2246{
2247
2248
2249
2259 ULONG ParameterFlags, PrivilegeValue, HardErrorMode, ErrorResponse;
2261 BOOLEAN InJob, SaferNeeded, UseLargePages, HavePrivilege;
2262 BOOLEAN QuerySection, SkipSaferAndAppCompat;
2272 NTSTATUS Status, AppCompatStatus, SaferStatus, IFEOStatus, ImageDbgStatus;
2282
2283
2284
2290 SIZE_T EnvironmentLength, CmdLineLength;
2295 BOOLEAN SearchRetry, QuotesNeeded, CmdLineIsAppName, HasQuotes;
2296
2297
2298
2299
2301#if _SXS_SUPPORT_ENABLED_
2309 PVOID CapturedStrings[3];
2313 PWCHAR SxsConglomeratedBuffer, StaticBuffer;
2314 ULONG ConglomeratedBufferSizeBytes, StaticBufferSize,
i;
2315#endif
2317
2318
2319
2320
2321 PWCHAR FilePart, PathBuffer, FreeBuffer;
2325
2326
2327
2328
2329 PVOID AppCompatSxsData, AppCompatData;
2330 ULONG AppCompatSxsDataSize, AppCompatDataSize;
2331
2332
2333
2334 ULONG BinarySubType, VdmBinaryType, VdmTask, VdmReserve;
2342
2343
2344 QuerySection =
FALSE;
2346 SkipSaferAndAppCompat =
FALSE;
2347 ParameterFlags = 0;
2353 SectionHandle =
NULL;
2355 ThreadHandle =
NULL;
2358
2359
2360 AppCompatData =
NULL;
2361 AppCompatDataSize = 0;
2362 AppCompatSxsData =
NULL;
2363 AppCompatSxsDataSize = 0;
2364 CaptureBuffer =
NULL;
2365#if _SXS_SUPPORT_ENABLED_
2366 SxsConglomeratedBuffer =
NULL;
2367#endif
2369
2370
2371 DebuggerCmdLine =
NULL;
2381 QuotedCmdLine =
NULL;
2382
2383
2387 VdmTask = 0;
2388 VdmUndoLevel = 0;
2389 VdmBinaryType = 0;
2390 VdmReserve = 0;
2391 VdmWaitObject =
NULL;
2392 UseVdmReserve =
FALSE;
2394
2395
2398
2399
2401#if _SXS_SUPPORT_ENABLED_
2405#endif
2407 RtlZeroMemory(&LocalProcessAttributes,
sizeof(LocalProcessAttributes));
2408 RtlZeroMemory(&LocalThreadAttributes,
sizeof(LocalThreadAttributes));
2409
2410
2411 RtlZeroMemory(lpProcessInformation,
sizeof(*lpProcessInformation));
2412 if (hNewToken) *hNewToken =
NULL;
2413
2414
2416 dwCreationFlags &= ~CREATE_NO_WINDOW;
2417
2418#if _SXS_SUPPORT_ENABLED_
2419
2420 SxsStaticBuffers[0] = &SxsWin32ManifestPath;
2421 SxsStaticBuffers[1] = &SxsWin32PolicyPath;
2422 SxsStaticBuffers[2] = &SxsWin32AssemblyDirectory;
2423 SxsStaticBuffers[3] = &SxsNtManifestPath;
2424 SxsStaticBuffers[4] = &SxsNtPolicyPath;
2425 ExePathPair.
Win32 = &SxsWin32ExePath;
2426 ExePathPair.
Nt = &SxsNtExePath;
2427 ManifestPathPair.
Win32 = &SxsWin32ManifestPath.
String;
2428 ManifestPathPair.
Nt = &SxsNtManifestPath.
String;
2429 PolicyPathPair.
Win32 = &SxsWin32PolicyPath.
String;
2430 PolicyPathPair.
Nt = &SxsNtPolicyPath.
String;
2431#endif
2432
2433 DPRINT(
"CreateProcessInternalW: '%S' '%S' %lx\n", lpApplicationName, lpCommandLine, dwCreationFlags);
2434
2435
2438
2439
2442 {
2443 DPRINT1(
"Invalid flag combo used\n");
2446 }
2447
2448
2450 {
2452 }
2454 {
2456 }
2458 {
2460 }
2462 {
2464 }
2466 {
2468 }
2470 {
2473 }
2474 else
2475 {
2477 }
2478
2479
2487
2488
2491 {
2492
2493 DPRINT1(
"Invalid WOW flags\n");
2496 }
2499 {
2500
2502 }
2503
2504
2507 {
2508
2509 dwCreationFlags = (dwCreationFlags &~ CREATE_SHARED_WOW_VDM) |
2511 }
2512
2513
2515 {
2516
2518 while ((*pcScan) || (*(pcScan + 1))) ++pcScan;
2519
2520
2521 EnvironmentLength = (pcScan +
sizeof(
ANSI_NULL) - (
PCHAR)lpEnvironment);
2523 {
2524
2527 }
2528
2529
2532
2533
2538 0,
2543 {
2544
2547 }
2548
2549
2553 {
2554
2561 }
2562
2563
2564 lpEnvironment = UnicodeEnv.
Buffer;
2565 }
2566
2567
2568 StartupInfo = *lpStartupInfo;
2569
2570
2573 {
2574
2575 StartupInfo.
dwFlags &= ~STARTF_USESTDHANDLES;
2576 }
2577
2578
2579AppNameRetry:
2580
2581 if (NameBuffer)
2582 {
2585 }
2586
2587
2588 if (FreeBuffer)
2589 {
2592 }
2593
2594
2596 {
2599 }
2600
2601
2604 QuotesNeeded =
FALSE;
2605 CmdLineIsAppName =
FALSE;
2606
2607
2608 if (!lpApplicationName)
2609 {
2610
2612
2613
2615 0,
2617 if (!NameBuffer)
2618 {
2621 goto Quickie;
2622 }
2623
2624
2625 lpApplicationName = NullBuffer = ScanString = lpCommandLine;
2626
2627
2628 if (*lpCommandLine ==
L'\"')
2629 {
2630
2631 SearchRetry =
FALSE;
2632 ScanString++;
2633 lpApplicationName = ScanString;
2634 while (*ScanString)
2635 {
2636
2637 if (*ScanString ==
L'\"')
2638 {
2639
2640 NullBuffer = ScanString;
2642 break;
2643 }
2644
2645
2646 ScanString++;
2647 NullBuffer = ScanString;
2648 }
2649 }
2650 else
2651 {
2652StartScan:
2653
2654 lpApplicationName = lpCommandLine;
2655 while (*ScanString)
2656 {
2657
2658 if ((*ScanString ==
L' ') || (*ScanString ==
L'\t'))
2659 {
2660
2661 NullBuffer = ScanString;
2662 break;
2663 }
2664
2665
2666 ScanString++;
2667 NullBuffer = ScanString;
2668 }
2669 }
2670
2671
2672 SaveChar = *NullBuffer;
2674
2675
2677 {
2680 }
2681
2682
2686 {
2689 goto Quickie;
2690 }
2691
2692
2694 lpApplicationName,
2697 NameBuffer,
2699
2700
2702 {
2703
2707 {
2708
2710 }
2711 else
2712 {
2713
2715 }
2716 }
2717
2718 DPRINT(
"Length: %lu Buffer: %S\n",
Length, NameBuffer);
2719
2720
2722 {
2723
2724 *NullBuffer = SaveChar;
2725 lpApplicationName = NameBuffer;
2726 }
2727 else
2728 {
2729
2732 {
2733
2743 {
2744
2748 }
2749 }
2750 else
2751 {
2752
2754 }
2755
2756
2758 {
2759
2761 }
2762 else
2763 {
2764
2766 }
2767
2768
2769 *NullBuffer = SaveChar;
2770 lpApplicationName = NameBuffer;
2771
2772
2773 if (!(*ScanString) || !(SearchRetry))
2774 {
2775
2777 goto Quickie;
2778 }
2779
2780
2781 ScanString++;
2782 NullBuffer = ScanString;
2783
2784
2785 QuotesNeeded =
TRUE;
2787 goto StartScan;
2788 }
2789 }
2790 else if (!(lpCommandLine) || !(*lpCommandLine))
2791 {
2792
2793 CmdLineIsAppName =
TRUE;
2794 lpCommandLine = (
LPWSTR)lpApplicationName;
2795 }
2796
2797
2799 &PathName,
2801 &SxsWin32RelativePath);
2802 if (!TranslationStatus)
2803 {
2804
2805 DPRINT1(
"Path translation for SxS failed\n");
2808 goto Quickie;
2809 }
2810
2811
2813 FreeBuffer = PathName.
Buffer;
2814
2815
2822 {
2823
2824 RtlInitEmptyUnicodeString(&PathBufferString,
NULL, 0);
2827 &PathBufferString,
2831 &SxsPathType,
2834 {
2835
2839 goto Quickie;
2840 }
2841
2842
2843 SxsWin32ExePath = PathBufferString;
2844 PathBuffer = PathBufferString.
Buffer;
2846 DPRINT(
"SxS Path: %S\n", PathBuffer);
2847 }
2848
2849
2850#if _SXS_SUPPORT_ENABLED_
2851 SxsNtExePath = PathName;
2852#endif
2854 {
2855
2857 }
2858 else
2859 {
2860
2862 }
2863
2864
2867 &PathName,
2876 &LocalObjectAttributes,
2882 {
2883
2886 &LocalObjectAttributes,
2891 }
2892
2893
2895 DPRINT1(
"Open file failed: %lx (%wZ)\n",
Status, &PathName);
2896
2897
2899
2901 {
2902
2904 {
2905
2908 goto Quickie;
2909 }
2910 else
2911 {
2912
2915 goto Quickie;
2916 }
2917 }
2918
2919
2921 {
2922
2924 }
2925
2926
2936 {
2937
2942 {
2943
2946 {
2947
2948 DPRINT1(
"Invalid Blade hashes!\n");
2951 goto Quickie;
2952 }
2953
2954
2956 {
2957
2958 DPRINT1(
"Tampered Blade hashes!\n");
2961 goto Quickie;
2962 }
2963 }
2964
2965
2968 {
2969
2972 if (SectionHandle)
2973 {
2975 SectionHandle =
NULL;
2976 }
2978 goto Quickie;
2979 }
2980
2981
2984 {
2985
2988
2989
2991 UseVdmReserve =
TRUE;
2992
2993
2995 SectionHandle =
NULL;
2996
2997
2998 QuerySection =
FALSE;
2999 }
3000 }
3001
3002
3003 if (!SkipSaferAndAppCompat)
3004 {
3005
3009 {
3010
3011 ImageMachine = 0;
3012
3013
3015 AppCompatData =
NULL;
3016 AppCompatSxsData =
NULL;
3017
3018
3019 if (SectionHandle)
3020 {
3021
3022 if (QuerySection)
3023 {
3024
3026 }
3027 else
3028 {
3029
3032 &ImageInformation,
3033 sizeof(ImageInformation),
3035 }
3036
3037
3039 {
3040
3041 QuerySection =
TRUE;
3042 ImageMachine = ImageInformation.
Machine;
3043 }
3044 }
3045
3046
3048 FreeBuffer,
3049 lpEnvironment,
3050 ImageMachine,
3051 &AppCompatData,
3052 &AppCompatDataSize,
3053 &AppCompatSxsData,
3054 &AppCompatSxsDataSize,
3057 {
3058
3059 DPRINT1(
"App compat launch failure: %lx\n", AppCompatStatus);
3061 {
3062
3064 }
3065 else
3066 {
3067
3069 }
3070
3071
3072 if (SectionHandle)
3073 {
3074
3076 SectionHandle =
NULL;
3077 }
3078
3079
3081 goto Quickie;
3082 }
3083 }
3084 }
3085
3086
3087
3088
3089 if (!(SkipSaferAndAppCompat) &&
3091 {
3092
3095 {
3100
3101 break;
3102
3104
3106
3107 default:
3108
3110 {
3111 SaferNeeded =
FALSE;
3112 }
3113
3114
3115 break;
3116 }
3117
3118
3119 if (SaferNeeded)
3120 {
3121
3123 (
LPWSTR)lpApplicationName,
3125 &InJob,
3127 &JobHandle);
3128 if (SaferStatus == 0xFFFFFFFF)
3129 {
3130
3131 DPRINT1(
"WinSafer blocking process launch\n");
3134 goto Quickie;
3135 }
3136
3137
3139 {
3140 DPRINT1(
"Error checking WinSafer: %lx\n", SaferStatus);
3143 goto Quickie;
3144 }
3145 }
3146 }
3147
3148
3150 {
3152 {
3153
3155 {
3156
3158
3159
3161 &VdmAnsiEnv,
3162 &VdmUnicodeEnv);
3164 {
3165 DPRINT1(
"VDM environment for WOW app failed\n");
3166 goto Quickie;
3167 }
3168
3169
3171 {
3172
3173 VdmBinaryType = (dwCreationFlags &
3176
3177
3179 lpApplicationName,
3180 lpCommandLine,
3181 lpCurrentDirectory,
3182 &VdmAnsiEnv,
3183 &CsrMsg[1],
3184 &VdmTask,
3185 dwCreationFlags,
3186 &StartupInfo,
3188
3189
3191
3192
3197 {
3198
3201 goto Quickie;
3202 }
3203
3204
3206 }
3207
3208
3212 {
3214
3216
3217
3218 if (UseVdmReserve) VdmReserve = 1;
3219
3220
3222 VdmTask,
3223 VdmBinaryType,
3224 &VdmString,
3225 &VdmReserve);
3227 {
3228 DPRINT1(
"VDM Configuration failed for WOW\n");
3230 goto Quickie;
3231 }
3232
3233
3234 lpCommandLine = VdmString.
Buffer;
3235 lpApplicationName =
NULL;
3236
3237
3240
3241
3243 break;
3244
3245
3247
3249
3250
3252 break;
3253
3255
3256 DPRINT1(
"VDM is not ready for WOW\n");
3259 goto Quickie;
3260
3261 default:
3262 break;
3263 }
3264
3265
3266 VdmReserve--;
3267
3268
3269 if (VdmWaitObject) goto VdmShortCircuit;
3270
3271
3272 bInheritHandles =
FALSE;
3273
3274
3275 if ((lpEnvironment) &&
3277 {
3279 }
3280
3281
3282 SkipSaferAndAppCompat =
TRUE;
3283 goto AppNameRetry;
3284 }
3285
3286
3287 }
3288
3292 {
3293
3295
3296
3300 {
3301
3303
3304
3306 &VdmAnsiEnv,
3307 &VdmUnicodeEnv);
3309 {
3310 DPRINT1(
"VDM environment for DOS failed\n");
3311 goto Quickie;
3312 }
3313
3314
3316 lpApplicationName,
3317 lpCommandLine,
3318 lpCurrentDirectory,
3319 &VdmAnsiEnv,
3320 &CsrMsg[1],
3321 &VdmTask,
3322 dwCreationFlags,
3323 &StartupInfo,
3326 {
3327
3331 goto Quickie;
3332 };
3333
3334
3338 {
3340
3342
3343
3345 {
3346 DPRINT1(
"Detached process but no VDM, not allowed\n");
3349 }
3350
3351
3353 VdmTask,
3354 VdmBinaryType,
3355 &VdmString,
3356 &VdmReserve);
3358 {
3359 DPRINT1(
"VDM Configuration failed for DOS\n");
3361 goto Quickie;
3362 }
3363
3364
3365 lpCommandLine = VdmString.
Buffer;
3366 lpApplicationName =
NULL;
3367 break;
3368
3370
3372
3373
3375 break;
3376
3378
3379 DPRINT1(
"VDM is not ready for DOS\n");
3382 goto Quickie;
3383
3384 default:
3385 break;
3386 }
3387
3388
3389 VdmReserve--;
3390
3391
3392 if (VdmWaitObject) goto VdmShortCircuit;
3393
3394
3395 bInheritHandles =
FALSE;
3396
3397
3398 if ((lpEnvironment) &&
3400 {
3402 }
3403
3404
3405 lpEnvironment = VdmUnicodeEnv.
Buffer;
3406 }
3407 else
3408 {
3409
3411
3412
3416 {
3417 DPRINT1(
"'%wZ': Invalid EXE, and not a batch or script file\n", &PathName);
3420 goto Quickie;
3421 }
3422
3423
3424 CmdQuoteLength = CmdLineIsAppName || HasQuotes;
3425 if (!CmdLineIsAppName)
3426 {
3427 if (HasQuotes) CmdQuoteLength++;
3428 }
3429 else
3430 {
3431 CmdQuoteLength++;
3432 }
3433
3434
3435 CmdLineLength =
wcslen(lpCommandLine);
3437 CmdLineLength += CmdQuoteLength +
sizeof(
ANSI_NULL);
3438 CmdLineLength *=
sizeof(
WCHAR);
3439
3440
3442 0,
3443 CmdLineLength);
3444 if (!AnsiCmdCommand)
3445 {
3448 goto Quickie;
3449 }
3450
3451
3453 if ((CmdLineIsAppName) || (HasQuotes))
3454 {
3455 wcscat(AnsiCmdCommand,
L"\"");
3456 }
3457 wcscat(AnsiCmdCommand, lpCommandLine);
3458 if ((CmdLineIsAppName) || (HasQuotes))
3459 {
3460 wcscat(AnsiCmdCommand,
L"\"");
3461 }
3462
3463
3465
3466
3467 lpCommandLine = DebuggerString.
Buffer;
3468 lpApplicationName =
NULL;
3469 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3470 }
3471
3472
3473 SkipSaferAndAppCompat =
TRUE;
3474 goto AppNameRetry;
3475 }
3476
3478 {
3479
3480 DPRINT1(
"64-bit binary, failing\n");
3483 goto Quickie;
3484 }
3485
3487 {
3488
3489 DPRINT1(
"File is offline, failing\n");
3491 break;
3492 }
3493
3494 default:
3495 {
3496
3498 {
3502 goto Quickie;
3503 }
3504
3505
3507 break;
3508 }
3509 }
3510
3511
3513 {
3514
3515 dwCreationFlags &= ~CREATE_SEPARATE_WOW_VDM;
3516 }
3517
3518
3519 if (!QuerySection)
3520 {
3521
3524 &ImageInformation,
3525 sizeof(ImageInformation),
3528 {
3529
3530 DPRINT1(
"Section query failed\n");
3533 goto Quickie;
3534 }
3535
3536
3537 QuerySection =
TRUE;
3538 }
3539
3540
3542 {
3543
3544 DPRINT1(
"Trying to launch a DLL, failing\n");
3547 goto Quickie;
3548 }
3549
3550
3551 Flags &= ~PROCESS_CREATE_FLAGS_LARGE_PAGES;
3552
3553
3554 ParameterFlags &= ~2;
3555
3556
3559 {
3560
3563 {
3564
3566 }
3567 else
3568 {
3569
3570 if (!DebuggerCmdLine)
3571 {
3572
3574 0,
3576 if (!DebuggerCmdLine)
3577 {
3578
3581
3582
3585 goto Quickie;
3586 }
3587 }
3588
3589
3593 DebuggerCmdLine,
3595 &ResultSize);
3597 (ResultSize <
sizeof(
WCHAR)) ||
3599 {
3600
3601 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3602 DebuggerCmdLine =
NULL;
3603 }
3604
3605
3609 &UseLargePages,
3610 sizeof(UseLargePages),
3612 if ((
NT_SUCCESS(IFEOStatus)) && (UseLargePages))
3613 {
3614
3616 }
3617
3618
3621 }
3622 }
3623
3624
3627 {
3628
3630 ErrorParameters[0] = (
ULONG_PTR)&PathName;
3632 1,
3633 1,
3634 ErrorParameters,
3636 &ErrorResponse);
3638 {
3639
3641 }
3642 else
3643 {
3644
3646 }
3647
3648
3649 DPRINT1(
"Invalid image architecture: %lx\n", ImageInformation.
Machine);
3651 goto Quickie;
3652 }
3653
3654
3657 {
3658
3660 SectionHandle =
NULL;
3661 QuerySection =
FALSE;
3662
3663
3665 {
3666
3669 goto Quickie;
3670 }
3671
3672
3674 lpApplicationName,
3675 lpCommandLine,
3676 &DebuggerString);
3678 {
3679
3680 DPRINT1(
"Subsystem command line failed\n");
3681 goto Quickie;
3682 }
3683
3684
3685 lpCommandLine = DebuggerString.
Buffer;
3686 lpApplicationName =
NULL;
3687
3688
3689 SkipSaferAndAppCompat =
TRUE;
3690 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3691 goto AppNameRetry;
3692 }
3693
3694
3698 {
3699
3700 DPRINT1(
"Invalid subsystem version: %hu.%hu\n",
3704 goto Quickie;
3705 }
3706
3707
3708 if (DebuggerCmdLine)
3709 {
3710
3713 {
3714
3715 lpCommandLine = (
LPWSTR)lpApplicationName;
3717 }
3718
3719
3721 {
3724 goto Quickie;
3725 }
3726
3727
3729
3730
3732 {
3735 goto Quickie;
3736 }
3737
3738
3740
3741
3744 {
3747 goto Quickie;
3748 }
3749
3750
3752 if (!DebuggerString.
Buffer)
3753 {
3756 goto Quickie;
3757 }
3758
3759
3760 RtlInitEmptyUnicodeString(&DebuggerString,
3763
3764
3766 DebuggerCmdLine);
3772
3773
3774 DbgPrint(
"BASE: Calling debugger with '%wZ'\n", &DebuggerString);
3775
3776
3777 lpCommandLine = DebuggerString.
Buffer;
3778 lpApplicationName =
NULL;
3779
3780
3782 SectionHandle =
NULL;
3783 QuerySection =
FALSE;
3784
3785
3790 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3791 DebuggerCmdLine =
NULL;
3792 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3793 goto AppNameRetry;
3794 }
3795
3796
3798 lpProcessAttributes,
3801 {
3802
3803
3804 LocalProcessAttributes = *lpProcessAttributes;
3807 &LocalProcessAttributes,
3809 }
3810
3811
3813 {
3814
3816 }
3817
3818
3820 {
3821
3824 {
3825 DPRINT1(
"Failed to connect to DbgUI!\n");
3828 goto Quickie;
3829 }
3830
3831
3833
3834
3836 {
3837
3839 }
3840 }
3841
3842
3844
3845
3846 HavePrivilege =
FALSE;
3847 PrivilegeState =
NULL;
3849 {
3850
3854 {
3855
3856 HavePrivilege =
TRUE;
3857 }
3858 }
3859
3860
3862
3863
3869 SectionHandle,
3870 DebugHandle,
3872 InJob);
3873
3874
3876
3877
3879
3880
3882
3883
3885 {
3886
3890 goto Quickie;
3891 }
3892
3893
3895 {
3896
3897 RealTimePrivilegeState =
NULL;
3898
3899
3901 {
3902
3904 }
3905
3906
3909 &PriorityClass,
3912
3913
3915 {
3916
3920 goto Quickie;
3921 }
3922 }
3923
3924
3926 {
3927
3931 &HardErrorMode,
3933 }
3934
3935
3936 if (VdmBinaryType)
3937 {
3938
3941 &VdmWaitObject,
3942 VdmTask,
3943 VdmBinaryType);
3944
3946 {
3947
3948 DPRINT1(
"Failed to update VDM with wait object\n");
3949 VdmWaitObject =
NULL;
3950 goto Quickie;
3951 }
3952
3953
3955 }
3956
3957
3958 if (VdmReserve)
3959 {
3960
3964 0,
3969 {
3970
3974 goto Quickie;
3975 }
3976
3978 }
3979
3980
3981 if (!QuerySection)
3982 {
3983
3986 &ImageInformation,
3987 sizeof(ImageInformation),
3990 {
3991
3995 goto Quickie;
3996 }
3997
3998
3999 QuerySection =
TRUE;
4000 }
4001
4002
4004 {
4005
4006 DPRINT(
"Image should receive SxS Fusion Isolation\n");
4007 }
4008
4009
4011
4012
4013 if (lpCurrentDirectory)
4014 {
4015
4016 DPRINT(
"Current directory: %S\n", lpCurrentDirectory);
4018 0,
4022 {
4023
4026 goto Quickie;
4027 }
4028
4029
4033 &FilePart);
4035 {
4036
4039 goto Quickie;
4040 }
4041
4042
4046 {
4047
4048 DPRINT1(
"Current directory is invalid\n");
4051 goto Quickie;
4052 }
4053 }
4054
4055
4056 if ((QuotesNeeded) || (CmdLineIsAppName))
4057 {
4058
4060 0,
4063 if (QuotedCmdLine)
4064 {
4065
4067
4068
4069 if (QuotesNeeded)
4070 {
4071 SaveChar = *NullBuffer;
4073 }
4074
4075
4076 wcscat(QuotedCmdLine, lpCommandLine);
4078
4079
4080 if (QuotesNeeded)
4081 {
4082 *NullBuffer = SaveChar;
4083 wcscat(QuotedCmdLine, NullBuffer);
4084 }
4085 }
4086 else
4087 {
4088
4089 if (QuotesNeeded) QuotesNeeded =
FALSE;
4090 if (CmdLineIsAppName) CmdLineIsAppName =
FALSE;
4091 }
4092 }
4093
4094
4095 if (CreateProcessMsg->
Sxs.
Flags & 1) ParameterFlags |= 1;
4096
4097
4098 if ((QuotesNeeded) || (CmdLineIsAppName)) lpCommandLine = QuotedCmdLine;
4099
4100
4103 RemotePeb,
4104 lpApplicationName,
4106 lpCommandLine,
4107 lpEnvironment,
4108 &StartupInfo,
4109 dwCreationFlags | NoWindow,
4110 bInheritHandles,
4112 AppCompatData,
4113 AppCompatDataSize);
4115 {
4116
4117 DPRINT1(
"BasePushProcessParameters failed\n");
4118 goto Quickie;
4119 }
4120
4121
4124
4125
4126 if (!(VdmBinaryType) &&
4127 !(bInheritHandles) &&
4133 {
4134
4137 &ProcessParameters,
4141 {
4142
4144 {
4148 }
4149
4150
4152 {
4156 }
4157
4158
4160 {
4164 }
4165 }
4166 }
4167
4168
4173 &InitialTeb);
4175 {
4179 goto Quickie;
4180 }
4181
4182
4184 RemotePeb,
4187 0);
4188
4189
4191 lpThreadAttributes,
4194 {
4195
4196 LocalThreadAttributes = *lpThreadAttributes;
4199 &LocalThreadAttributes,
4201 }
4202
4203
4210 &InitialTeb,
4213 {
4214
4218 goto Quickie;
4219 }
4220
4221
4225
4226
4228#ifdef _WIN64
4229 DPRINT(
"TODO: WOW64 is not supported yet\n");
4231#else
4233#endif
4235
4236
4237 switch (ImageInformation.
Machine)
4238 {
4239
4242 break;
4245 break;
4248 break;
4249
4250
4251 default:
4252 DbgPrint(
"kernel32: No mapping for ImageInformation.Machine == %04x\n",
4255 break;
4256 }
4257
4258
4261
4262
4264 (IsWowApp))
4265 {
4266
4267
4268
4269
4270
4272
4273
4275 if ((NtHeaders) &&
4277 {
4278
4280 }
4281 }
4282
4283
4284
4286 {
4288 }
4290 {
4292 }
4293
4294
4296
4297
4298 if (VdmBinaryType)
4299 {
4300
4302 CreateProcessMsg->
VdmTask = VdmTask;
4303 }
4304 else if (VdmReserve)
4305 {
4306
4308 }
4309
4310
4312 {
4313
4314 DPRINT1(
"This is an SxS Message -- should not happen yet\n");
4318 goto Quickie;
4319 }
4320
4321
4323 CaptureBuffer,
4326 sizeof(*CreateProcessMsg));
4327
4328
4329 if (CaptureBuffer)
4330 {
4332 CaptureBuffer =
NULL;
4333 }
4334
4335
4337 {
4338
4339 DPRINT1(
"Failed to tell csrss about new process\n");
4343 goto Quickie;
4344 }
4345
4346
4348 {
4349
4352 ThreadHandle);
4354 {
4355
4360 goto Quickie;
4361 }
4362 }
4363
4364
4365 if (JobHandle)
4366 {
4367
4370 {
4371
4376 goto Quickie;
4377 }
4378 }
4379
4380
4382 {
4384 }
4385
4386VdmShortCircuit:
4387
4389
4390
4392
4393
4394 if (VdmWaitObject)
4395 {
4396
4398 {
4399
4401 lpProcessInformation->hProcess = VdmWaitObject;
4402
4403
4405 {
4406
4409 }
4410 }
4411 else
4412 {
4413
4414
4416 lpProcessInformation->hProcess = VdmWaitObject;
4417 }
4418
4419
4421 }
4422 else
4423 {
4424
4426 }
4427
4428
4429 lpProcessInformation->hThread = ThreadHandle;
4432
4433
4435 ThreadHandle =
NULL;
4436
4437Quickie:
4438
4439 if (DebuggerCmdLine)
RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
4440
4441
4442 if (PathBuffer)
4443 {
4444
4445 RtlInitEmptyUnicodeString(&SxsWin32ExePath,
NULL, 0);
4446 SxsWin32ExePath.
Length = 0;
4447
4448
4450 }
4451
4452#if _SXS_SUPPORT_ENABLED_
4453
4454 if (!VdmBinaryType)
4455 {
4456
4459
4460
4461 if (SxsConglomeratedBuffer)
4462 {
4463
4464 for (
i = 0;
i < 5;
i++)
4465 {
4466
4467 ThisBuffer = SxsStaticBuffers[
i];
4468 if (ThisBuffer)
4469 {
4470
4472 if ((ThisBuffer != (
PVOID)-8) && (ByteBuffer->
Buffer))
4473 {
4474
4476 {
4477
4480 }
4481
4482
4485 }
4486
4487
4488 RtlInitEmptyUnicodeString(&ThisBuffer->
String,
4492 {
4493
4495 }
4496 }
4497 }
4498 }
4499 }
4500#endif
4501
4503 {
4504
4506
4507
4509 lpEnvironment =
NULL;
4510 }
4511
4512
4513 RtlFreeHeap(RtlGetProcessHeap(), 0, QuotedCmdLine);
4517
4518
4520 if (SectionHandle)
NtClose(SectionHandle);
4521
4522
4523 if (ThreadHandle)
4524 {
4525
4528 }
4529
4530
4532
4533
4534 if (JobHandle)
NtClose(JobHandle);
4535
4536
4538 {
4539
4541 {
4542
4544 }
4545 else
4546 {
4547
4549 }
4550 }
4551
4552
4554
4555
4558
4559
4561 {
4562
4564 }
4565
4566
4568 {
4569
4572 VdmUndoLevel,
4573 VdmBinaryType);
4574
4575
4576 if (VdmWaitObject)
NtClose(VdmWaitObject);
4577 }
4578
4579
4581
4582
4584}
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN OUT PATH_TYPE_AND_UNKNOWN * PathType
NTSTATUS WINAPI BasepCheckBadapp(IN HANDLE FileHandle, IN PWCHAR ApplicationName, IN PWCHAR Environment, IN USHORT ExeType, IN PVOID *SdbQueryAppCompatData, IN PULONG SdbQueryAppCompatDataSize, IN PVOID *SxsData, IN PULONG SxsDataSize, OUT PULONG FusionFlags)
VOID WINAPI BasepFreeAppCompatData(IN PVOID AppCompatData, IN PVOID AppCompatSxsData)
#define FILE_NON_DIRECTORY_FILE
#define BASESRV_SERVERDLL_INDEX
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
#define CSR_CREATE_API_NUMBER(ServerId, ApiId)
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
#define ERROR_INVALID_PARAMETER
#define INVALID_HANDLE_VALUE
#define FILE_ATTRIBUTE_NORMAL
#define ERROR_ACCESS_DENIED
PBASE_STATIC_SERVER_DATA BaseStaticServerData
DWORD WINAPI GetFileAttributesW(LPCWSTR lpFileName)
LPWSTR WINAPI BaseComputeProcessExePath(IN LPWSTR FullPath)
DWORD WINAPI SearchPathW(IN LPCWSTR lpPath OPTIONAL, IN LPCWSTR lpFileName, IN LPCWSTR lpExtension OPTIONAL, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart OPTIONAL)
BOOLEAN WINAPI BasePushProcessParameters(IN ULONG ParameterFlags, IN HANDLE ProcessHandle, IN PPEB RemotePeb, IN LPCWSTR ApplicationPathName, IN LPWSTR lpCurrentDirectory, IN LPWSTR lpCommandLine, IN LPVOID lpEnvironment, IN LPSTARTUPINFOW StartupInfo, IN DWORD CreationFlags, IN BOOL InheritHandles, IN ULONG ImageSubsystem, IN PVOID AppCompatData, IN ULONG AppCompatDataSize)
NTSTATUS WINAPI BasepCheckWebBladeHashes(IN HANDLE FileHandle)
VOID WINAPI StuffStdHandle(IN HANDLE ProcessHandle, IN HANDLE StandardHandle, IN PHANDLE Address)
BOOLEAN WINAPI BuildSubSysCommandLine(IN LPCWSTR SubsystemName, IN LPCWSTR ApplicationName, IN LPCWSTR CommandLine, OUT PUNICODE_STRING SubsysCommandLine)
NTSTATUS WINAPI BasepIsProcessAllowed(IN LPWSTR ApplicationName)
#define AddToHandle(x, y)
NTSTATUS WINAPI BasepReplaceProcessThreadTokens(IN HANDLE TokenHandle, IN HANDLE ProcessHandle, IN HANDLE ThreadHandle)
VOID WINAPI BasepSxsCloseHandles(IN PBASE_MSG_SXS_HANDLES Handles)
#define RemoveFromHandle(x, y)
BOOLEAN WINAPI BasepIsImageVersionOk(IN ULONG ImageMajorVersion, IN ULONG ImageMinorVersion)
NTSTATUS WINAPI BaseCreateStack(_In_ HANDLE hProcess, _In_opt_ SIZE_T StackCommit, _In_opt_ SIZE_T StackReserve, _Out_ PINITIAL_TEB InitialTeb)
VOID WINAPI BaseInitializeContext(IN PCONTEXT Context, IN PVOID Parameter, IN PVOID StartAddress, IN PVOID StackAddress, IN ULONG ContextType)
POBJECT_ATTRIBUTES WINAPI BaseFormatObjectAttributes(OUT POBJECT_ATTRIBUTES ObjectAttributes, IN PSECURITY_ATTRIBUTES SecurityAttributes OPTIONAL, IN PUNICODE_STRING ObjectName)
NTSTATUS WINAPI BasepCheckWinSaferRestrictions(IN HANDLE UserToken, IN LPWSTR ApplicationName, IN HANDLE FileHandle, OUT PBOOLEAN InJob, OUT PHANDLE NewToken, OUT PHANDLE JobHandle)
PVOID WINAPI BasepIsRealtimeAllowed(IN BOOLEAN Keep)
ULONG WINAPI BaseIsDosApplication(IN PUNICODE_STRING PathName, IN NTSTATUS Status)
BOOL NTAPI BaseDestroyVDMEnvironment(IN PANSI_STRING AnsiEnv, IN PUNICODE_STRING UnicodeEnv)
BOOL WINAPI BaseGetVdmConfigInfo(IN LPCWSTR CommandLineReserved, IN ULONG DosSeqId, IN ULONG BinaryType, IN PUNICODE_STRING CmdLineString, OUT PULONG VdmSize)
BOOL WINAPI BaseUpdateVDMEntry(IN ULONG UpdateIndex, IN OUT PHANDLE WaitHandle, IN ULONG IndexInfo, IN ULONG BinaryType)
BOOL NTAPI BaseCreateVDMEnvironment(IN PWCHAR lpEnvironment, OUT PANSI_STRING AnsiEnv, OUT PUNICODE_STRING UnicodeEnv)
NTSTATUS WINAPI BaseCheckVDM(IN ULONG BinaryType, IN PCWCH ApplicationName, IN PCWCH CommandLine, IN PCWCH CurrentDirectory, IN PANSI_STRING AnsiEnvironment, IN PBASE_API_MESSAGE ApiMessage, IN OUT PULONG iTask, IN DWORD CreationFlags, IN LPSTARTUPINFOW StartupInfo, IN HANDLE hUserToken OPTIONAL)
#define FILE_SYNCHRONOUS_IO_NONALERT
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define PROCESS_CREATE_FLAGS_BREAKAWAY
#define PROCESS_PRIORITY_CLASS_IDLE
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
#define PROCESS_PRIORITY_CLASS_INVALID
#define PROCESS_PRIORITY_CLASS_NORMAL
#define PROCESS_PRIORITY_CLASS_HIGH
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
#define PROCESS_PRIORITY_CLASS_REALTIME
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
@ ProcessDefaultHardErrorMode
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(IN PUNICODE_STRING SubKey, IN BOOLEAN Wow64, OUT PHANDLE NewKeyHandle)
PVOID PVOID PWCHAR PVOID USHORT PULONG PVOID PULONG PVOID PULONG PULONG FusionFlags
#define SE_LOCK_MEMORY_PRIVILEGE
static OUT PIO_STATUS_BLOCK IoStatusBlock
#define InitializeObjectAttributes(p, n, a, r, s)
_In_ NDIS_ERROR_CODE ErrorCode
#define PROCESSOR_ARCHITECTURE_IA64
#define PROCESSOR_ARCHITECTURE_UNKNOWN
#define PROCESSOR_ARCHITECTURE_AMD64
#define PROCESSOR_ARCHITECTURE_INTEL
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
@ SectionImageInformation
NTSYSAPI ULONG NTAPI RtlIsDosDeviceName_U(_In_ PCWSTR Name)
NTSYSAPI NTSTATUS NTAPI RtlAcquirePrivilege(_In_ PULONG Privilege, _In_ ULONG NumPriv, _In_ ULONG Flags, _Out_ PVOID *ReturnedState)
NTSTATUS NTAPI RtlGetFullPathName_UstrEx(_In_ PUNICODE_STRING FileName, _In_opt_ PUNICODE_STRING StaticString, _In_opt_ PUNICODE_STRING DynamicString, _Out_opt_ PUNICODE_STRING *StringUsed, _Out_opt_ PSIZE_T FilePartSize, _Out_opt_ PBOOLEAN NameInvalid, _Out_ RTL_PATH_TYPE *PathType, _Out_opt_ PSIZE_T LengthNeeded)
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName)
NTSYSAPI VOID NTAPI RtlDestroyEnvironment(_In_ PWSTR Environment)
NTSYSAPI RTL_PATH_TYPE NTAPI RtlDetermineDosPathNameType_U(_In_ PCWSTR Path)
NTSYSAPI VOID NTAPI RtlReleasePrivilege(_In_ PVOID ReturnedState)
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToRelativeNtPathName_U(_In_ PCWSTR DosName, _Out_ PUNICODE_STRING NtName, _Out_ PCWSTR *PartName, _Out_ PRTL_RELATIVE_NAME_U RelativeName)
#define SEM_FAILCRITICALERRORS
@ RtlPathTypeRootLocalDevice
@ RtlPathTypeDriveAbsolute
enum _RTL_PATH_TYPE RTL_PATH_TYPE
#define THREAD_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
#define SECTION_ALL_ACCESS
#define FILE_READ_ATTRIBUTES
#define PROCESS_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI NtTerminateProcess(HANDLE ProcessHandle, LONG ExitStatus)
#define FILE_SHARE_DELETE
#define FILE_ATTRIBUTE_DIRECTORY
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
#define PAGE_EXECUTE_READWRITE
#define UNICODE_STRING_MAX_CHARS
#define UNICODE_STRING_MAX_BYTES
#define VER_SUITE_DATACENTER
#define VER_SUITE_PERSONAL
#define IMAGE_SUBSYSTEM_POSIX_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
#define IMAGE_FILE_MACHINE_AMD64
#define IMAGE_FILE_MACHINE_IA64
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)
NTSTATUS NTAPI NtReadVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OUT PSIZE_T NumberOfBytesRead OPTIONAL)
NTSTATUS NTAPI NtIsProcessInJob(IN HANDLE ProcessHandle, IN HANDLE JobHandle OPTIONAL)
NTSTATUS NTAPI NtAssignProcessToJobObject(HANDLE JobHandle, HANDLE ProcessHandle)
NTSTATUS NTAPI NtCreateProcessEx(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI NtResumeThread(IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL)
#define STATUS_INVALID_IMAGE_WIN_64
#define STATUS_INVALID_IMAGE_WIN_16
#define STATUS_INVALID_IMAGE_NE_FORMAT
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
#define STATUS_INVALID_IMAGE_NOT_MZ
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_VDM_DISALLOWED
#define STATUS_FILE_IS_OFFLINE
#define STATUS_NAME_TOO_LONG
#define IMAGE_FILE_MACHINE_I386
_CRTIMP wchar_t *__cdecl wcscpy(_Out_writes_z_(_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_CRTIMP wchar_t *__cdecl wcscat(_Inout_updates_z_(_String_length_(_Dest)+_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_Check_return_ _CRTIMP int __cdecl _wcsnicmp(_In_reads_or_z_(_MaxCount) const wchar_t *_Str1, _In_reads_or_z_(_MaxCount) const wchar_t *_Str2, _In_ size_t _MaxCount)
VOID NTAPI CsrFreeCaptureBuffer(_In_ _Frees_ptr_ PCSR_CAPTURE_BUFFER CaptureBuffer)
NTSTATUS NTAPI CsrClientCallServer(_Inout_ PCSR_API_MESSAGE ApiMessage, _Inout_opt_ PCSR_CAPTURE_BUFFER CaptureBuffer, _In_ CSR_API_NUMBER ApiNumber, _In_ ULONG DataLength)
#define VDM_UNDO_COMPLETED
#define BINARY_TYPE_WOW_EX
#define BINARY_TYPE_SEPARATE_WOW
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
BASE_CREATE_PROCESS CreateProcessRequest
union _BASE_API_MESSAGE::@3513 Data
BASE_CHECK_VDM CheckVDMRequest
HANDLE WaitObjectForParent
BASE_SXS_CREATEPROCESS_MSG Sxs
USHORT ProcessorArchitecture
BOOLEAN DefaultSeparateVDM
PVOID ArbitraryUserPointer
BOOLEAN ReadImageFileExecOptions
ULONG ImageSubsystemMajorVersion
UNICODE_STRING RelativeName
HANDLE ContainingDirectory
UNICODE_STRING DesktopInfo
LPVOID lpSecurityDescriptor
#define RtlZeroMemory(Destination, Length)
#define STATUS_ACCESS_DENIED
#define INVALID_FILE_ATTRIBUTES
#define NORMAL_PRIORITY_CLASS
#define STARTF_FORCEOFFFEEDBACK
DWORD WINAPI GetLastError(void)
#define REALTIME_PRIORITY_CLASS
#define BELOW_NORMAL_PRIORITY_CLASS
#define CREATE_UNICODE_ENVIRONMENT
#define HIGH_PRIORITY_CLASS
#define CREATE_SHARED_WOW_VDM
#define CREATE_DEFAULT_ERROR_MODE
#define CREATE_SEPARATE_WOW_VDM
#define DEBUG_ONLY_THIS_PROCESS
#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL
#define IDLE_PRIORITY_CLASS
#define STARTF_FORCEONFEEDBACK
#define ABOVE_NORMAL_PRIORITY_CLASS
#define ERROR_PATH_NOT_FOUND
#define ERROR_BAD_EXE_FORMAT
#define ERROR_CHILD_NOT_COMPLETE
#define ERROR_ACCESS_DISABLED_BY_POLICY
#define ERROR_EXE_MACHINE_TYPE_MISMATCH
#define ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER
#define ERROR_ACCESS_DISABLED_WEBBLADE
#define ERROR_FILE_OFFLINE
_Must_inspect_result_ _In_ ULONG Flags
_Out_ PCLIENT_ID ClientId