204{
210 DPRINT(
"RtlCreateUserProcess: %wZ\n", ImageFileName);
211
212
217 {
218 DPRINT1(
"Could not map process image\n");
220 }
221
222
223 if (!InheritHandles) ProcessParameters->CurrentDirectory.Handle =
NULL;
224
225
227
228
231 0,
233 ProcessSecurityDescriptor);
234
235
236
237
238
240 (
wcsstr(ImageFileName->Buffer,
L"csrss")))
241 {
243 }
244
245
249 ParentProcess,
250 InheritHandles,
252 DebugPort,
253 ExceptionPort);
255 {
256 DPRINT1(
"Could not create Kernel Process Object\n");
259 }
260
261
264 &ProcessInfo->ImageInformation,
268 {
269 DPRINT1(
"Could not query Section Info\n");
270 ZwClose(ProcessInfo->ProcessHandle);
273 }
274
275
278 &ProcessBasicInfo,
279 sizeof(ProcessBasicInfo),
282 {
283 DPRINT1(
"Could not query Process Info\n");
284 ZwClose(ProcessInfo->ProcessHandle);
287 }
288
289
292 {
293 if (ProcessParameters->StandardInput)
294 {
295 Status = ZwDuplicateObject(ParentProcess,
296 ProcessParameters->StandardInput,
297 ProcessInfo->ProcessHandle,
298 &ProcessParameters->StandardInput,
299 0,
300 0,
304 {
306 }
307 }
308
309 if (ProcessParameters->StandardOutput)
310 {
311 Status = ZwDuplicateObject(ParentProcess,
312 ProcessParameters->StandardOutput,
313 ProcessInfo->ProcessHandle,
314 &ProcessParameters->StandardOutput,
315 0,
316 0,
320 {
322 }
323 }
324
325 if (ProcessParameters->StandardError)
326 {
327 Status = ZwDuplicateObject(ParentProcess,
328 ProcessParameters->StandardError,
329 ProcessInfo->ProcessHandle,
330 &ProcessParameters->StandardError,
331 0,
332 0,
336 {
338 }
339 }
340 }
342 {
344 {
345 ZwClose(ProcessInfo->ProcessHandle);
347 }
348 }
350
353
354
357 ProcessParameters);
359 {
360 DPRINT1(
"Could not Create Process Environment\n");
361 ZwClose(ProcessInfo->ProcessHandle);
364 }
365
366
368 ThreadSecurityDescriptor,
370 ProcessInfo->ImageInformation.ZeroBits,
371 ProcessInfo->ImageInformation.MaximumStackSize,
372 ProcessInfo->ImageInformation.CommittedStackSize,
373 ProcessInfo->ImageInformation.TransferAddress,
375 &ProcessInfo->ThreadHandle,
376 &ProcessInfo->ClientId);
378 {
379 DPRINT1(
"Could not Create Thread\n");
380 ZwClose(ProcessInfo->ProcessHandle);
383 }
384
385
388}
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
_CONST_RETURN wchar_t *__cdecl wcsstr(_In_z_ const wchar_t *_Str, _In_z_ const wchar_t *_SubStr)
#define FLG_ENABLE_CSRDEBUG
@ ProcessBasicInformation
NTSYSAPI ULONG WINAPI RtlGetNtGlobalFlags(void)
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
@ SectionImageInformation
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
#define DUPLICATE_SAME_ATTRIBUTES
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
#define PROCESS_ALL_ACCESS
#define NtCurrentProcess()
NTSTATUS NTAPI RtlpMapFile(PUNICODE_STRING ImageFileName, ULONG Attributes, PHANDLE Section)
NTSTATUS NTAPI RtlpInitEnvironment(HANDLE ProcessHandle, PPEB Peb, PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
#define RTL_CONSTANT_STRING(s)
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_In_ const BITMAPINFO _In_ UINT _In_opt_ HANDLE hSection
#define DUPLICATE_SAME_ACCESS