Hi,
What is the fundamental difference between these two? From the MS documentation it seems that a driver should use IoCreateSystemThread(), for example it guarantees that the driver does not unload while the thread is active.
However most of the discussion here is around PsCreateSystemThread ().
This appears to be more "generic" way of creating a stand-alone thread. Also Windows Driver Samples exclusively use this method.
Why I should not use IoCreateSystemThread()?
from the MSDN documentation
IoCreateSystemThread is similar to the PsCreateSystemThread routine, but has an additional parameter, IoObject , which is a pointer to the caller's driver object or device object. IoCreateSystemThread uses this parameter to ensure that the driver cannot unload while the created thread exists. Before scheduling StartRoutine to run in this thread, IoCreateSystemThread takes a counted reference to the IoObject object. The I/O manager releases this reference after the created thread exits. Thus, this object persists for the lifetime of the created thread.
In contrast to a system thread that is created by the PsCreateSystemThread routine, a thread created by IoCreateSystemThread does not call the PsTerminateSystemThread routine to terminate itself. Instead, the I/O manager calls PsTerminateSystemThread on behalf of the created thread when the thread exits.
IoCreateSystemThread function (wdm.h) - Windows drivers | Microsoft Learn
This is a newer function that wraps some common logic into the API. Automatic use of reference tracking / rundown prevention and a simpler thread termination scenario. If these features match your needs, then use this function. If not, use the other one. Neither is inherently better
Thank you. Looks like Io.. version is then what I need.