code was working
    perfectly well everywhere......

    BTW, somewhere on MSDN I saw quite an interesting statement on the topic .
    It was saying "Drivers for Windows 98/Me/2000 must call
    PsCreateSystemThread only from the system process context " - it was
    speaking about W2K as if it was from Win9X family of functions....

    Probably, the above statement holds true for Win9x, but it *definitely*
    false for W2K......

    Anton Bassov

    ---
    NTDEV is sponsored by OSR

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at
    http://www.osronline.com/page.cfm?name=ListServer
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online