210 DPRINT(
"RtlCreateUserProcess: %wZ\n", ImageFileName);
218 DPRINT1(
"Could not map process image\n");
223 if (!InheritHandles) ProcessParameters->CurrentDirectory.Handle =
NULL;
233 ProcessSecurityDescriptor);
240 (
wcsstr(ImageFileName->Buffer,
L"csrss")))
256 DPRINT1(
"Could not create Kernel Process Object\n");
264 &ProcessInfo->ImageInformation,
269 DPRINT1(
"Could not query Section Info\n");
270 ZwClose(ProcessInfo->ProcessHandle);
279 sizeof(ProcessBasicInfo),
283 DPRINT1(
"Could not query Process Info\n");
284 ZwClose(ProcessInfo->ProcessHandle);
293 if (ProcessParameters->StandardInput)
295 Status = ZwDuplicateObject(ParentProcess,
296 ProcessParameters->StandardInput,
297 ProcessInfo->ProcessHandle,
298 &ProcessParameters->StandardInput,
309 if (ProcessParameters->StandardOutput)
311 Status = ZwDuplicateObject(ParentProcess,
312 ProcessParameters->StandardOutput,
313 ProcessInfo->ProcessHandle,
314 &ProcessParameters->StandardOutput,
325 if (ProcessParameters->StandardError)
327 Status = ZwDuplicateObject(ParentProcess,
328 ProcessParameters->StandardError,
329 ProcessInfo->ProcessHandle,
330 &ProcessParameters->StandardError,
345 ZwClose(ProcessInfo->ProcessHandle);
360 DPRINT1(
"Could not Create Process Environment\n");
361 ZwClose(ProcessInfo->ProcessHandle);
368 ThreadSecurityDescriptor,
370 ProcessInfo->ImageInformation.ZeroBits,
371 ProcessInfo->ImageInformation.MaximumStackSize,
372 ProcessInfo->ImageInformation.CommittedStackSize,
373 ProcessInfo->ImageInformation.TransferAddress,
375 &ProcessInfo->ThreadHandle,
376 &ProcessInfo->ClientId);
379 DPRINT1(
"Could not Create Thread\n");
380 ZwClose(ProcessInfo->ProcessHandle);
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
NTSTATUS NTAPI RtlpMapFile(PUNICODE_STRING ImageFileName, ULONG Attributes, PHANDLE Section)
#define PROCESS_ALL_ACCESS
_CONST_RETURN wchar_t *__cdecl wcsstr(_In_z_ const wchar_t *_Str, _In_z_ const wchar_t *_SubStr)
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
#define FLG_ENABLE_CSRDEBUG
#define DUPLICATE_SAME_ACCESS
#define NtCurrentProcess()
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
#define NT_SUCCESS(StatCode)
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
#define DUPLICATE_SAME_ATTRIBUTES
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSTATUS NTAPI RtlpInitEnvironment(HANDLE ProcessHandle, PPEB Peb, PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
_In_ const BITMAPINFO _In_ UINT _In_opt_ HANDLE hSection
ULONG NTAPI RtlGetNtGlobalFlags(VOID)
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
#define RTL_CONSTANT_STRING(s)