51 #define CMD_STRING L"cmd /c " 63 SIZE_T NumberOfBytesWritten;
66 if (!StandardHandle)
return;
84 &NumberOfBytesWritten);
127 if (ImageMajorVersion > 3 ||
128 (ImageMajorVersion == 3 && ImageMinorVersion >= 10))
134 DPRINT1(
"Accepting image version %lu.%lu, although ReactOS is an NT %hu.%hu OS!\n",
161 DPRINT1(
"Egad! This is a ReactOS Compute Server and we should prevent you from using certain APIs...but we won't.");
165 DPRINT1(
"Gasp! This is a ReactOS Storage Server and we should prevent you from using certain APIs...but we won't.");
169 DPRINT1(
"Golly! This is a ReactOS Web Blade Server and we should prevent you from using certain APIs...but we won't.");
249 sizeof(
L"EmbdTrst.DLL"));
257 "ImageOkToRunOnEmbeddedNT");
333 NextEntry = NextEntry->
Flink;
388 &SaferiReplaceProcessThreadTokens,
433 if (Handles->Section)
440 if (Handles->ViewBase.QuadPart)
452 DPRINT(
"BaseProcessStartup(..) - setting up exception frame.\n");
490 DPRINT(
"BasepNotifyCsrOfThread: Thread: %p, Handle %p\n",
501 sizeof(*CreateThreadRequest));
504 DPRINT1(
"Failed to tell CSRSS about new thread: %lx\n", ApiMessage.
Status);
529 PWCHAR Remaining, DllPathString, ScanChar;
531 PVOID RemoteAppCompatData;
582 if (StartupInfo->lpDesktop)
590 if (StartupInfo->lpReserved)
598 if (StartupInfo->lpTitle)
612 if (!AppCompatData) AppCompatDataSize = 0;
615 ProcessParameters =
NULL;
619 DPRINT(
"CmdLine : '%wZ'\n", &CommandLine);
623 DPRINT(
"Runtime : '%wZ'\n", &Runtime);
656 ScanChar = lpEnvironment;
660 while (*ScanChar++)
while (*ScanChar++);
694 ProcessParameters->
StartingX = StartupInfo->dwX;
695 ProcessParameters->
StartingY = StartupInfo->dwY;
696 ProcessParameters->
CountX = StartupInfo->dwXSize;
697 ProcessParameters->
CountY = StartupInfo->dwYSize;
698 ProcessParameters->
CountCharsX = StartupInfo->dwXCountChars;
699 ProcessParameters->
CountCharsY = StartupInfo->dwYCountChars;
700 ProcessParameters->
FillAttribute = StartupInfo->dwFillAttribute;
701 ProcessParameters->
WindowFlags = StartupInfo->dwFlags;
705 if (StartupInfo->dwFlags &
732 if (!(StartupInfo->dwFlags &
736 if ((InheritHandles) ||
741 if ((InheritHandles) ||
746 if ((InheritHandles) ||
762 if (ParameterFlags & 1)
768 if (ParameterFlags & 2)
775 RemoteParameters =
NULL;
777 (
PVOID*)&RemoteParameters,
801 ProcessParameters->
Length,
807 &RemotePeb->ProcessParameters,
814 RemoteAppCompatData =
NULL;
818 Size = AppCompatDataSize;
820 &RemoteAppCompatData,
838 &RemotePeb->pShimData,
839 &RemoteAppCompatData,
848 &RemotePeb->ImageSubsystem,
850 sizeof(ImageSubsystem),
864 DPRINT1(
"Failure to create process parameters: %lx\n",
Status);
932 (
PVOID)&dwProcessAffinityMask,
960 sizeof(*ShutdownParametersRequest));
991 sizeof(*ShutdownParametersRequest));
1020 sizeof(QuotaLimits),
1047 lpMinimumWorkingSetSize,
1048 lpMaximumWorkingSetSize,
1072 if ((dwMinimumWorkingSetSize) && (dwMaximumWorkingSetSize))
1086 sizeof(QuotaLimits));
1119 dwMinimumWorkingSetSize,
1120 dwMaximumWorkingSetSize,
1152 lpCreationTime->dwLowDateTime = Kut.
CreateTime.
u.LowPart;
1153 lpCreationTime->dwHighDateTime = Kut.
CreateTime.
u.HighPart;
1154 lpExitTime->dwLowDateTime = Kut.
ExitTime.
u.LowPart;
1155 lpExitTime->dwHighDateTime = Kut.
ExitTime.
u.HighPart;
1156 lpKernelTime->dwLowDateTime = Kut.
KernelTime.
u.LowPart;
1157 lpKernelTime->dwHighDateTime = Kut.
KernelTime.
u.HighPart;
1158 lpUserTime->dwLowDateTime = Kut.
UserTime.
u.LowPart;
1159 lpUserTime->dwHighDateTime = Kut.
UserTime.
u.HighPart;
1208 sizeof(ProcessBasic),
1239 sizeof(ProcessBasic),
1323 lpStartupInfo->dwXSize = Params->
CountX;
1324 lpStartupInfo->dwYSize = Params->
CountY;
1325 lpStartupInfo->dwXCountChars = Params->
CountCharsX;
1326 lpStartupInfo->dwYCountChars = Params->
CountCharsY;
1353 ANSI_STRING TitleString, ShellString, DesktopString;
1362 while (!StartupInfo)
1367 sizeof(*StartupInfo));
1376 StartupInfo->
cb =
sizeof(*StartupInfo);
1454 lpStartupInfo->cb = StartupInfo->
cb;
1455 lpStartupInfo->lpReserved = StartupInfo->
lpReserved;
1456 lpStartupInfo->lpDesktop = StartupInfo->
lpDesktop;
1457 lpStartupInfo->lpTitle = StartupInfo->
lpTitle;
1458 lpStartupInfo->dwX = StartupInfo->
dwX;
1459 lpStartupInfo->dwY = StartupInfo->
dwY;
1460 lpStartupInfo->dwXSize = StartupInfo->
dwXSize;
1461 lpStartupInfo->dwYSize = StartupInfo->
dwYSize;
1465 lpStartupInfo->dwFlags = StartupInfo->
dwFlags;
1466 lpStartupInfo->wShowWindow = StartupInfo->
wShowWindow;
1467 lpStartupInfo->cbReserved2 = StartupInfo->
cbReserved2;
1468 lpStartupInfo->lpReserved2 = StartupInfo->
lpReserved2;
1471 if (lpStartupInfo->dwFlags &
1475 lpStartupInfo->hStdInput = StartupInfo->
hStdInput;
1476 lpStartupInfo->hStdOutput = StartupInfo->
hStdOutput;
1477 lpStartupInfo->hStdError = StartupInfo->
hStdError;
1536 ExitProcessRequest->
uExitCode = uExitCode;
1540 sizeof(*ExitProcessRequest));
1663 DbgPrompt(
"A (Abort), B (Break), I (Ignore)? ", ch,
sizeof(ch));
1696 sizeof(PriorityClass),
1730 switch (dwPriorityClass)
1835 sizeof(ProcessBasicInfo),
1863 sizeof(VersionData),
1948 IN BOOL bDisablePriorityBoost)
1990 *pdwHandleCount = phc;
2024 *Wow64Process = (
pbi != 0);
2063 (
PVOID)lpBaseAddress,
2069 if (lpNumberOfBytesRead) *lpNumberOfBytesRead =
nSize;
2100 Base = lpBaseAddress;
2132 if (lpNumberOfBytesWritten) *lpNumberOfBytesWritten =
nSize;
2170 if (lpNumberOfBytesWritten) *lpNumberOfBytesWritten =
nSize;
2235 &SessionInformation,
2236 sizeof(SessionInformation),
2244 *pSessionId = SessionInformation.
SessionId;
2255 #define AddToHandle(x,y) (x) = (HANDLE)((ULONG_PTR)(x) | (y)); 2256 #define RemoveFromHandle(x,y) (x) = (HANDLE)((ULONG_PTR)(x) & ~(y)); 2289 ULONG ParameterFlags, PrivilegeValue, HardErrorMode, ErrorResponse;
2291 BOOLEAN InJob, SaferNeeded, UseLargePages, HavePrivilege;
2292 BOOLEAN QuerySection, SkipSaferAndAppCompat;
2302 NTSTATUS Status, AppCompatStatus, SaferStatus, IFEOStatus, ImageDbgStatus;
2320 SIZE_T EnvironmentLength, CmdLineLength;
2325 BOOLEAN SearchRetry, QuotesNeeded, CmdLineIsAppName, HasQuotes;
2331 #if _SXS_SUPPORT_ENABLED_ 2339 PVOID CapturedStrings[3];
2343 PWCHAR SxsConglomeratedBuffer, StaticBuffer;
2344 ULONG ConglomeratedBufferSizeBytes, StaticBufferSize,
i;
2351 PWCHAR FilePart, PathBuffer, FreeBuffer;
2359 PVOID AppCompatSxsData, AppCompatData;
2360 ULONG AppCompatSxsDataSize, AppCompatDataSize;
2364 ULONG BinarySubType, VdmBinaryType, VdmTask, VdmReserve;
2374 QuerySection =
FALSE;
2376 SkipSaferAndAppCompat =
FALSE;
2383 SectionHandle =
NULL;
2385 ThreadHandle =
NULL;
2389 AppCompatData =
NULL;
2390 AppCompatDataSize = 0;
2391 AppCompatSxsData =
NULL;
2392 AppCompatSxsDataSize = 0;
2393 CaptureBuffer =
NULL;
2394 #if _SXS_SUPPORT_ENABLED_ 2395 SxsConglomeratedBuffer =
NULL;
2400 DebuggerCmdLine =
NULL;
2410 QuotedCmdLine =
NULL;
2420 VdmWaitObject =
NULL;
2421 UseVdmReserve =
FALSE;
2430 #if _SXS_SUPPORT_ENABLED_ 2436 RtlZeroMemory(&LocalProcessAttributes,
sizeof(LocalProcessAttributes));
2437 RtlZeroMemory(&LocalThreadAttributes,
sizeof(LocalThreadAttributes));
2440 RtlZeroMemory(lpProcessInformation,
sizeof(*lpProcessInformation));
2441 if (hNewToken) *hNewToken =
NULL;
2447 #if _SXS_SUPPORT_ENABLED_ 2449 SxsStaticBuffers[0] = &SxsWin32ManifestPath;
2450 SxsStaticBuffers[1] = &SxsWin32PolicyPath;
2451 SxsStaticBuffers[2] = &SxsWin32AssemblyDirectory;
2452 SxsStaticBuffers[3] = &SxsNtManifestPath;
2453 SxsStaticBuffers[4] = &SxsNtPolicyPath;
2454 ExePathPair.
Win32 = &SxsWin32ExePath;
2455 ExePathPair.
Nt = &SxsNtExePath;
2456 ManifestPathPair.
Win32 = &SxsWin32ManifestPath.
String;
2457 ManifestPathPair.
Nt = &SxsNtManifestPath.
String;
2458 PolicyPathPair.
Win32 = &SxsWin32PolicyPath.
String;
2459 PolicyPathPair.
Nt = &SxsNtPolicyPath.
String;
2462 DPRINT(
"CreateProcessInternalW: '%S' '%S' %lx\n", lpApplicationName, lpCommandLine, dwCreationFlags);
2472 DPRINT1(
"Invalid flag combo used\n");
2522 DPRINT1(
"Invalid WOW flags\n");
2547 while ((*pcScan) || (*(pcScan + 1))) ++pcScan;
2550 EnvironmentLength = (pcScan +
sizeof(
ANSI_NULL) - (
PCHAR)lpEnvironment);
2593 lpEnvironment = UnicodeEnv.
Buffer;
2597 StartupInfo = *lpStartupInfo;
2633 QuotesNeeded =
FALSE;
2634 CmdLineIsAppName =
FALSE;
2637 if (!lpApplicationName)
2654 lpApplicationName = NullBuffer = ScanString = lpCommandLine;
2657 if (*lpCommandLine ==
L'\"')
2660 SearchRetry =
FALSE;
2662 lpApplicationName = ScanString;
2666 if (*ScanString ==
L'\"')
2669 NullBuffer = ScanString;
2676 NullBuffer = ScanString;
2683 lpApplicationName = lpCommandLine;
2687 if ((*ScanString ==
L' ') || (*ScanString ==
L'\t'))
2690 NullBuffer = ScanString;
2696 NullBuffer = ScanString;
2701 SaveChar = *NullBuffer;
2747 DPRINT(
"Length: %lu Buffer: %S\n",
Length, NameBuffer);
2753 *NullBuffer = SaveChar;
2754 lpApplicationName = NameBuffer;
2798 *NullBuffer = SaveChar;
2799 lpApplicationName = NameBuffer;
2802 if (!(*ScanString) || !(SearchRetry))
2811 NullBuffer = ScanString;
2814 QuotesNeeded =
TRUE;
2819 else if (!(lpCommandLine) || !(*lpCommandLine))
2822 CmdLineIsAppName =
TRUE;
2823 lpCommandLine = (
LPWSTR)lpApplicationName;
2830 &SxsWin32RelativePath);
2831 if (!TranslationStatus)
2834 DPRINT1(
"Path translation for SxS failed\n");
2842 FreeBuffer = PathName.
Buffer;
2853 RtlInitEmptyUnicodeString(&PathBufferString,
NULL, 0);
2872 SxsWin32ExePath = PathBufferString;
2873 PathBuffer = PathBufferString.
Buffer;
2875 DPRINT(
"SxS Path: %S\n", PathBuffer);
2879 #if _SXS_SUPPORT_ENABLED_ 2880 SxsNtExePath = PathName;
2905 &LocalObjectAttributes,
2915 &LocalObjectAttributes,
2924 DPRINT1(
"Open file failed: %lx (%wZ)\n",
Status, &PathName);
2977 DPRINT1(
"Invalid Blade hashes!\n");
2987 DPRINT1(
"Tampered Blade hashes!\n");
3004 SectionHandle =
NULL;
3020 UseVdmReserve =
TRUE;
3024 SectionHandle =
NULL;
3027 QuerySection =
FALSE;
3032 if (!SkipSaferAndAppCompat)
3044 AppCompatData =
NULL;
3045 AppCompatSxsData =
NULL;
3062 sizeof(ImageInformation),
3070 QuerySection =
TRUE;
3071 ImageMachine = ImageInformation.
Machine;
3083 &AppCompatSxsDataSize,
3088 DPRINT1(
"App compat launch failure: %lx\n", AppCompatStatus);
3105 SectionHandle =
NULL;
3118 if (!(SkipSaferAndAppCompat) &&
3140 SaferNeeded =
FALSE;
3152 (
LPWSTR)lpApplicationName,
3157 if (SaferStatus == 0xFFFFFFFF)
3160 DPRINT1(
"WinSafer blocking process launch\n");
3169 DPRINT1(
"Error checking WinSafer: %lx\n", SaferStatus);
3194 DPRINT1(
"VDM environment for WOW app failed\n");
3202 VdmBinaryType = (dwCreationFlags &
3247 if (UseVdmReserve) VdmReserve = 1;
3257 DPRINT1(
"VDM Configuration failed for WOW\n");
3263 lpCommandLine = VdmString.
Buffer;
3264 lpApplicationName =
NULL;
3285 DPRINT1(
"VDM is not ready for WOW\n");
3298 if (VdmWaitObject)
goto VdmShortCircuit;
3301 bInheritHandles =
FALSE;
3304 if ((lpEnvironment) &&
3311 SkipSaferAndAppCompat =
TRUE;
3339 DPRINT1(
"VDM environment for DOS failed\n");
3375 DPRINT1(
"Detached process but no VDM, not allowed\n");
3388 DPRINT1(
"VDM Configuration failed for DOS\n");
3394 lpCommandLine = VdmString.
Buffer;
3395 lpApplicationName =
NULL;
3408 DPRINT1(
"VDM is not ready for DOS\n");
3421 if (VdmWaitObject)
goto VdmShortCircuit;
3424 bInheritHandles =
FALSE;
3427 if ((lpEnvironment) &&
3434 lpEnvironment = VdmUnicodeEnv.
Buffer;
3446 DPRINT1(
"'%wZ': Invalid EXE, and not a batch or script file\n", &PathName);
3453 CmdQuoteLength = CmdLineIsAppName || HasQuotes;
3454 if (!CmdLineIsAppName)
3456 if (HasQuotes) CmdQuoteLength++;
3464 CmdLineLength =
wcslen(lpCommandLine);
3466 CmdLineLength += CmdQuoteLength +
sizeof(
ANSI_NULL);
3467 CmdLineLength *=
sizeof(
WCHAR);
3473 if (!AnsiCmdCommand)
3482 if ((CmdLineIsAppName) || (HasQuotes))
3484 wcscat(AnsiCmdCommand,
L"\"");
3486 wcscat(AnsiCmdCommand, lpCommandLine);
3487 if ((CmdLineIsAppName) || (HasQuotes))
3489 wcscat(AnsiCmdCommand,
L"\"");
3496 lpCommandLine = DebuggerString.
Buffer;
3497 lpApplicationName =
NULL;
3498 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3502 SkipSaferAndAppCompat =
TRUE;
3509 DPRINT1(
"64-bit binary, failing\n");
3518 DPRINT1(
"File is offline, failing\n");
3554 sizeof(ImageInformation),
3559 DPRINT1(
"Section query failed\n");
3566 QuerySection =
TRUE;
3573 DPRINT1(
"Trying to launch a DLL, failing\n");
3583 ParameterFlags &= ~2;
3599 if (!DebuggerCmdLine)
3605 if (!DebuggerCmdLine)
3626 (ResultSize <
sizeof(
WCHAR)) ||
3630 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3631 DebuggerCmdLine =
NULL;
3639 sizeof(UseLargePages),
3641 if ((
NT_SUCCESS(IFEOStatus)) && (UseLargePages))
3659 ErrorParameters[0] = (
ULONG_PTR)&PathName;
3678 DPRINT1(
"Invalid image architecture: %lx\n", ImageInformation.
Machine);
3689 SectionHandle =
NULL;
3690 QuerySection =
FALSE;
3709 DPRINT1(
"Subsystem command line failed\n");
3714 lpCommandLine = DebuggerString.
Buffer;
3715 lpApplicationName =
NULL;
3718 SkipSaferAndAppCompat =
TRUE;
3719 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3729 DPRINT1(
"Invalid subsystem version: %hu.%hu\n",
3737 if (DebuggerCmdLine)
3744 lpCommandLine = (
LPWSTR)lpApplicationName;
3781 if (!DebuggerString.
Buffer)
3789 RtlInitEmptyUnicodeString(&DebuggerString,
3803 DbgPrint(
"BASE: Calling debugger with '%wZ'\n", &DebuggerString);
3806 lpCommandLine = DebuggerString.
Buffer;
3807 lpApplicationName =
NULL;
3811 SectionHandle =
NULL;
3812 QuerySection =
FALSE;
3819 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3820 DebuggerCmdLine =
NULL;
3821 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3827 lpProcessAttributes,
3833 LocalProcessAttributes = *lpProcessAttributes;
3836 &LocalProcessAttributes,
3854 DPRINT1(
"Failed to connect to DbgUI!\n");
3875 HavePrivilege =
FALSE;
3876 PrivilegeState =
NULL;
3885 HavePrivilege =
TRUE;
3926 RealTimePrivilegeState =
NULL;
3977 DPRINT1(
"Failed to update VDM with wait object\n");
3978 VdmWaitObject =
NULL;
4016 sizeof(ImageInformation),
4028 QuerySection =
TRUE;
4035 DPRINT1(
"Image should receive SxS Fusion Isolation\n");
4042 if (lpCurrentDirectory)
4045 DPRINT(
"Current directory: %S\n", lpCurrentDirectory);
4077 DPRINT1(
"Current directory is invalid\n");
4085 if ((QuotesNeeded) || (CmdLineIsAppName))
4100 SaveChar = *NullBuffer;
4105 wcscat(QuotedCmdLine, lpCommandLine);
4111 *NullBuffer = SaveChar;
4112 wcscat(QuotedCmdLine, NullBuffer);
4118 if (QuotesNeeded) QuotesNeeded =
FALSE;
4119 if (CmdLineIsAppName) CmdLineIsAppName =
FALSE;
4124 if (CreateProcessMsg->
Sxs.
Flags & 1) ParameterFlags |= 1;
4127 if ((QuotesNeeded) || (CmdLineIsAppName)) lpCommandLine = QuotedCmdLine;
4138 dwCreationFlags | NoWindow,
4146 DPRINT1(
"BasePushProcessParameters failed\n");
4155 if (!(VdmBinaryType) &&
4156 !(bInheritHandles) &&
4225 LocalThreadAttributes = *lpThreadAttributes;
4228 &LocalThreadAttributes,
4258 DPRINT1(
"TODO: WOW64 is not supported yet\n");
4266 switch (ImageInformation.
Machine)
4281 DbgPrint(
"kernel32: No mapping for ImageInformation.Machine == %04x\n",
4332 CreateProcessMsg->
VdmTask = VdmTask;
4334 else if (VdmReserve)
4344 DPRINT1(
"This is an SxS Message -- should not happen yet\n");
4356 sizeof(*CreateProcessMsg));
4362 CaptureBuffer =
NULL;
4369 DPRINT1(
"Failed to tell csrss about new process\n");
4431 lpProcessInformation->hProcess = VdmWaitObject;
4447 lpProcessInformation->hProcess = VdmWaitObject;
4460 lpProcessInformation->hThread = ThreadHandle;
4466 ThreadHandle =
NULL;
4470 if (DebuggerCmdLine)
RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
4476 RtlInitEmptyUnicodeString(&SxsWin32ExePath,
NULL, 0);
4477 SxsWin32ExePath.
Length = 0;
4483 #if _SXS_SUPPORT_ENABLED_ 4492 if (SxsConglomeratedBuffer)
4495 for (
i = 0;
i < 5;
i++)
4498 ThisBuffer = SxsStaticBuffers[
i];
4503 if ((ThisBuffer != (
PVOID)-8) && (ByteBuffer->
Buffer))
4519 RtlInitEmptyUnicodeString(&ThisBuffer->
String,
4540 lpEnvironment =
NULL;
4544 RtlFreeHeap(RtlGetProcessHeap(), 0, QuotedCmdLine);
4551 if (SectionHandle)
NtClose(SectionHandle);
4565 if (JobHandle)
NtClose(JobHandle);
4607 if (VdmWaitObject)
NtClose(VdmWaitObject);
4627 BOOL bInheritHandles,
4628 DWORD dwCreationFlags,
4638 lpProcessAttributes,
4645 lpProcessInformation,
4655 LPCSTR lpApplicationName,
4656 LPSTR lpCommandLine,
4659 BOOL bInheritHandles,
4660 DWORD dwCreationFlags,
4662 LPCSTR lpCurrentDirectory,
4673 DPRINT(
"dwCreationFlags %x, lpEnvironment %p, lpCurrentDirectory %p, " 4674 "lpStartupInfo %p, lpProcessInformation %p\n",
4675 dwCreationFlags, lpEnvironment, lpCurrentDirectory,
4676 lpStartupInfo, lpProcessInformation);
4679 RtlMoveMemory(&StartupInfo, lpStartupInfo,
sizeof(*lpStartupInfo));
4697 if (lpApplicationName)
4702 if (lpCurrentDirectory)
4705 lpCurrentDirectory);
4729 lpProcessAttributes,
4736 lpProcessInformation,
4773 LPSTR lpCommandLine,
4776 BOOL bInheritHandles,
4777 DWORD dwCreationFlags,
4779 LPCSTR lpCurrentDirectory,
4787 lpProcessAttributes,
4794 lpProcessInformation,
4825 &ProcessInformation))
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
struct _STARTUPINFOA STARTUPINFOA
BASE_SXS_CREATEPROCESS_MSG Sxs
#define ERROR_INVALID_PARAMETER
VOID WINAPI BasepFreeAppCompatData(IN PVOID AppCompatData, IN PVOID AppCompatSxsData)
#define ERROR_CHILD_NOT_COMPLETE
PVOID WINAPI BasepIsRealtimeAllowed(IN BOOLEAN Keep)
ULONG ImageSubsystemMajorVersion
BOOL WINAPI CreateProcessInternalW(IN HANDLE hUserToken, IN LPCWSTR lpApplicationName, IN LPWSTR lpCommandLine, IN LPSECURITY_ATTRIBUTES lpProcessAttributes, IN LPSECURITY_ATTRIBUTES lpThreadAttributes, IN BOOL bInheritHandles, IN DWORD dwCreationFlags, IN LPVOID lpEnvironment, IN LPCWSTR lpCurrentDirectory, IN LPSTARTUPINFOW lpStartupInfo, IN LPPROCESS_INFORMATION lpProcessInformation, OUT PHANDLE hNewToken)
VOID NTAPI CsrFreeCaptureBuffer(IN PCSR_CAPTURE_BUFFER CaptureBuffer)
static int Hash(const char *)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
enum _RTL_PATH_TYPE RTL_PATH_TYPE
#define STATUS_INVALID_IMAGE_WIN_64
#define RemoveFromHandle(x, y)
BASE_CREATE_THREAD CreateThreadRequest
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
NTSTATUS NTAPI LdrQueryImageFileKeyOption(IN HANDLE KeyHandle, IN PCWSTR ValueName, IN ULONG Type, OUT PVOID Buffer, IN ULONG BufferSize, OUT PULONG ReturnedLength OPTIONAL)
VOID WINAPI BaseInitializeContext(IN PCONTEXT Context, IN PVOID Parameter, IN PVOID StartAddress, IN PVOID StackAddress, IN ULONG ContextType)
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
NTSYSAPI NTSTATUS NTAPI RtlCreateProcessParameters(_Out_ PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, _In_ PUNICODE_STRING ImagePathName, _In_opt_ PUNICODE_STRING DllPath, _In_opt_ PUNICODE_STRING CurrentDirectory, _In_opt_ PUNICODE_STRING CommandLine, _In_opt_ PWSTR Environment, _In_opt_ PUNICODE_STRING WindowTitle, _In_opt_ PUNICODE_STRING DesktopInfo, _In_opt_ PUNICODE_STRING ShellInfo, _In_opt_ PUNICODE_STRING RuntimeInfo)
#define THREAD_ALL_ACCESS
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
PVOID PVOID PWCHAR PVOID USHORT PULONG PVOID PULONG PVOID PULONG PULONG FusionFlags
#define REALTIME_PRIORITY_CLASS
NTSYSAPI VOID NTAPI RtlCopyMemory(VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, ULONG Length)
IN PVOID IN PVOID IN USHORT Version
#define IMAGE_SUBSYSTEM_POSIX_CUI
NTSTATUS NTAPI BasepSaveAppCertRegistryValue(IN PLIST_ENTRY List, IN PWCHAR ComponentName, IN PWCHAR DllName)
_In_ NDIS_ERROR_CODE ErrorCode
RTL_CRITICAL_SECTION gcsAppCert
*BytesInUnicodeString PWCH UnicodeString
BOOL NTAPI IsBadWritePtr(IN LPVOID lp, IN UINT_PTR ucb)
#define PROCESS_PRIORITY_CLASS_INVALID
#define PROCESS_ALL_ACCESS
#define RTL_USER_PROCESS_PARAMETERS_IMAGE_KEY_MISSING
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
NTSTATUS NTAPI LdrShutdownProcess(VOID)
#define SEM_FAILCRITICALERRORS
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
#define STATUS_NOT_IMPLEMENTED
#define PROCESS_QUERY_INFORMATION
BOOL WINAPI BaseUpdateVDMEntry(IN ULONG UpdateIndex, IN OUT PHANDLE WaitHandle, IN ULONG IndexInfo, IN ULONG BinaryType)
PBASE_STATIC_SERVER_DATA BaseStaticServerData
#define CREATE_SEPARATE_WOW_VDM
#define CREATE_UNICODE_ENVIRONMENT
#define PROCESSOR_ARCHITECTURE_UNKNOWN
#define HANDLE_DETACHED_PROCESS
#define HANDLE_CREATE_NO_WINDOW
WCHAR CurrentDirectory[1024]
NTSYSAPI ULONG NTAPI DbgPrompt(_In_z_ PCCH Prompt, _Out_writes_bytes_(MaximumResponseLength) PCH Response, _In_ ULONG MaximumResponseLength)
NTSTATUS NTAPI BasepConfigureAppCertDlls(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
#define SE_LOCK_MEMORY_PRIVILEGE
UNICODE_STRING WindowTitle
#define STATUS_INVALID_PARAMETER
#define AddToHandle(x, y)
NTSYSAPI VOID NTAPI RtlDestroyEnvironment(_In_ PWSTR Environment)
BOOL NTAPI BaseCreateVDMEnvironment(IN PWCHAR lpEnvironment, OUT PANSI_STRING AnsiEnv, OUT PUNICODE_STRING UnicodeEnv)
VOID WINAPI BasepAnsiStringToHeapUnicodeString(IN LPCSTR AnsiString, OUT LPWSTR *UnicodeString)
BOOL WINAPI GetExitCodeProcess(IN HANDLE hProcess, IN LPDWORD lpExitCode)
NTSTATUS WINAPI BasepCheckWinSaferRestrictions(IN HANDLE UserToken, IN LPWSTR ApplicationName, IN HANDLE FileHandle, OUT PBOOLEAN InJob, OUT PHANDLE NewToken, OUT PHANDLE JobHandle)
NTSTATUS NTAPI CsrClientCallServer(IN OUT PCSR_API_MESSAGE ApiMessage, IN OUT PCSR_CAPTURE_BUFFER CaptureBuffer OPTIONAL, IN CSR_API_NUMBER ApiNumber, IN ULONG DataLength)
_In_ PCWSTR _In_z_ PCWSTR _In_ ULONG ValueType
HANDLE ContainingDirectory
struct _STARTUPINFOW STARTUPINFOW
BOOL WINAPI BaseGetVdmConfigInfo(IN LPCWSTR CommandLineReserved, IN ULONG DosSeqId, IN ULONG BinaryType, IN PUNICODE_STRING CmdLineString, OUT PULONG VdmSize)
BASE_CREATE_PROCESS CreateProcessRequest
BOOL NTAPI BaseDestroyVDMEnvironment(IN PANSI_STRING AnsiEnv, IN PUNICODE_STRING UnicodeEnv)
#define ERROR_INVALID_HANDLE
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName)
NTSTATUS WINAPI BasepNotifyCsrOfThread(IN HANDLE ThreadHandle, IN PCLIENT_ID ClientId)
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
*nSize LPSTR _Inout_ LPDWORD nSize
BOOLEAN DefaultSeparateVDM
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)