2246{
2247
2248
2249
2259 ULONG ParameterFlags, PrivilegeValue, HardErrorMode, ErrorResponse;
2261 BOOLEAN InJob, SaferNeeded, UseLargePages, HavePrivilege;
2262 BOOLEAN QuerySection, SkipSaferAndAppCompat;
2272 NTSTATUS Status, AppCompatStatus, SaferStatus, IFEOStatus, ImageDbgStatus;
2282
2283
2284
2290 SIZE_T EnvironmentLength, CmdLineLength;
2295 BOOLEAN SearchRetry, QuotesNeeded, CmdLineIsAppName, HasQuotes;
2296
2297
2298
2299
2301#if _SXS_SUPPORT_ENABLED_
2309 PVOID CapturedStrings[3];
2313 PWCHAR SxsConglomeratedBuffer, StaticBuffer;
2314 ULONG ConglomeratedBufferSizeBytes, StaticBufferSize,
i;
2315#endif
2317
2318
2319
2320
2321 PWCHAR FilePart, PathBuffer, FreeBuffer;
2325
2326
2327
2328
2329 PVOID AppCompatSxsData, AppCompatData;
2330 ULONG AppCompatSxsDataSize, AppCompatDataSize;
2331
2332
2333
2334 ULONG BinarySubType, VdmBinaryType, VdmTask, VdmReserve;
2342
2343
2344 QuerySection =
FALSE;
2346 SkipSaferAndAppCompat =
FALSE;
2347 ParameterFlags = 0;
2353 SectionHandle =
NULL;
2355 ThreadHandle =
NULL;
2357
2358
2359 AppCompatData =
NULL;
2360 AppCompatDataSize = 0;
2361 AppCompatSxsData =
NULL;
2362 AppCompatSxsDataSize = 0;
2363 CaptureBuffer =
NULL;
2364#if _SXS_SUPPORT_ENABLED_
2365 SxsConglomeratedBuffer =
NULL;
2366#endif
2368
2369
2370 DebuggerCmdLine =
NULL;
2380 QuotedCmdLine =
NULL;
2381
2382
2386 VdmTask = 0;
2387 VdmUndoLevel = 0;
2388 VdmBinaryType = 0;
2389 VdmReserve = 0;
2390 VdmWaitObject =
NULL;
2391 UseVdmReserve =
FALSE;
2393
2394
2397
2398
2400#if _SXS_SUPPORT_ENABLED_
2404#endif
2406 RtlZeroMemory(&LocalProcessAttributes,
sizeof(LocalProcessAttributes));
2407 RtlZeroMemory(&LocalThreadAttributes,
sizeof(LocalThreadAttributes));
2408
2409
2410 RtlZeroMemory(lpProcessInformation,
sizeof(*lpProcessInformation));
2411 if (hNewToken) *hNewToken =
NULL;
2412
2413
2415 dwCreationFlags &= ~CREATE_NO_WINDOW;
2416
2417#if _SXS_SUPPORT_ENABLED_
2418
2419 SxsStaticBuffers[0] = &SxsWin32ManifestPath;
2420 SxsStaticBuffers[1] = &SxsWin32PolicyPath;
2421 SxsStaticBuffers[2] = &SxsWin32AssemblyDirectory;
2422 SxsStaticBuffers[3] = &SxsNtManifestPath;
2423 SxsStaticBuffers[4] = &SxsNtPolicyPath;
2424 ExePathPair.
Win32 = &SxsWin32ExePath;
2425 ExePathPair.
Nt = &SxsNtExePath;
2426 ManifestPathPair.
Win32 = &SxsWin32ManifestPath.
String;
2427 ManifestPathPair.
Nt = &SxsNtManifestPath.
String;
2428 PolicyPathPair.
Win32 = &SxsWin32PolicyPath.
String;
2429 PolicyPathPair.
Nt = &SxsNtPolicyPath.
String;
2430#endif
2431
2432 DPRINT(
"CreateProcessInternalW: '%S' '%S' %lx\n", lpApplicationName, lpCommandLine, dwCreationFlags);
2433
2434
2437
2438
2441 {
2442 DPRINT1(
"Invalid flag combo used\n");
2445 }
2446
2447
2449 {
2451 }
2453 {
2455 }
2457 {
2459 }
2461 {
2463 }
2465 {
2467 }
2469 {
2472 }
2473 else
2474 {
2476 }
2477
2478
2486
2487
2490 {
2491
2492 DPRINT1(
"Invalid WOW flags\n");
2495 }
2498 {
2499
2501 }
2502
2503
2506 {
2507
2508 dwCreationFlags = (dwCreationFlags &~ CREATE_SHARED_WOW_VDM) |
2510 }
2511
2512
2514 {
2515
2517 while ((*pcScan) || (*(pcScan + 1))) ++pcScan;
2518
2519
2520 EnvironmentLength = (pcScan +
sizeof(
ANSI_NULL) - (
PCHAR)lpEnvironment);
2522 {
2523
2526 }
2527
2528
2531
2532
2537 0,
2542 {
2543
2546 }
2547
2548
2552 {
2553
2560 }
2561
2562
2563 lpEnvironment = UnicodeEnv.
Buffer;
2564 }
2565
2566
2567 StartupInfo = *lpStartupInfo;
2568
2569
2572 {
2573
2574 StartupInfo.
dwFlags &= ~STARTF_USESTDHANDLES;
2575 }
2576
2577
2578AppNameRetry:
2579
2580 if (NameBuffer)
2581 {
2584 }
2585
2586
2587 if (FreeBuffer)
2588 {
2591 }
2592
2593
2595 {
2598 }
2599
2600
2603 QuotesNeeded =
FALSE;
2604 CmdLineIsAppName =
FALSE;
2605
2606
2607 if (!lpApplicationName)
2608 {
2609
2611
2612
2614 0,
2616 if (!NameBuffer)
2617 {
2620 goto Quickie;
2621 }
2622
2623
2624 lpApplicationName = NullBuffer = ScanString = lpCommandLine;
2625
2626
2627 if (*lpCommandLine ==
L'\"')
2628 {
2629
2630 SearchRetry =
FALSE;
2631 ScanString++;
2632 lpApplicationName = ScanString;
2633 while (*ScanString)
2634 {
2635
2636 if (*ScanString ==
L'\"')
2637 {
2638
2639 NullBuffer = ScanString;
2641 break;
2642 }
2643
2644
2645 ScanString++;
2646 NullBuffer = ScanString;
2647 }
2648 }
2649 else
2650 {
2651StartScan:
2652
2653 lpApplicationName = lpCommandLine;
2654 while (*ScanString)
2655 {
2656
2657 if ((*ScanString ==
L' ') || (*ScanString ==
L'\t'))
2658 {
2659
2660 NullBuffer = ScanString;
2661 break;
2662 }
2663
2664
2665 ScanString++;
2666 NullBuffer = ScanString;
2667 }
2668 }
2669
2670
2671 SaveChar = *NullBuffer;
2673
2674
2676 {
2679 }
2680
2681
2685 {
2688 goto Quickie;
2689 }
2690
2691
2693 lpApplicationName,
2696 NameBuffer,
2698
2699
2701 {
2702
2706 {
2707
2709 }
2710 else
2711 {
2712
2714 }
2715 }
2716
2717 DPRINT(
"Length: %lu Buffer: %S\n",
Length, NameBuffer);
2718
2719
2721 {
2722
2723 *NullBuffer = SaveChar;
2724 lpApplicationName = NameBuffer;
2725 }
2726 else
2727 {
2728
2731 {
2732
2742 {
2743
2747 }
2748 }
2749 else
2750 {
2751
2753 }
2754
2755
2757 {
2758
2760 }
2761 else
2762 {
2763
2765 }
2766
2767
2768 *NullBuffer = SaveChar;
2769 lpApplicationName = NameBuffer;
2770
2771
2772 if (!(*ScanString) || !(SearchRetry))
2773 {
2774
2776 goto Quickie;
2777 }
2778
2779
2780 ScanString++;
2781 NullBuffer = ScanString;
2782
2783
2784 QuotesNeeded =
TRUE;
2786 goto StartScan;
2787 }
2788 }
2789 else if (!(lpCommandLine) || !(*lpCommandLine))
2790 {
2791
2792 CmdLineIsAppName =
TRUE;
2793 lpCommandLine = (
LPWSTR)lpApplicationName;
2794 }
2795
2796
2798 &PathName,
2800 &SxsWin32RelativePath);
2801 if (!TranslationStatus)
2802 {
2803
2804 DPRINT1(
"Path translation for SxS failed\n");
2807 goto Quickie;
2808 }
2809
2810
2812 FreeBuffer = PathName.
Buffer;
2813
2814
2821 {
2822
2823 RtlInitEmptyUnicodeString(&PathBufferString,
NULL, 0);
2826 &PathBufferString,
2830 &SxsPathType,
2833 {
2834
2838 goto Quickie;
2839 }
2840
2841
2842 SxsWin32ExePath = PathBufferString;
2843 PathBuffer = PathBufferString.
Buffer;
2845 DPRINT(
"SxS Path: %S\n", PathBuffer);
2846 }
2847
2848
2849#if _SXS_SUPPORT_ENABLED_
2850 SxsNtExePath = PathName;
2851#endif
2853 {
2854
2856 }
2857 else
2858 {
2859
2861 }
2862
2863
2866 &PathName,
2875 &LocalObjectAttributes,
2881 {
2882
2885 &LocalObjectAttributes,
2890 }
2891
2892
2894 DPRINT1(
"Open file failed: %lx (%wZ)\n",
Status, &PathName);
2895
2896
2898
2900 {
2901
2903 {
2904
2907 goto Quickie;
2908 }
2909 else
2910 {
2911
2914 goto Quickie;
2915 }
2916 }
2917
2918
2920 {
2921
2923 }
2924
2925
2935 {
2936
2941 {
2942
2945 {
2946
2947 DPRINT1(
"Invalid Blade hashes!\n");
2950 goto Quickie;
2951 }
2952
2953
2955 {
2956
2957 DPRINT1(
"Tampered Blade hashes!\n");
2960 goto Quickie;
2961 }
2962 }
2963
2964
2967 {
2968
2971 if (SectionHandle)
2972 {
2974 SectionHandle =
NULL;
2975 }
2977 goto Quickie;
2978 }
2979
2980
2983 {
2984
2987
2988
2990 UseVdmReserve =
TRUE;
2991
2992
2994 SectionHandle =
NULL;
2995
2996
2997 QuerySection =
FALSE;
2998 }
2999 }
3000
3001
3002 if (!SkipSaferAndAppCompat)
3003 {
3004
3008 {
3009
3010 ImageMachine = 0;
3011
3012
3014 AppCompatData =
NULL;
3015 AppCompatSxsData =
NULL;
3016
3017
3018 if (SectionHandle)
3019 {
3020
3021 if (QuerySection)
3022 {
3023
3025 }
3026 else
3027 {
3028
3031 &ImageInformation,
3032 sizeof(ImageInformation),
3034 }
3035
3036
3038 {
3039
3040 QuerySection =
TRUE;
3041 ImageMachine = ImageInformation.
Machine;
3042 }
3043 }
3044
3045
3047 FreeBuffer,
3048 lpEnvironment,
3049 ImageMachine,
3050 &AppCompatData,
3051 &AppCompatDataSize,
3052 &AppCompatSxsData,
3053 &AppCompatSxsDataSize,
3056 {
3057
3058 DPRINT1(
"App compat launch failure: %lx\n", AppCompatStatus);
3060 {
3061
3063 }
3064 else
3065 {
3066
3068 }
3069
3070
3071 if (SectionHandle)
3072 {
3073
3075 SectionHandle =
NULL;
3076 }
3077
3078
3080 goto Quickie;
3081 }
3082 }
3083 }
3084
3085
3086
3087
3088 if (!(SkipSaferAndAppCompat) &&
3090 {
3091
3094 {
3099
3100 break;
3101
3103
3105
3106 default:
3107
3109 {
3110 SaferNeeded =
FALSE;
3111 }
3112
3113
3114 break;
3115 }
3116
3117
3118 if (SaferNeeded)
3119 {
3120
3122 (
LPWSTR)lpApplicationName,
3124 &InJob,
3126 &JobHandle);
3127 if (SaferStatus == 0xFFFFFFFF)
3128 {
3129
3130 DPRINT1(
"WinSafer blocking process launch\n");
3133 goto Quickie;
3134 }
3135
3136
3138 {
3139 DPRINT1(
"Error checking WinSafer: %lx\n", SaferStatus);
3142 goto Quickie;
3143 }
3144 }
3145 }
3146
3147
3149 {
3151 {
3152
3154 {
3155
3157
3158
3160 &VdmAnsiEnv,
3161 &VdmUnicodeEnv);
3163 {
3164 DPRINT1(
"VDM environment for WOW app failed\n");
3165 goto Quickie;
3166 }
3167
3168
3170 {
3171
3172 VdmBinaryType = (dwCreationFlags &
3175
3176
3178 lpApplicationName,
3179 lpCommandLine,
3180 lpCurrentDirectory,
3181 &VdmAnsiEnv,
3182 &CsrMsg[1],
3183 &VdmTask,
3184 dwCreationFlags,
3185 &StartupInfo,
3187
3188
3190
3191
3196 {
3197
3200 goto Quickie;
3201 }
3202
3203
3205 }
3206
3207
3211 {
3213
3215
3216
3217 if (UseVdmReserve) VdmReserve = 1;
3218
3219
3221 VdmTask,
3222 VdmBinaryType,
3223 &VdmString,
3224 &VdmReserve);
3226 {
3227 DPRINT1(
"VDM Configuration failed for WOW\n");
3229 goto Quickie;
3230 }
3231
3232
3233 lpCommandLine = VdmString.
Buffer;
3234 lpApplicationName =
NULL;
3235
3236
3239
3240
3242 break;
3243
3244
3246
3248
3249
3251 break;
3252
3254
3255 DPRINT1(
"VDM is not ready for WOW\n");
3258 goto Quickie;
3259
3260 default:
3261 break;
3262 }
3263
3264
3265 VdmReserve--;
3266
3267
3268 if (VdmWaitObject) goto VdmShortCircuit;
3269
3270
3271 bInheritHandles =
FALSE;
3272
3273
3274 if ((lpEnvironment) &&
3276 {
3278 }
3279
3280
3281 SkipSaferAndAppCompat =
TRUE;
3282 goto AppNameRetry;
3283 }
3284
3285
3286 }
3287
3291 {
3292
3294
3295
3299 {
3300
3302
3303
3305 &VdmAnsiEnv,
3306 &VdmUnicodeEnv);
3308 {
3309 DPRINT1(
"VDM environment for DOS failed\n");
3310 goto Quickie;
3311 }
3312
3313
3315 lpApplicationName,
3316 lpCommandLine,
3317 lpCurrentDirectory,
3318 &VdmAnsiEnv,
3319 &CsrMsg[1],
3320 &VdmTask,
3321 dwCreationFlags,
3322 &StartupInfo,
3325 {
3326
3330 goto Quickie;
3331 };
3332
3333
3337 {
3339
3341
3342
3344 {
3345 DPRINT1(
"Detached process but no VDM, not allowed\n");
3348 }
3349
3350
3352 VdmTask,
3353 VdmBinaryType,
3354 &VdmString,
3355 &VdmReserve);
3357 {
3358 DPRINT1(
"VDM Configuration failed for DOS\n");
3360 goto Quickie;
3361 }
3362
3363
3364 lpCommandLine = VdmString.
Buffer;
3365 lpApplicationName =
NULL;
3366 break;
3367
3369
3371
3372
3374 break;
3375
3377
3378 DPRINT1(
"VDM is not ready for DOS\n");
3381 goto Quickie;
3382
3383 default:
3384 break;
3385 }
3386
3387
3388 VdmReserve--;
3389
3390
3391 if (VdmWaitObject) goto VdmShortCircuit;
3392
3393
3394 bInheritHandles =
FALSE;
3395
3396
3397 if ((lpEnvironment) &&
3399 {
3401 }
3402
3403
3404 lpEnvironment = VdmUnicodeEnv.
Buffer;
3405 }
3406 else
3407 {
3408
3410
3411
3415 {
3416 DPRINT1(
"'%wZ': Invalid EXE, and not a batch or script file\n", &PathName);
3419 goto Quickie;
3420 }
3421
3422
3423 CmdQuoteLength = CmdLineIsAppName || HasQuotes;
3424 if (!CmdLineIsAppName)
3425 {
3426 if (HasQuotes) CmdQuoteLength++;
3427 }
3428 else
3429 {
3430 CmdQuoteLength++;
3431 }
3432
3433
3434 CmdLineLength =
wcslen(lpCommandLine);
3436 CmdLineLength += CmdQuoteLength +
sizeof(
ANSI_NULL);
3437 CmdLineLength *=
sizeof(
WCHAR);
3438
3439
3441 0,
3442 CmdLineLength);
3443 if (!AnsiCmdCommand)
3444 {
3447 goto Quickie;
3448 }
3449
3450
3452 if ((CmdLineIsAppName) || (HasQuotes))
3453 {
3454 wcscat(AnsiCmdCommand,
L"\"");
3455 }
3456 wcscat(AnsiCmdCommand, lpCommandLine);
3457 if ((CmdLineIsAppName) || (HasQuotes))
3458 {
3459 wcscat(AnsiCmdCommand,
L"\"");
3460 }
3461
3462
3464
3465
3466 lpCommandLine = DebuggerString.
Buffer;
3467 lpApplicationName =
NULL;
3468 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3469 }
3470
3471
3472 SkipSaferAndAppCompat =
TRUE;
3473 goto AppNameRetry;
3474 }
3475
3477 {
3478
3479 DPRINT1(
"64-bit binary, failing\n");
3482 goto Quickie;
3483 }
3484
3486 {
3487
3488 DPRINT1(
"File is offline, failing\n");
3490 break;
3491 }
3492
3493 default:
3494 {
3495
3497 {
3501 goto Quickie;
3502 }
3503
3504
3506 break;
3507 }
3508 }
3509
3510
3512 {
3513
3514 dwCreationFlags &= ~CREATE_SEPARATE_WOW_VDM;
3515 }
3516
3517
3518 if (!QuerySection)
3519 {
3520
3523 &ImageInformation,
3524 sizeof(ImageInformation),
3527 {
3528
3529 DPRINT1(
"Section query failed\n");
3532 goto Quickie;
3533 }
3534
3535
3536 QuerySection =
TRUE;
3537 }
3538
3539
3541 {
3542
3543 DPRINT1(
"Trying to launch a DLL, failing\n");
3546 goto Quickie;
3547 }
3548
3549
3550 Flags &= ~PROCESS_CREATE_FLAGS_LARGE_PAGES;
3551
3552
3553 ParameterFlags &= ~2;
3554
3555
3558 {
3559
3562 {
3563
3565 }
3566 else
3567 {
3568
3569 if (!DebuggerCmdLine)
3570 {
3571
3573 0,
3575 if (!DebuggerCmdLine)
3576 {
3577
3580
3581
3584 goto Quickie;
3585 }
3586 }
3587
3588
3592 DebuggerCmdLine,
3594 &ResultSize);
3596 (ResultSize <
sizeof(
WCHAR)) ||
3598 {
3599
3600 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3601 DebuggerCmdLine =
NULL;
3602 }
3603
3604
3608 &UseLargePages,
3609 sizeof(UseLargePages),
3611 if ((
NT_SUCCESS(IFEOStatus)) && (UseLargePages))
3612 {
3613
3615 }
3616
3617
3620 }
3621 }
3622
3623
3626 {
3627
3629 ErrorParameters[0] = (
ULONG_PTR)&PathName;
3631 1,
3632 1,
3633 ErrorParameters,
3635 &ErrorResponse);
3637 {
3638
3640 }
3641 else
3642 {
3643
3645 }
3646
3647
3648 DPRINT1(
"Invalid image architecture: %lx\n", ImageInformation.
Machine);
3650 goto Quickie;
3651 }
3652
3653
3656 {
3657
3659 SectionHandle =
NULL;
3660 QuerySection =
FALSE;
3661
3662
3664 {
3665
3668 goto Quickie;
3669 }
3670
3671
3673 lpApplicationName,
3674 lpCommandLine,
3675 &DebuggerString);
3677 {
3678
3679 DPRINT1(
"Subsystem command line failed\n");
3680 goto Quickie;
3681 }
3682
3683
3684 lpCommandLine = DebuggerString.
Buffer;
3685 lpApplicationName =
NULL;
3686
3687
3688 SkipSaferAndAppCompat =
TRUE;
3689 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3690 goto AppNameRetry;
3691 }
3692
3693
3697 {
3698
3699 DPRINT1(
"Invalid subsystem version: %hu.%hu\n",
3703 goto Quickie;
3704 }
3705
3706
3707 if (DebuggerCmdLine)
3708 {
3709
3712 {
3713
3714 lpCommandLine = (
LPWSTR)lpApplicationName;
3716 }
3717
3718
3720 {
3723 goto Quickie;
3724 }
3725
3726
3728
3729
3731 {
3734 goto Quickie;
3735 }
3736
3737
3739
3740
3743 {
3746 goto Quickie;
3747 }
3748
3749
3751 if (!DebuggerString.
Buffer)
3752 {
3755 goto Quickie;
3756 }
3757
3758
3759 RtlInitEmptyUnicodeString(&DebuggerString,
3762
3763
3765 DebuggerCmdLine);
3771
3772
3773 DbgPrint(
"BASE: Calling debugger with '%wZ'\n", &DebuggerString);
3774
3775
3776 lpCommandLine = DebuggerString.
Buffer;
3777 lpApplicationName =
NULL;
3778
3779
3781 SectionHandle =
NULL;
3782 QuerySection =
FALSE;
3783
3784
3789 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3790 DebuggerCmdLine =
NULL;
3791 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3792 goto AppNameRetry;
3793 }
3794
3795
3797 lpProcessAttributes,
3800 {
3801
3802
3803 LocalProcessAttributes = *lpProcessAttributes;
3806 &LocalProcessAttributes,
3808 }
3809
3810
3812 {
3813
3815 }
3816
3817
3819 {
3820
3823 {
3824 DPRINT1(
"Failed to connect to DbgUI!\n");
3827 goto Quickie;
3828 }
3829
3830
3832
3833
3835 {
3836
3838 }
3839 }
3840
3841
3843
3844
3845 HavePrivilege =
FALSE;
3846 PrivilegeState =
NULL;
3848 {
3849
3853 {
3854
3855 HavePrivilege =
TRUE;
3856 }
3857 }
3858
3859
3861
3862
3868 SectionHandle,
3869 DebugHandle,
3871 InJob);
3872
3873
3875
3876
3878
3879
3881
3882
3884 {
3885
3889 goto Quickie;
3890 }
3891
3892
3894 {
3895
3896 RealTimePrivilegeState =
NULL;
3897
3898
3900 {
3901
3903 }
3904
3905
3908 &PriorityClass,
3911
3912
3914 {
3915
3919 goto Quickie;
3920 }
3921 }
3922
3923
3925 {
3926
3930 &HardErrorMode,
3932 }
3933
3934
3935 if (VdmBinaryType)
3936 {
3937
3940 &VdmWaitObject,
3941 VdmTask,
3942 VdmBinaryType);
3943
3945 {
3946
3947 DPRINT1(
"Failed to update VDM with wait object\n");
3948 VdmWaitObject =
NULL;
3949 goto Quickie;
3950 }
3951
3952
3954 }
3955
3956
3957 if (VdmReserve)
3958 {
3959
3963 0,
3968 {
3969
3973 goto Quickie;
3974 }
3975
3977 }
3978
3979
3980 if (!QuerySection)
3981 {
3982
3985 &ImageInformation,
3986 sizeof(ImageInformation),
3989 {
3990
3994 goto Quickie;
3995 }
3996
3997
3998 QuerySection =
TRUE;
3999 }
4000
4001
4003 {
4004
4005 DPRINT(
"Image should receive SxS Fusion Isolation\n");
4006 }
4007
4008
4010
4011
4012 if (lpCurrentDirectory)
4013 {
4014
4015 DPRINT(
"Current directory: %S\n", lpCurrentDirectory);
4017 0,
4021 {
4022
4025 goto Quickie;
4026 }
4027
4028
4032 &FilePart);
4034 {
4035
4038 goto Quickie;
4039 }
4040
4041
4045 {
4046
4047 DPRINT1(
"Current directory is invalid\n");
4050 goto Quickie;
4051 }
4052 }
4053
4054
4055 if ((QuotesNeeded) || (CmdLineIsAppName))
4056 {
4057
4059 0,
4062 if (QuotedCmdLine)
4063 {
4064
4066
4067
4068 if (QuotesNeeded)
4069 {
4070 SaveChar = *NullBuffer;
4072 }
4073
4074
4075 wcscat(QuotedCmdLine, lpCommandLine);
4077
4078
4079 if (QuotesNeeded)
4080 {
4081 *NullBuffer = SaveChar;
4082 wcscat(QuotedCmdLine, NullBuffer);
4083 }
4084 }
4085 else
4086 {
4087
4088 if (QuotesNeeded) QuotesNeeded =
FALSE;
4089 if (CmdLineIsAppName) CmdLineIsAppName =
FALSE;
4090 }
4091 }
4092
4093
4094 if (CreateProcessMsg->
Sxs.
Flags & 1) ParameterFlags |= 1;
4095
4096
4097 if ((QuotesNeeded) || (CmdLineIsAppName)) lpCommandLine = QuotedCmdLine;
4098
4099
4102 RemotePeb,
4103 lpApplicationName,
4105 lpCommandLine,
4106 lpEnvironment,
4107 &StartupInfo,
4108 dwCreationFlags | NoWindow,
4109 bInheritHandles,
4111 AppCompatData,
4112 AppCompatDataSize);
4114 {
4115
4116 DPRINT1(
"BasePushProcessParameters failed\n");
4117 goto Quickie;
4118 }
4119
4120
4123
4124
4125 if (!(VdmBinaryType) &&
4126 !(bInheritHandles) &&
4132 {
4133
4136 &ProcessParameters,
4140 {
4141
4143 {
4147 }
4148
4149
4151 {
4155 }
4156
4157
4159 {
4163 }
4164 }
4165 }
4166
4167
4172 &InitialTeb);
4174 {
4178 goto Quickie;
4179 }
4180
4181
4186 0);
4187
4188
4190 lpThreadAttributes,
4193 {
4194
4195 LocalThreadAttributes = *lpThreadAttributes;
4198 &LocalThreadAttributes,
4200 }
4201
4202
4209 &InitialTeb,
4212 {
4213
4217 goto Quickie;
4218 }
4219
4220
4224
4225
4227#ifdef _WIN64
4228 DPRINT(
"TODO: WOW64 is not supported yet\n");
4230#else
4232#endif
4234
4235
4236 switch (ImageInformation.
Machine)
4237 {
4238
4241 break;
4244 break;
4247 break;
4248
4249
4250 default:
4251 DbgPrint(
"kernel32: No mapping for ImageInformation.Machine == %04x\n",
4254 break;
4255 }
4256
4257
4260
4261
4263 (IsWowApp))
4264 {
4265
4266
4267
4268
4269
4271
4272
4274 if ((NtHeaders) &&
4276 {
4277
4279 }
4280 }
4281
4282
4284 {
4286 }
4287
4288
4290 {
4292 }
4293
4294
4296
4297
4298 if (VdmBinaryType)
4299 {
4300
4302 CreateProcessMsg->
VdmTask = VdmTask;
4303 }
4304 else if (VdmReserve)
4305 {
4306
4308 }
4309
4310
4312 {
4313
4314 DPRINT1(
"This is an SxS Message -- should not happen yet\n");
4318 goto Quickie;
4319 }
4320
4321
4323 CaptureBuffer,
4326 sizeof(*CreateProcessMsg));
4327
4328
4329 if (CaptureBuffer)
4330 {
4332 CaptureBuffer =
NULL;
4333 }
4334
4335
4337 {
4338
4339 DPRINT1(
"Failed to tell csrss about new process\n");
4343 goto Quickie;
4344 }
4345
4346
4348 {
4349
4352 ThreadHandle);
4354 {
4355
4360 goto Quickie;
4361 }
4362 }
4363
4364
4365 if (JobHandle)
4366 {
4367
4370 {
4371
4376 goto Quickie;
4377 }
4378 }
4379
4380
4382 {
4384 }
4385
4386VdmShortCircuit:
4387
4389
4390
4392
4393
4394 if (VdmWaitObject)
4395 {
4396
4398 {
4399
4401 lpProcessInformation->hProcess = VdmWaitObject;
4402
4403
4405 {
4406
4409 }
4410 }
4411 else
4412 {
4413
4415
4416
4417 lpProcessInformation->hProcess = VdmWaitObject;
4418 }
4419
4420
4422 }
4423 else
4424 {
4425
4427 }
4428
4429
4430 lpProcessInformation->hThread = ThreadHandle;
4433
4434
4436 ThreadHandle =
NULL;
4437
4438Quickie:
4439
4440 if (DebuggerCmdLine)
RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
4441
4442
4443 if (PathBuffer)
4444 {
4445
4446 RtlInitEmptyUnicodeString(&SxsWin32ExePath,
NULL, 0);
4447 SxsWin32ExePath.
Length = 0;
4448
4449
4451 }
4452
4453#if _SXS_SUPPORT_ENABLED_
4454
4455 if (!VdmBinaryType)
4456 {
4457
4460
4461
4462 if (SxsConglomeratedBuffer)
4463 {
4464
4465 for (
i = 0;
i < 5;
i++)
4466 {
4467
4468 ThisBuffer = SxsStaticBuffers[
i];
4469 if (ThisBuffer)
4470 {
4471
4473 if ((ThisBuffer != (
PVOID)-8) && (ByteBuffer->
Buffer))
4474 {
4475
4477 {
4478
4481 }
4482
4483
4486 }
4487
4488
4489 RtlInitEmptyUnicodeString(&ThisBuffer->
String,
4493 {
4494
4496 }
4497 }
4498 }
4499 }
4500 }
4501#endif
4502
4504 {
4505
4507
4508
4510 lpEnvironment =
NULL;
4511 }
4512
4513
4514 RtlFreeHeap(RtlGetProcessHeap(), 0, QuotedCmdLine);
4518
4519
4521 if (SectionHandle)
NtClose(SectionHandle);
4522
4523
4524 if (ThreadHandle)
4525 {
4526
4529 }
4530
4531
4533
4534
4535 if (JobHandle)
NtClose(JobHandle);
4536
4537
4539 {
4540
4542 {
4543
4545 }
4546 else
4547 {
4548
4550 }
4551 }
4552
4553
4555
4556
4559
4560
4562 {
4563
4565 }
4566
4567
4569 {
4570
4573 VdmUndoLevel,
4574 VdmBinaryType);
4575
4576
4577 if (VdmWaitObject)
NtClose(VdmWaitObject);
4578 }
4579
4580
4582
4583
4585}
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN OUT PATH_TYPE_AND_UNKNOWN * PathType
NTSTATUS WINAPI BasepCheckBadapp(IN HANDLE FileHandle, IN PWCHAR ApplicationName, IN PWCHAR Environment, IN USHORT ExeType, IN PVOID *SdbQueryAppCompatData, IN PULONG SdbQueryAppCompatDataSize, IN PVOID *SxsData, IN PULONG SxsDataSize, OUT PULONG FusionFlags)
VOID WINAPI BasepFreeAppCompatData(IN PVOID AppCompatData, IN PVOID AppCompatSxsData)
#define FILE_NON_DIRECTORY_FILE
#define BASESRV_SERVERDLL_INDEX
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define CSR_CREATE_API_NUMBER(ServerId, ApiId)
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
#define ERROR_INVALID_PARAMETER
#define INVALID_HANDLE_VALUE
#define FILE_ATTRIBUTE_NORMAL
#define ERROR_ACCESS_DENIED
PBASE_STATIC_SERVER_DATA BaseStaticServerData
DWORD WINAPI GetFileAttributesW(LPCWSTR lpFileName)
LPWSTR WINAPI BaseComputeProcessExePath(IN LPWSTR FullPath)
DWORD WINAPI SearchPathW(IN LPCWSTR lpPath OPTIONAL, IN LPCWSTR lpFileName, IN LPCWSTR lpExtension OPTIONAL, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart OPTIONAL)
BOOLEAN WINAPI BasePushProcessParameters(IN ULONG ParameterFlags, IN HANDLE ProcessHandle, IN PPEB RemotePeb, IN LPCWSTR ApplicationPathName, IN LPWSTR lpCurrentDirectory, IN LPWSTR lpCommandLine, IN LPVOID lpEnvironment, IN LPSTARTUPINFOW StartupInfo, IN DWORD CreationFlags, IN BOOL InheritHandles, IN ULONG ImageSubsystem, IN PVOID AppCompatData, IN ULONG AppCompatDataSize)
NTSTATUS WINAPI BasepCheckWebBladeHashes(IN HANDLE FileHandle)
VOID WINAPI StuffStdHandle(IN HANDLE ProcessHandle, IN HANDLE StandardHandle, IN PHANDLE Address)
BOOLEAN WINAPI BuildSubSysCommandLine(IN LPCWSTR SubsystemName, IN LPCWSTR ApplicationName, IN LPCWSTR CommandLine, OUT PUNICODE_STRING SubsysCommandLine)
NTSTATUS WINAPI BasepIsProcessAllowed(IN LPWSTR ApplicationName)
#define AddToHandle(x, y)
NTSTATUS WINAPI BasepReplaceProcessThreadTokens(IN HANDLE TokenHandle, IN HANDLE ProcessHandle, IN HANDLE ThreadHandle)
VOID WINAPI BasepSxsCloseHandles(IN PBASE_MSG_SXS_HANDLES Handles)
#define RemoveFromHandle(x, y)
BOOLEAN WINAPI BasepIsImageVersionOk(IN ULONG ImageMajorVersion, IN ULONG ImageMinorVersion)
NTSTATUS WINAPI BaseCreateStack(_In_ HANDLE hProcess, _In_opt_ SIZE_T StackCommit, _In_opt_ SIZE_T StackReserve, _Out_ PINITIAL_TEB InitialTeb)
VOID WINAPI BaseInitializeContext(IN PCONTEXT Context, IN PVOID Parameter, IN PVOID StartAddress, IN PVOID StackAddress, IN ULONG ContextType)
POBJECT_ATTRIBUTES WINAPI BaseFormatObjectAttributes(OUT POBJECT_ATTRIBUTES ObjectAttributes, IN PSECURITY_ATTRIBUTES SecurityAttributes OPTIONAL, IN PUNICODE_STRING ObjectName)
NTSTATUS WINAPI BasepCheckWinSaferRestrictions(IN HANDLE UserToken, IN LPWSTR ApplicationName, IN HANDLE FileHandle, OUT PBOOLEAN InJob, OUT PHANDLE NewToken, OUT PHANDLE JobHandle)
PVOID WINAPI BasepIsRealtimeAllowed(IN BOOLEAN Keep)
ULONG WINAPI BaseIsDosApplication(IN PUNICODE_STRING PathName, IN NTSTATUS Status)
BOOL NTAPI BaseDestroyVDMEnvironment(IN PANSI_STRING AnsiEnv, IN PUNICODE_STRING UnicodeEnv)
BOOL WINAPI BaseGetVdmConfigInfo(IN LPCWSTR CommandLineReserved, IN ULONG DosSeqId, IN ULONG BinaryType, IN PUNICODE_STRING CmdLineString, OUT PULONG VdmSize)
BOOL WINAPI BaseUpdateVDMEntry(IN ULONG UpdateIndex, IN OUT PHANDLE WaitHandle, IN ULONG IndexInfo, IN ULONG BinaryType)
BOOL NTAPI BaseCreateVDMEnvironment(IN PWCHAR lpEnvironment, OUT PANSI_STRING AnsiEnv, OUT PUNICODE_STRING UnicodeEnv)
NTSTATUS WINAPI BaseCheckVDM(IN ULONG BinaryType, IN PCWCH ApplicationName, IN PCWCH CommandLine, IN PCWCH CurrentDirectory, IN PANSI_STRING AnsiEnvironment, IN PBASE_API_MESSAGE ApiMessage, IN OUT PULONG iTask, IN DWORD CreationFlags, IN LPSTARTUPINFOW StartupInfo, IN HANDLE hUserToken OPTIONAL)
#define FILE_SYNCHRONOUS_IO_NONALERT
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define PROCESS_CREATE_FLAGS_BREAKAWAY
#define PROCESS_PRIORITY_CLASS_IDLE
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
#define PROCESS_PRIORITY_CLASS_INVALID
#define PROCESS_PRIORITY_CLASS_NORMAL
#define PROCESS_PRIORITY_CLASS_HIGH
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
#define PROCESS_PRIORITY_CLASS_REALTIME
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
@ ProcessDefaultHardErrorMode
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(IN PUNICODE_STRING SubKey, IN BOOLEAN Wow64, OUT PHANDLE NewKeyHandle)
PVOID PVOID PWCHAR PVOID USHORT PULONG PVOID PULONG PVOID PULONG PULONG FusionFlags
#define SE_LOCK_MEMORY_PRIVILEGE
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
_In_ NDIS_ERROR_CODE ErrorCode
#define PROCESSOR_ARCHITECTURE_IA64
#define PROCESSOR_ARCHITECTURE_UNKNOWN
#define PROCESSOR_ARCHITECTURE_AMD64
#define PROCESSOR_ARCHITECTURE_INTEL
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
@ SectionImageInformation
NTSYSAPI ULONG NTAPI RtlIsDosDeviceName_U(_In_ PCWSTR Name)
NTSYSAPI NTSTATUS NTAPI RtlAcquirePrivilege(_In_ PULONG Privilege, _In_ ULONG NumPriv, _In_ ULONG Flags, _Out_ PVOID *ReturnedState)
NTSTATUS NTAPI RtlGetFullPathName_UstrEx(_In_ PUNICODE_STRING FileName, _In_opt_ PUNICODE_STRING StaticString, _In_opt_ PUNICODE_STRING DynamicString, _Out_opt_ PUNICODE_STRING *StringUsed, _Out_opt_ PSIZE_T FilePartSize, _Out_opt_ PBOOLEAN NameInvalid, _Out_ RTL_PATH_TYPE *PathType, _Out_opt_ PSIZE_T LengthNeeded)
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName)
NTSYSAPI VOID NTAPI RtlDestroyEnvironment(_In_ PWSTR Environment)
NTSYSAPI RTL_PATH_TYPE NTAPI RtlDetermineDosPathNameType_U(_In_ PCWSTR Path)
NTSYSAPI VOID NTAPI RtlReleasePrivilege(_In_ PVOID ReturnedState)
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToRelativeNtPathName_U(_In_ PCWSTR DosName, _Out_ PUNICODE_STRING NtName, _Out_ PCWSTR *PartName, _Out_ PRTL_RELATIVE_NAME_U RelativeName)
#define SEM_FAILCRITICALERRORS
@ RtlPathTypeRootLocalDevice
@ RtlPathTypeDriveAbsolute
enum _RTL_PATH_TYPE RTL_PATH_TYPE
#define THREAD_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
#define SECTION_ALL_ACCESS
#define FILE_READ_ATTRIBUTES
#define PROCESS_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI NtTerminateProcess(HANDLE ProcessHandle, LONG ExitStatus)
#define FILE_SHARE_DELETE
#define FILE_ATTRIBUTE_DIRECTORY
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
#define PAGE_EXECUTE_READWRITE
#define UNICODE_STRING_MAX_CHARS
#define UNICODE_STRING_MAX_BYTES
#define VER_SUITE_DATACENTER
#define VER_SUITE_PERSONAL
#define IMAGE_SUBSYSTEM_POSIX_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
#define IMAGE_FILE_MACHINE_AMD64
#define IMAGE_FILE_MACHINE_IA64
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)
NTSTATUS NTAPI NtReadVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OUT PSIZE_T NumberOfBytesRead OPTIONAL)
NTSTATUS NTAPI NtIsProcessInJob(IN HANDLE ProcessHandle, IN HANDLE JobHandle OPTIONAL)
NTSTATUS NTAPI NtAssignProcessToJobObject(HANDLE JobHandle, HANDLE ProcessHandle)
NTSTATUS NTAPI NtCreateProcessEx(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI NtResumeThread(IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL)
#define STATUS_INVALID_IMAGE_WIN_64
#define STATUS_INVALID_IMAGE_WIN_16
#define STATUS_INVALID_IMAGE_NE_FORMAT
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
#define STATUS_INVALID_IMAGE_NOT_MZ
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_VDM_DISALLOWED
#define STATUS_FILE_IS_OFFLINE
#define STATUS_NAME_TOO_LONG
#define IMAGE_FILE_MACHINE_I386
_CRTIMP wchar_t *__cdecl wcscpy(_Out_writes_z_(_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_CRTIMP wchar_t *__cdecl wcscat(_Inout_updates_z_(_String_length_(_Dest)+_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_Check_return_ _CRTIMP int __cdecl _wcsnicmp(_In_reads_or_z_(_MaxCount) const wchar_t *_Str1, _In_reads_or_z_(_MaxCount) const wchar_t *_Str2, _In_ size_t _MaxCount)
VOID NTAPI CsrFreeCaptureBuffer(_In_ _Frees_ptr_ PCSR_CAPTURE_BUFFER CaptureBuffer)
NTSTATUS NTAPI CsrClientCallServer(_Inout_ PCSR_API_MESSAGE ApiMessage, _Inout_opt_ PCSR_CAPTURE_BUFFER CaptureBuffer, _In_ CSR_API_NUMBER ApiNumber, _In_ ULONG DataLength)
#define VDM_UNDO_COMPLETED
#define BINARY_TYPE_WOW_EX
#define BINARY_TYPE_SEPARATE_WOW
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
BASE_CREATE_PROCESS CreateProcessRequest
union _BASE_API_MESSAGE::@3503 Data
BASE_CHECK_VDM CheckVDMRequest
HANDLE WaitObjectForParent
BASE_SXS_CREATEPROCESS_MSG Sxs
USHORT ProcessorArchitecture
BOOLEAN DefaultSeparateVDM
PVOID ArbitraryUserPointer
ULONG ImageSubsystemMajorVersion
UNICODE_STRING RelativeName
HANDLE ContainingDirectory
UNICODE_STRING DesktopInfo
LPVOID lpSecurityDescriptor
#define RtlZeroMemory(Destination, Length)
#define STATUS_ACCESS_DENIED
#define INVALID_FILE_ATTRIBUTES
#define NORMAL_PRIORITY_CLASS
#define STARTF_FORCEOFFFEEDBACK
DWORD WINAPI GetLastError(void)
#define REALTIME_PRIORITY_CLASS
#define BELOW_NORMAL_PRIORITY_CLASS
#define CREATE_UNICODE_ENVIRONMENT
#define HIGH_PRIORITY_CLASS
#define CREATE_SHARED_WOW_VDM
#define CREATE_DEFAULT_ERROR_MODE
#define CREATE_SEPARATE_WOW_VDM
#define DEBUG_ONLY_THIS_PROCESS
#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL
#define IDLE_PRIORITY_CLASS
#define STARTF_FORCEONFEEDBACK
#define ABOVE_NORMAL_PRIORITY_CLASS
#define ERROR_PATH_NOT_FOUND
#define ERROR_BAD_EXE_FORMAT
#define ERROR_CHILD_NOT_COMPLETE
#define ERROR_ACCESS_DISABLED_BY_POLICY
#define ERROR_EXE_MACHINE_TYPE_MISMATCH
#define ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER
#define ERROR_ACCESS_DISABLED_WEBBLADE
#define ERROR_FILE_OFFLINE
_Must_inspect_result_ _In_ ULONG Flags
_Out_ PCLIENT_ID ClientId