Suspending/Resuming a thread.

NTFSD
1

Hello all,

Hopefully a simple question, I have looked in the IFS help and also
searched the forum but can’t see an answer.

How can I suspend and resume a thread (in Kernal Mode) of a process
detected in the callback of PsSetCreateProcessNotifyRoutine() or
PsSetCreateThreadNotifyRoutine().

Thanks,

Dave

2

Try to dissassemble the SuspendThread API.
It should go through to any native NT function,
which should be usable in kernel too.

L.