45 DPRINT1(
"Failed to read image file from disk, Status = 0x%08X\n",
Status);
50 Status = ZwCreateSection(Section,
59 DPRINT1(
"Failed to create section for image file, Status = 0x%08X\n",
Status);
79 DPRINT(
"RtlpInitEnvironment(ProcessHandle: %p, Peb: %p Params: %p)\n",
87 EnviroSize = (1024 * 1024) - 256;
96 DPRINT1(
"Failed to reserve 1MB of space\n");
120 DPRINT1(
"Failed to allocate Environment Block\n");
146 DPRINT1(
"Failed to allocate Parameter Block\n");
154 ProcessParameters->
Length,
158 DPRINT1(
"Failed to write the Parameter Block\n");
170 DPRINT1(
"Failed to write pointer to Parameter Block\n");
210 DPRINT(
"RtlCreateUserProcess: %wZ\n", ImageFileName);
218 DPRINT1(
"Could not map process image\n");
223 if (!InheritHandles) ProcessParameters->CurrentDirectory.Handle =
NULL;
233 ProcessSecurityDescriptor);
240 (
wcsstr(ImageFileName->Buffer,
L"csrss")))
256 DPRINT1(
"Could not create Kernel Process Object\n");
264 &ProcessInfo->ImageInformation,
269 DPRINT1(
"Could not query Section Info\n");
270 ZwClose(ProcessInfo->ProcessHandle);
279 sizeof(ProcessBasicInfo),
283 DPRINT1(
"Could not query Process Info\n");
284 ZwClose(ProcessInfo->ProcessHandle);
293 if (ProcessParameters->StandardInput)
295 Status = ZwDuplicateObject(ParentProcess,
296 ProcessParameters->StandardInput,
297 ProcessInfo->ProcessHandle,
298 &ProcessParameters->StandardInput,
309 if (ProcessParameters->StandardOutput)
311 Status = ZwDuplicateObject(ParentProcess,
312 ProcessParameters->StandardOutput,
313 ProcessInfo->ProcessHandle,
314 &ProcessParameters->StandardOutput,
325 if (ProcessParameters->StandardError)
327 Status = ZwDuplicateObject(ParentProcess,
328 ProcessParameters->StandardError,
329 ProcessInfo->ProcessHandle,
330 &ProcessParameters->StandardError,
345 ZwClose(ProcessInfo->ProcessHandle);
360 DPRINT1(
"Could not Create Process Environment\n");
361 ZwClose(ProcessInfo->ProcessHandle);
368 ThreadSecurityDescriptor,
370 ProcessInfo->ImageInformation.ZeroBits,
371 ProcessInfo->ImageInformation.MaximumStackSize,
372 ProcessInfo->ImageInformation.CommittedStackSize,
373 ProcessInfo->ImageInformation.TransferAddress,
375 &ProcessInfo->ThreadHandle,
376 &ProcessInfo->ClientId);
379 DPRINT1(
"Could not Create Thread\n");
380 ZwClose(ProcessInfo->ProcessHandle);
407 DPRINT1(
"Failed to receive the process cookie! Status: 0x%lx\n",
Status);
457 ULONG BreakOnTermination;
460 if (OldValue) *OldValue =
FALSE;
478 *OldValue = (
BOOLEAN)BreakOnTermination;
482 BreakOnTermination = NewValue;
500RtlRosGetAppcompatVersion(
VOID)
#define FILE_NON_DIRECTORY_FILE
static CCHAR DebugString[256]
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define NT_SUCCESS(StatCode)
#define _IRQL_requires_max_(irql)
#define FILE_SYNCHRONOUS_IO_NONALERT
_CONST_RETURN wchar_t *__cdecl wcsstr(_In_z_ const wchar_t *_Str, _In_z_ const wchar_t *_SubStr)
#define FLG_ENABLE_SYSTEM_CRIT_BREAKS
#define FLG_ENABLE_CSRDEBUG
#define OBJ_CASE_INSENSITIVE
@ ProcessBreakOnTermination
@ ProcessBasicInformation
NTSYSAPI ULONG WINAPI NtGetCurrentProcessorNumber(void)
NTSYSAPI PEB *WINAPI RtlGetCurrentPeb(void)
NTSYSAPI ULONG WINAPI RtlGetNtGlobalFlags(void)
PVOID PVOID PWCHAR PVOID Environment
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
NTSYSAPI NTSTATUS NTAPI ZwOpenFile(_Out_ PHANDLE FileHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes, _Out_ PIO_STATUS_BLOCK IoStatusBlock, _In_ ULONG ShareAccess, _In_ ULONG OpenOptions)
NTSYSAPI NTSTATUS NTAPI ZwQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
_In_ HANDLE ProcessHandle
NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
@ SectionImageInformation
NTSYSAPI NTSTATUS NTAPI ZwClose(_In_ HANDLE Handle)
#define DUPLICATE_SAME_ATTRIBUTES
NTSYSAPI NTSTATUS NTAPI ZwSetInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _In_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength)
NTSYSAPI NTSTATUS NTAPI ZwCreateProcess(_Out_ PHANDLE ProcessHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ HANDLE ParentProcess, _In_ BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort)
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTSYSAPI NTSTATUS NTAPI RtlCreateUserThread(_In_ PVOID ThreadContext, _Out_ HANDLE *OutThreadHandle, _Reserved_ PVOID Reserved1, _Reserved_ PVOID Reserved2, _Reserved_ PVOID Reserved3, _Reserved_ PVOID Reserved4, _Reserved_ PVOID Reserved5, _Reserved_ PVOID Reserved6, _Reserved_ PVOID Reserved7, _Reserved_ PVOID Reserved8)
#define RTL_USER_PROCESS_PARAMETERS_RESERVE_1MB
#define SECTION_ALL_ACCESS
#define PROCESS_ALL_ACCESS
#define NtCurrentProcess()
#define FILE_SHARE_DELETE
NTSTATUS NTAPI RtlCreateUserProcess(IN PUNICODE_STRING ImageFileName, IN ULONG Attributes, IN OUT PRTL_USER_PROCESS_PARAMETERS ProcessParameters, IN PSECURITY_DESCRIPTOR ProcessSecurityDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR ThreadSecurityDescriptor OPTIONAL, IN HANDLE ParentProcess OPTIONAL, IN BOOLEAN InheritHandles, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, OUT PRTL_USER_PROCESS_INFORMATION ProcessInfo)
PVOID NTAPI RtlEncodeSystemPointer(IN PVOID Pointer)
NTSTATUS __cdecl RtlSetProcessIsCritical(IN BOOLEAN NewValue, OUT PBOOLEAN OldValue OPTIONAL, IN BOOLEAN NeedBreaks)
NTSTATUS NTAPI RtlpMapFile(PUNICODE_STRING ImageFileName, ULONG Attributes, PHANDLE Section)
NTSTATUS NTAPI RtlpInitEnvironment(HANDLE ProcessHandle, PPEB Peb, PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
PVOID NTAPI RtlDecodePointer(IN PVOID Pointer)
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
PVOID NTAPI RtlEncodePointer(IN PVOID Pointer)
ULONG NTAPI RtlGetCurrentProcessorNumber(VOID)
#define _WIN32_WINNT_WS03
PULONG MinorVersion OPTIONAL
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
#define RTL_CONSTANT_STRING(s)
#define STATUS_UNSUCCESSFUL
_Must_inspect_result_ _In_ WDFDMAENABLER _In_ _In_opt_ PWDF_OBJECT_ATTRIBUTES Attributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_In_ const BITMAPINFO _In_ UINT _In_opt_ HANDLE hSection
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
#define DUPLICATE_SAME_ACCESS