Hi. I have several related questions:
a) Why does the DDK (XP SP1) say the following: “Drivers for Windows 2000
and Windows 98/Me must only call PsCreateSystemThread from the system
process context”.
Can’t OBJ_KERNEL_HANDLE be used for Win2k? (I know it cannot for WinME and
Win98)
b) If OBJ_KERNEL_HANDLE is not used, could I not do a ZwClose right after
ObReferenceObjectByHandle? This would be done right away while still in the
same process context as the PsCreateSystemThread call. Do I absolutely have
to schedule a work item to create a system thread if I dispose of the handle
right away? Security reasons would apply for Win2k, but for Win98/WinMe I
can’t take this seriously. Except for the security argument, are there
other reasons as well?
TIA
Philip Lukidis