gmh5225/driver-hidekernelthread-iocancelirpWindows kernel driver technique that hides kernel threads by abusing IoCancelIrp and IRP cancel routines, with detection methods for identifying hidden threads.
not my code. only for saving https://bbs.pediy.com/thread-272795.htm
Set the thread entry address to IoCancelIrp and the context to the irp you created. Then the thread will call IoCancelIrp. when called, will perform the operation of canlcelling the IRP. This will then call the IRP->CancelRoutine. so we just need to set our own thread entry address to IRP->CancelRoutine.
