系统线程: 在驱动中生成的线程一般是系统线程,系统线程所在的进程名为“System”,用到的内核API函数是: NTSTATUS PsCreateSystemThread( OUT PHANDLE ThreadHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES objectAttributes OPTIONAL, IN HANDLE ProcessHandle OPTIONAL, OUT PCLIENT_ID ClientId OPTION