自己帮自己顶，自己回答了。
PsCreateSystemThread函数有个可选参数ProcessHandle
ddk定义如下:
Specifies an open handle for the process in whose address space the thread is to be run. The caller’s thread must have PROCESS_CREATE_THREAD access to this process. If this parameter is not supplied, the thread will be created in the initial system process. This value should be NULL for a driver-created thread. Use the NtCurrentProcess macro to specify the current process.
再翻翻wrk看看实现就更清楚了
NTSTATUS PsCreateSystemThread{...
ProcessPointer = NULL;
if (ARGUMENT_PRESENT(ProcessHandle)) {
SystemProcess = ProcessHandle;
} else {
SystemProcess = NULL;
ProcessPointer = PsInitialSystemProcess;
}
PspCreateThread(...)
...}
