45 DPRINT1(
"Failed to read image file from disk, Status = 0x%08X\n",
Status);
50 Status = ZwCreateSection(Section,
59 DPRINT1(
"Failed to create section for image file, Status = 0x%08X\n",
Status);
79 DPRINT(
"RtlpInitEnvironment(ProcessHandle: %p, Peb: %p Params: %p)\n",
87 EnviroSize = (1024 * 1024) - 256;
96 DPRINT1(
"Failed to reserve 1MB of space\n");
120 DPRINT1(
"Failed to allocate Environment Block\n");
146 DPRINT1(
"Failed to allocate Parameter Block\n");
154 ProcessParameters->
Length,
158 DPRINT1(
"Failed to write the Parameter Block\n");
170 DPRINT1(
"Failed to write pointer to Parameter Block\n");
210 DPRINT(
"RtlCreateUserProcess: %wZ\n", ImageFileName);
218 DPRINT1(
"Could not map process image\n");
223 if (!InheritHandles) ProcessParameters->CurrentDirectory.Handle =
NULL;
233 ProcessSecurityDescriptor);
240 (
wcsstr(ImageFileName->Buffer,
L"csrss")))
256 DPRINT1(
"Could not create Kernel Process Object\n");
264 &ProcessInfo->ImageInformation,
269 DPRINT1(
"Could not query Section Info\n");
270 ZwClose(ProcessInfo->ProcessHandle);
279 sizeof(ProcessBasicInfo),
283 DPRINT1(
"Could not query Process Info\n");
284 ZwClose(ProcessInfo->ProcessHandle);
293 if (ProcessParameters->StandardInput)
295 Status = ZwDuplicateObject(ParentProcess,
296 ProcessParameters->StandardInput,
297 ProcessInfo->ProcessHandle,
298 &ProcessParameters->StandardInput,
309 if (ProcessParameters->StandardOutput)
311 Status = ZwDuplicateObject(ParentProcess,
312 ProcessParameters->StandardOutput,
313 ProcessInfo->ProcessHandle,
314 &ProcessParameters->StandardOutput,
325 if (ProcessParameters->StandardError)
327 Status = ZwDuplicateObject(ParentProcess,
328 ProcessParameters->StandardError,
329 ProcessInfo->ProcessHandle,
330 &ProcessParameters->StandardError,
345 ZwClose(ProcessInfo->ProcessHandle);
360 DPRINT1(
"Could not Create Process Environment\n");
361 ZwClose(ProcessInfo->ProcessHandle);
368 ThreadSecurityDescriptor,
370 ProcessInfo->ImageInformation.ZeroBits,
371 ProcessInfo->ImageInformation.MaximumStackSize,
372 ProcessInfo->ImageInformation.CommittedStackSize,
373 ProcessInfo->ImageInformation.TransferAddress,
375 &ProcessInfo->ThreadHandle,
376 &ProcessInfo->ClientId);
379 DPRINT1(
"Could not Create Thread\n");
380 ZwClose(ProcessInfo->ProcessHandle);
407 DPRINT1(
"Failed to receive the process cookie! Status: 0x%lx\n",
Status);
457 ULONG BreakOnTermination;
460 if (OldValue) *OldValue =
FALSE;
478 *OldValue = (
BOOLEAN)BreakOnTermination;
482 BreakOnTermination = NewValue;
500 RtlRosGetAppcompatVersion(
VOID)
PVOID NTAPI RtlEncodeSystemPointer(IN PVOID Pointer)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
PVOID PVOID PWCHAR PVOID Environment
NTSTATUS NTAPI RtlpMapFile(PUNICODE_STRING ImageFileName, ULONG Attributes, PHANDLE Section)
#define PROCESS_ALL_ACCESS
#define OBJ_CASE_INSENSITIVE
#define _WIN32_WINNT_WS03
_CONST_RETURN wchar_t *__cdecl wcsstr(_In_z_ const wchar_t *_Str, _In_z_ const wchar_t *_SubStr)
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
PVOID NTAPI RtlDecodePointer(IN PVOID Pointer)
#define FLG_ENABLE_CSRDEBUG
IN PVOID IN PVOID IN USHORT IN USHORT Size
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
#define FLG_ENABLE_SYSTEM_CRIT_BREAKS
NTSTATUS NTAPI RtlCreateUserProcess(IN PUNICODE_STRING ImageFileName, IN ULONG Attributes, IN OUT PRTL_USER_PROCESS_PARAMETERS ProcessParameters, IN PSECURITY_DESCRIPTOR ProcessSecurityDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL, IN HANDLE ParentProcess OPTIONAL, IN BOOLEAN InheritHandles, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, OUT PRTL_USER_PROCESS_INFORMATION ProcessInfo)
ULONG NTAPI NtGetCurrentProcessorNumber(VOID)
#define SECTION_ALL_ACCESS
#define DUPLICATE_SAME_ACCESS
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
PVOID NTAPI RtlEncodePointer(IN PVOID Pointer)
NTSTATUS __cdecl RtlSetProcessIsCritical(IN BOOLEAN NewValue, OUT PBOOLEAN OldValue OPTIONAL, IN BOOLEAN NeedBreaks)
#define NtCurrentProcess()
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
#define NT_SUCCESS(StatCode)
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
PPEB NTAPI RtlGetCurrentPeb(VOID)
#define STATUS_UNSUCCESSFUL
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
#define FILE_SHARE_DELETE
#define FILE_NON_DIRECTORY_FILE
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
#define DUPLICATE_SAME_ATTRIBUTES
static OUT PIO_STATUS_BLOCK IoStatusBlock
ULONG NTAPI RtlGetCurrentProcessorNumber(VOID)
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
#define FILE_SYNCHRONOUS_IO_NONALERT
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
_In_ HANDLE ProcessHandle
NTSTATUS NTAPI RtlpInitEnvironment(HANDLE ProcessHandle, PPEB Peb, PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
_IRQL_requires_max_(APC_LEVEL)
_In_ const BITMAPINFO _In_ UINT _In_opt_ HANDLE hSection
ULONG NTAPI RtlGetNtGlobalFlags(VOID)
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
#define RTL_CONSTANT_STRING(s)
PULONG MinorVersion OPTIONAL
NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)