2260 ULONG ParameterFlags, PrivilegeValue, HardErrorMode, ErrorResponse;
2262 BOOLEAN InJob, SaferNeeded, UseLargePages, HavePrivilege;
2263 BOOLEAN QuerySection, SkipSaferAndAppCompat;
2273 NTSTATUS Status, AppCompatStatus, SaferStatus, IFEOStatus, ImageDbgStatus;
2291 SIZE_T EnvironmentLength, CmdLineLength;
2296 BOOLEAN SearchRetry, QuotesNeeded, CmdLineIsAppName, HasQuotes;
2302 #if _SXS_SUPPORT_ENABLED_ 2310 PVOID CapturedStrings[3];
2314 PWCHAR SxsConglomeratedBuffer, StaticBuffer;
2315 ULONG ConglomeratedBufferSizeBytes, StaticBufferSize,
i;
2322 PWCHAR FilePart, PathBuffer, FreeBuffer;
2330 PVOID AppCompatSxsData, AppCompatData;
2331 ULONG AppCompatSxsDataSize, AppCompatDataSize;
2335 ULONG BinarySubType, VdmBinaryType, VdmTask, VdmReserve;
2345 QuerySection =
FALSE;
2347 SkipSaferAndAppCompat =
FALSE;
2354 SectionHandle =
NULL;
2356 ThreadHandle =
NULL;
2360 AppCompatData =
NULL;
2361 AppCompatDataSize = 0;
2362 AppCompatSxsData =
NULL;
2363 AppCompatSxsDataSize = 0;
2364 CaptureBuffer =
NULL;
2365 #if _SXS_SUPPORT_ENABLED_ 2366 SxsConglomeratedBuffer =
NULL;
2371 DebuggerCmdLine =
NULL;
2381 QuotedCmdLine =
NULL;
2391 VdmWaitObject =
NULL;
2392 UseVdmReserve =
FALSE;
2401 #if _SXS_SUPPORT_ENABLED_ 2407 RtlZeroMemory(&LocalProcessAttributes,
sizeof(LocalProcessAttributes));
2408 RtlZeroMemory(&LocalThreadAttributes,
sizeof(LocalThreadAttributes));
2411 RtlZeroMemory(lpProcessInformation,
sizeof(*lpProcessInformation));
2412 if (hNewToken) *hNewToken =
NULL;
2418 #if _SXS_SUPPORT_ENABLED_ 2420 SxsStaticBuffers[0] = &SxsWin32ManifestPath;
2421 SxsStaticBuffers[1] = &SxsWin32PolicyPath;
2422 SxsStaticBuffers[2] = &SxsWin32AssemblyDirectory;
2423 SxsStaticBuffers[3] = &SxsNtManifestPath;
2424 SxsStaticBuffers[4] = &SxsNtPolicyPath;
2425 ExePathPair.
Win32 = &SxsWin32ExePath;
2426 ExePathPair.
Nt = &SxsNtExePath;
2427 ManifestPathPair.
Win32 = &SxsWin32ManifestPath.
String;
2428 ManifestPathPair.
Nt = &SxsNtManifestPath.
String;
2429 PolicyPathPair.
Win32 = &SxsWin32PolicyPath.
String;
2430 PolicyPathPair.
Nt = &SxsNtPolicyPath.
String;
2433 DPRINT(
"CreateProcessInternalW: '%S' '%S' %lx\n", lpApplicationName, lpCommandLine, dwCreationFlags);
2443 DPRINT1(
"Invalid flag combo used\n");
2493 DPRINT1(
"Invalid WOW flags\n");
2518 while ((*pcScan) || (*(pcScan + 1))) ++pcScan;
2521 EnvironmentLength = (pcScan +
sizeof(
ANSI_NULL) - (
PCHAR)lpEnvironment);
2564 lpEnvironment = UnicodeEnv.
Buffer;
2568 StartupInfo = *lpStartupInfo;
2604 QuotesNeeded =
FALSE;
2605 CmdLineIsAppName =
FALSE;
2608 if (!lpApplicationName)
2625 lpApplicationName = NullBuffer = ScanString = lpCommandLine;
2628 if (*lpCommandLine ==
L'\"')
2631 SearchRetry =
FALSE;
2633 lpApplicationName = ScanString;
2637 if (*ScanString ==
L'\"')
2640 NullBuffer = ScanString;
2647 NullBuffer = ScanString;
2654 lpApplicationName = lpCommandLine;
2658 if ((*ScanString ==
L' ') || (*ScanString ==
L'\t'))
2661 NullBuffer = ScanString;
2667 NullBuffer = ScanString;
2672 SaveChar = *NullBuffer;
2718 DPRINT(
"Length: %lu Buffer: %S\n",
Length, NameBuffer);
2724 *NullBuffer = SaveChar;
2725 lpApplicationName = NameBuffer;
2769 *NullBuffer = SaveChar;
2770 lpApplicationName = NameBuffer;
2773 if (!(*ScanString) || !(SearchRetry))
2782 NullBuffer = ScanString;
2785 QuotesNeeded =
TRUE;
2790 else if (!(lpCommandLine) || !(*lpCommandLine))
2793 CmdLineIsAppName =
TRUE;
2794 lpCommandLine = (
LPWSTR)lpApplicationName;
2801 &SxsWin32RelativePath);
2802 if (!TranslationStatus)
2805 DPRINT1(
"Path translation for SxS failed\n");
2813 FreeBuffer = PathName.
Buffer;
2824 RtlInitEmptyUnicodeString(&PathBufferString,
NULL, 0);
2843 SxsWin32ExePath = PathBufferString;
2844 PathBuffer = PathBufferString.
Buffer;
2846 DPRINT(
"SxS Path: %S\n", PathBuffer);
2850 #if _SXS_SUPPORT_ENABLED_ 2851 SxsNtExePath = PathName;
2876 &LocalObjectAttributes,
2886 &LocalObjectAttributes,
2895 DPRINT1(
"Open file failed: %lx (%wZ)\n",
Status, &PathName);
2948 DPRINT1(
"Invalid Blade hashes!\n");
2958 DPRINT1(
"Tampered Blade hashes!\n");
2975 SectionHandle =
NULL;
2991 UseVdmReserve =
TRUE;
2995 SectionHandle =
NULL;
2998 QuerySection =
FALSE;
3003 if (!SkipSaferAndAppCompat)
3015 AppCompatData =
NULL;
3016 AppCompatSxsData =
NULL;
3033 sizeof(ImageInformation),
3041 QuerySection =
TRUE;
3042 ImageMachine = ImageInformation.
Machine;
3054 &AppCompatSxsDataSize,
3059 DPRINT1(
"App compat launch failure: %lx\n", AppCompatStatus);
3076 SectionHandle =
NULL;
3089 if (!(SkipSaferAndAppCompat) &&
3111 SaferNeeded =
FALSE;
3123 (
LPWSTR)lpApplicationName,
3128 if (SaferStatus == 0xFFFFFFFF)
3131 DPRINT1(
"WinSafer blocking process launch\n");
3140 DPRINT1(
"Error checking WinSafer: %lx\n", SaferStatus);
3165 DPRINT1(
"VDM environment for WOW app failed\n");
3173 VdmBinaryType = (dwCreationFlags &
3218 if (UseVdmReserve) VdmReserve = 1;
3228 DPRINT1(
"VDM Configuration failed for WOW\n");
3234 lpCommandLine = VdmString.
Buffer;
3235 lpApplicationName =
NULL;
3256 DPRINT1(
"VDM is not ready for WOW\n");
3269 if (VdmWaitObject)
goto VdmShortCircuit;
3272 bInheritHandles =
FALSE;
3275 if ((lpEnvironment) &&
3282 SkipSaferAndAppCompat =
TRUE;
3310 DPRINT1(
"VDM environment for DOS failed\n");
3346 DPRINT1(
"Detached process but no VDM, not allowed\n");
3359 DPRINT1(
"VDM Configuration failed for DOS\n");
3365 lpCommandLine = VdmString.
Buffer;
3366 lpApplicationName =
NULL;
3379 DPRINT1(
"VDM is not ready for DOS\n");
3392 if (VdmWaitObject)
goto VdmShortCircuit;
3395 bInheritHandles =
FALSE;
3398 if ((lpEnvironment) &&
3405 lpEnvironment = VdmUnicodeEnv.
Buffer;
3417 DPRINT1(
"'%wZ': Invalid EXE, and not a batch or script file\n", &PathName);
3424 CmdQuoteLength = CmdLineIsAppName || HasQuotes;
3425 if (!CmdLineIsAppName)
3427 if (HasQuotes) CmdQuoteLength++;
3435 CmdLineLength =
wcslen(lpCommandLine);
3437 CmdLineLength += CmdQuoteLength +
sizeof(
ANSI_NULL);
3438 CmdLineLength *=
sizeof(
WCHAR);
3444 if (!AnsiCmdCommand)
3453 if ((CmdLineIsAppName) || (HasQuotes))
3455 wcscat(AnsiCmdCommand,
L"\"");
3457 wcscat(AnsiCmdCommand, lpCommandLine);
3458 if ((CmdLineIsAppName) || (HasQuotes))
3460 wcscat(AnsiCmdCommand,
L"\"");
3467 lpCommandLine = DebuggerString.
Buffer;
3468 lpApplicationName =
NULL;
3469 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3473 SkipSaferAndAppCompat =
TRUE;
3480 DPRINT1(
"64-bit binary, failing\n");
3489 DPRINT1(
"File is offline, failing\n");
3525 sizeof(ImageInformation),
3530 DPRINT1(
"Section query failed\n");
3537 QuerySection =
TRUE;
3544 DPRINT1(
"Trying to launch a DLL, failing\n");
3554 ParameterFlags &= ~2;
3570 if (!DebuggerCmdLine)
3576 if (!DebuggerCmdLine)
3597 (ResultSize <
sizeof(
WCHAR)) ||
3601 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3602 DebuggerCmdLine =
NULL;
3610 sizeof(UseLargePages),
3612 if ((
NT_SUCCESS(IFEOStatus)) && (UseLargePages))
3630 ErrorParameters[0] = (
ULONG_PTR)&PathName;
3649 DPRINT1(
"Invalid image architecture: %lx\n", ImageInformation.
Machine);
3660 SectionHandle =
NULL;
3661 QuerySection =
FALSE;
3680 DPRINT1(
"Subsystem command line failed\n");
3685 lpCommandLine = DebuggerString.
Buffer;
3686 lpApplicationName =
NULL;
3689 SkipSaferAndAppCompat =
TRUE;
3690 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3700 DPRINT1(
"Invalid subsystem version: %hu.%hu\n",
3708 if (DebuggerCmdLine)
3715 lpCommandLine = (
LPWSTR)lpApplicationName;
3752 if (!DebuggerString.
Buffer)
3760 RtlInitEmptyUnicodeString(&DebuggerString,
3774 DbgPrint(
"BASE: Calling debugger with '%wZ'\n", &DebuggerString);
3777 lpCommandLine = DebuggerString.
Buffer;
3778 lpApplicationName =
NULL;
3782 SectionHandle =
NULL;
3783 QuerySection =
FALSE;
3790 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3791 DebuggerCmdLine =
NULL;
3792 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3798 lpProcessAttributes,
3804 LocalProcessAttributes = *lpProcessAttributes;
3807 &LocalProcessAttributes,
3825 DPRINT1(
"Failed to connect to DbgUI!\n");
3846 HavePrivilege =
FALSE;
3847 PrivilegeState =
NULL;
3856 HavePrivilege =
TRUE;
3897 RealTimePrivilegeState =
NULL;
3948 DPRINT1(
"Failed to update VDM with wait object\n");
3949 VdmWaitObject =
NULL;
3987 sizeof(ImageInformation),
3999 QuerySection =
TRUE;
4006 DPRINT1(
"Image should receive SxS Fusion Isolation\n");
4013 if (lpCurrentDirectory)
4016 DPRINT(
"Current directory: %S\n", lpCurrentDirectory);
4048 DPRINT1(
"Current directory is invalid\n");
4056 if ((QuotesNeeded) || (CmdLineIsAppName))
4071 SaveChar = *NullBuffer;
4076 wcscat(QuotedCmdLine, lpCommandLine);
4082 *NullBuffer = SaveChar;
4083 wcscat(QuotedCmdLine, NullBuffer);
4089 if (QuotesNeeded) QuotesNeeded =
FALSE;
4090 if (CmdLineIsAppName) CmdLineIsAppName =
FALSE;
4095 if (CreateProcessMsg->
Sxs.
Flags & 1) ParameterFlags |= 1;
4098 if ((QuotesNeeded) || (CmdLineIsAppName)) lpCommandLine = QuotedCmdLine;
4109 dwCreationFlags | NoWindow,
4117 DPRINT1(
"BasePushProcessParameters failed\n");
4126 if (!(VdmBinaryType) &&
4127 !(bInheritHandles) &&
4196 LocalThreadAttributes = *lpThreadAttributes;
4199 &LocalThreadAttributes,
4229 DPRINT1(
"TODO: WOW64 is not supported yet\n");
4237 switch (ImageInformation.
Machine)
4252 DbgPrint(
"kernel32: No mapping for ImageInformation.Machine == %04x\n",
4303 CreateProcessMsg->
VdmTask = VdmTask;
4305 else if (VdmReserve)
4315 DPRINT1(
"This is an SxS Message -- should not happen yet\n");
4327 sizeof(*CreateProcessMsg));
4333 CaptureBuffer =
NULL;
4340 DPRINT1(
"Failed to tell csrss about new process\n");
4402 lpProcessInformation->hProcess = VdmWaitObject;
4418 lpProcessInformation->hProcess = VdmWaitObject;
4431 lpProcessInformation->hThread = ThreadHandle;
4437 ThreadHandle =
NULL;
4441 if (DebuggerCmdLine)
RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
4447 RtlInitEmptyUnicodeString(&SxsWin32ExePath,
NULL, 0);
4448 SxsWin32ExePath.
Length = 0;
4454 #if _SXS_SUPPORT_ENABLED_ 4463 if (SxsConglomeratedBuffer)
4466 for (
i = 0;
i < 5;
i++)
4469 ThisBuffer = SxsStaticBuffers[
i];
4474 if ((ThisBuffer != (
PVOID)-8) && (ByteBuffer->
Buffer))
4490 RtlInitEmptyUnicodeString(&ThisBuffer->
String,
4511 lpEnvironment =
NULL;
4515 RtlFreeHeap(RtlGetProcessHeap(), 0, QuotedCmdLine);
4522 if (SectionHandle)
NtClose(SectionHandle);
4536 if (JobHandle)
NtClose(JobHandle);
4578 if (VdmWaitObject)
NtClose(VdmWaitObject);
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
BASE_SXS_CREATEPROCESS_MSG Sxs
#define ERROR_INVALID_PARAMETER
VOID WINAPI BasepFreeAppCompatData(IN PVOID AppCompatData, IN PVOID AppCompatSxsData)
#define ERROR_CHILD_NOT_COMPLETE
PVOID WINAPI BasepIsRealtimeAllowed(IN BOOLEAN Keep)
ULONG ImageSubsystemMajorVersion
VOID NTAPI CsrFreeCaptureBuffer(IN PCSR_CAPTURE_BUFFER CaptureBuffer)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
enum _RTL_PATH_TYPE RTL_PATH_TYPE
#define STATUS_INVALID_IMAGE_WIN_64
#define RemoveFromHandle(x, y)
NTSTATUS WINAPI BaseCreateStack(_In_ HANDLE hProcess, _In_opt_ SIZE_T StackCommit, _In_opt_ SIZE_T StackReserve, _Out_ PINITIAL_TEB InitialTeb)
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
VOID WINAPI BaseInitializeContext(IN PCONTEXT Context, IN PVOID Parameter, IN PVOID StartAddress, IN PVOID StackAddress, IN ULONG ContextType)
#define THREAD_ALL_ACCESS
PVOID PVOID PWCHAR PVOID USHORT PULONG PVOID PULONG PVOID PULONG PULONG FusionFlags
#define REALTIME_PRIORITY_CLASS
#define IMAGE_SUBSYSTEM_POSIX_CUI
_In_ NDIS_ERROR_CODE ErrorCode
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define PROCESS_PRIORITY_CLASS_INVALID
#define PROCESS_ALL_ACCESS
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
#define SEM_FAILCRITICALERRORS
#define OBJ_CASE_INSENSITIVE
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
BOOL WINAPI BaseUpdateVDMEntry(IN ULONG UpdateIndex, IN OUT PHANDLE WaitHandle, IN ULONG IndexInfo, IN ULONG BinaryType)
PBASE_STATIC_SERVER_DATA BaseStaticServerData
#define CREATE_SEPARATE_WOW_VDM
#define CREATE_UNICODE_ENVIRONMENT
#define PROCESSOR_ARCHITECTURE_UNKNOWN
WCHAR CurrentDirectory[1024]
IN BOOLEAN OUT PSTR Buffer
#define SE_LOCK_MEMORY_PRIVILEGE
#define AddToHandle(x, y)
NTSYSAPI VOID NTAPI RtlDestroyEnvironment(_In_ PWSTR Environment)
BOOL NTAPI BaseCreateVDMEnvironment(IN PWCHAR lpEnvironment, OUT PANSI_STRING AnsiEnv, OUT PUNICODE_STRING UnicodeEnv)
NTSTATUS WINAPI BasepCheckWinSaferRestrictions(IN HANDLE UserToken, IN LPWSTR ApplicationName, IN HANDLE FileHandle, OUT PBOOLEAN InJob, OUT PHANDLE NewToken, OUT PHANDLE JobHandle)
NTSTATUS NTAPI CsrClientCallServer(IN OUT PCSR_API_MESSAGE ApiMessage, IN OUT PCSR_CAPTURE_BUFFER CaptureBuffer OPTIONAL, IN CSR_API_NUMBER ApiNumber, IN ULONG DataLength)
HANDLE ContainingDirectory
BOOL WINAPI BaseGetVdmConfigInfo(IN LPCWSTR CommandLineReserved, IN ULONG DosSeqId, IN ULONG BinaryType, IN PUNICODE_STRING CmdLineString, OUT PULONG VdmSize)
BASE_CREATE_PROCESS CreateProcessRequest
BOOL NTAPI BaseDestroyVDMEnvironment(IN PANSI_STRING AnsiEnv, IN PUNICODE_STRING UnicodeEnv)
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName)
BOOLEAN DefaultSeparateVDM
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
_Check_return_ _CRTIMP int __cdecl _wcsnicmp(_In_reads_or_z_(_MaxCount) const wchar_t *_Str1, _In_reads_or_z_(_MaxCount) const wchar_t *_Str2, _In_ size_t _MaxCount)
#define ERROR_NOT_ENOUGH_MEMORY
#define INVALID_HANDLE_VALUE
DWORD WINAPI GetLastError(VOID)
DWORD WINAPI GetFullPathNameW(IN LPCWSTR lpFileName, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart)
#define CREATE_DEFAULT_ERROR_MODE
NTSTATUS NTAPI RtlGetFullPathName_UstrEx(_In_ PUNICODE_STRING FileName, _In_opt_ PUNICODE_STRING StaticString, _In_opt_ PUNICODE_STRING DynamicString, _Out_opt_ PUNICODE_STRING *StringUsed, _Out_opt_ PSIZE_T FilePartSize, _Out_opt_ PBOOLEAN NameInvalid, _Out_ RTL_PATH_TYPE *PathType, _Out_opt_ PSIZE_T LengthNeeded)
#define VDM_UNDO_COMPLETED
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
#define STARTF_FORCEONFEEDBACK
#define NORMAL_PRIORITY_CLASS
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
UNICODE_STRING DesktopInfo
#define UNICODE_STRING_MAX_BYTES
#define ERROR_ACCESS_DISABLED_WEBBLADE
#define VER_SUITE_DATACENTER
#define IMAGE_FILE_MACHINE_AMD64
#define STATUS_VDM_DISALLOWED
#define VER_SUITE_PERSONAL
PVOID ArbitraryUserPointer
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(IN PUNICODE_STRING SubKey, IN BOOLEAN Wow64, OUT PHANDLE NewKeyHandle)
#define STARTF_FORCEOFFFEEDBACK
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToRelativeNtPathName_U(_In_ PCWSTR DosName, _Out_ PUNICODE_STRING NtName, _Out_ PCWSTR *PartName, _Out_ PRTL_RELATIVE_NAME_U RelativeName)
#define ABOVE_NORMAL_PRIORITY_CLASS
#define PROCESSOR_ARCHITECTURE_IA64
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN OUT PATH_TYPE_AND_UNKNOWN * PathType
#define SECTION_ALL_ACCESS
return STATUS_NOT_IMPLEMENTED
#define ERROR_ACCESS_DENIED
BOOLEAN WINAPI BasepIsImageVersionOk(IN ULONG ImageMajorVersion, IN ULONG ImageMinorVersion)
DWORD WINAPI GetFileAttributesW(LPCWSTR lpFileName)
#define STARTF_SHELLPRIVATE
HANDLE WaitObjectForParent
BASE_CHECK_VDM CheckVDMRequest
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
#define HIGH_PRIORITY_CLASS
#define ERROR_BAD_EXE_FORMAT
NTSYSAPI VOID NTAPI RtlReleasePrivilege(_In_ PVOID ReturnedState)
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
DWORD BaseSetLastNTError(IN NTSTATUS Status)
#define PROCESS_PRIORITY_CLASS_NORMAL
NTSTATUS WINAPI BasepReplaceProcessThreadTokens(IN HANDLE TokenHandle, IN HANDLE ProcessHandle, IN HANDLE ThreadHandle)
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
#define STATUS_NAME_TOO_LONG
#define NtCurrentProcess()
#define FILE_ATTRIBUTE_DIRECTORY
#define CSR_CREATE_API_NUMBER(ServerId, ApiId)
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
#define IMAGE_FILE_MACHINE_I386
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define CREATE_SHARED_WOW_VDM
#define STATUS_INVALID_IMAGE_PROTECT
#define STARTF_USESTDHANDLES
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
#define STATUS_INVALID_IMAGE_NOT_MZ
NTSTATUS NTAPI NtResumeThread(IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL)
#define IDLE_PRIORITY_CLASS
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
_Must_inspect_result_ _In_ ULONG Flags
#define UNICODE_STRING_MAX_CHARS
_Out_ PCLIENT_ID ClientId
#define CREATE_NEW_CONSOLE
#define PROCESS_PRIORITY_CLASS_REALTIME
#define BASESRV_SERVERDLL_INDEX
#define NT_SUCCESS(StatCode)
ULONG WINAPI BaseIsDosApplication(IN PUNICODE_STRING PathName, IN NTSTATUS Status)
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
#define STATUS_ACCESS_DENIED
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
#define BINARY_TYPE_SEPARATE_WOW
#define INVALID_FILE_ATTRIBUTES
#define PROCESS_PRIORITY_CLASS_HIGH
#define IsConsoleHandle(h)
NTSTATUS NTAPI NtReadVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OUT PSIZE_T NumberOfBytesRead OPTIONAL)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
#define PROCESSOR_ARCHITECTURE_AMD64
#define FILE_READ_ATTRIBUTES
#define ERROR_EXE_MACHINE_TYPE_MISMATCH
#define FILE_ATTRIBUTE_NORMAL
_CRTIMP wchar_t *__cdecl wcscpy(_Out_writes_z_(_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
#define FILE_SHARE_DELETE
#define FILE_NON_DIRECTORY_FILE
_In_ USHORT _In_ CCHAR StackSize
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
POBJECT_ATTRIBUTES WINAPI BaseFormatObjectAttributes(OUT POBJECT_ATTRIBUTES ObjectAttributes, IN PSECURITY_ATTRIBUTES SecurityAttributes OPTIONAL, IN PUNICODE_STRING ObjectName)
NTSTATUS NTAPI NtAssignProcessToJobObject(HANDLE JobHandle, HANDLE ProcessHandle)
DWORD WINAPI SearchPathW(IN LPCWSTR lpPath OPTIONAL, IN LPCWSTR lpFileName, IN LPCWSTR lpExtension OPTIONAL, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart OPTIONAL)
#define PROCESSOR_ARCHITECTURE_INTEL
#define STATUS_FILE_IS_OFFLINE
union _BASE_API_MESSAGE::@3487 Data
#define ERROR_FILE_OFFLINE
#define VER_SUITE_EMBEDDEDNT
NTSTATUS WINAPI BaseCheckVDM(IN ULONG BinaryType, IN PCWCH ApplicationName, IN PCWCH CommandLine, IN PCWCH CurrentDirectory, IN PANSI_STRING AnsiEnvironment, IN PBASE_API_MESSAGE ApiMessage, IN OUT PULONG iTask, IN DWORD CreationFlags, IN LPSTARTUPINFOW StartupInfo, IN HANDLE hUserToken OPTIONAL)
NTSTATUS NTAPI NtAllocateVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UBaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T URegionSize, IN ULONG AllocationType, IN ULONG Protect)
#define STATUS_OBJECT_NAME_NOT_FOUND
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
LPVOID lpSecurityDescriptor
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
VOID WINAPI StuffStdHandle(IN HANDLE ProcessHandle, IN HANDLE StandardHandle, IN PHANDLE Address)
NTSTATUS WINAPI BasepCheckWebBladeHashes(IN HANDLE FileHandle)
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
static OUT PIO_STATUS_BLOCK IoStatusBlock
_CRTIMP wchar_t *__cdecl wcscat(_Inout_updates_z_(_String_length_(_Dest)+_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
#define PROCESS_CREATE_FLAGS_BREAKAWAY
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
LPWSTR WINAPI BaseComputeProcessExePath(IN LPWSTR FullPath)
USHORT ProcessorArchitecture
NTSYSAPI NTSTATUS NTAPI RtlAcquirePrivilege(_In_ PULONG Privilege, _In_ ULONG NumPriv, _In_ ULONG Flags, _Out_ PVOID *ReturnedState)
#define BINARY_TYPE_WOW_EX
#define FILE_SYNCHRONOUS_IO_NONALERT
struct tagContext Context
#define STATUS_INVALID_IMAGE_NE_FORMAT
#define BELOW_NORMAL_PRIORITY_CLASS
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define RtlZeroMemory(Destination, Length)
NTSTATUS NTAPI NtTerminateProcess(HANDLE ProcessHandle, LONG ExitStatus)
#define InitializeObjectAttributes(p, n, a, r, s)
UNICODE_STRING RelativeName
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
#define ERROR_PATH_NOT_FOUND
#define PAGE_EXECUTE_READWRITE
#define ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER
#define ERROR_ACCESS_DISABLED_BY_POLICY
NTSTATUS NTAPI NtIsProcessInJob(IN HANDLE ProcessHandle, IN HANDLE JobHandle OPTIONAL)
#define PROCESS_PRIORITY_CLASS_IDLE
#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL
_In_ HANDLE ProcessHandle
#define DEBUG_ONLY_THIS_PROCESS
BOOLEAN WINAPI BuildSubSysCommandLine(IN LPCWSTR SubsystemName, IN LPCWSTR ApplicationName, IN LPCWSTR CommandLine, OUT PUNICODE_STRING SubsysCommandLine)
NTSTATUS NTAPI NtCreateProcessEx(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
VOID WINAPI BasepSxsCloseHandles(IN PBASE_MSG_SXS_HANDLES Handles)
#define STATUS_INVALID_IMAGE_WIN_16
#define IMAGE_FILE_MACHINE_IA64
NTSYSAPI ULONG NTAPI RtlIsDosDeviceName_U(_In_ PCWSTR Name)
NTSTATUS WINAPI BasepIsProcessAllowed(IN LPWSTR ApplicationName)
BOOLEAN WINAPI BasePushProcessParameters(IN ULONG ParameterFlags, IN HANDLE ProcessHandle, IN PPEB RemotePeb, IN LPCWSTR ApplicationPathName, IN LPWSTR lpCurrentDirectory, IN LPWSTR lpCommandLine, IN LPVOID lpEnvironment, IN LPSTARTUPINFOW StartupInfo, IN DWORD CreationFlags, IN BOOL InheritHandles, IN ULONG ImageSubsystem, IN PVOID AppCompatData, IN ULONG AppCompatDataSize)
NTSYSAPI RTL_PATH_TYPE NTAPI RtlDetermineDosPathNameType_U(_In_ PCWSTR Path)
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
NTSTATUS WINAPI BasepCheckBadapp(IN HANDLE FileHandle, IN PWCHAR ApplicationName, IN PWCHAR Environment, IN USHORT ExeType, IN PVOID *SdbQueryAppCompatData, IN PULONG SdbQueryAppCompatDataSize, IN PVOID *SxsData, IN PULONG SxsDataSize, OUT PULONG FusionFlags)
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)