51#define CMD_STRING L"cmd /c "
63 SIZE_T NumberOfBytesWritten;
66 if (!StandardHandle)
return;
84 &NumberOfBytesWritten);
127 if (ImageMajorVersion > 3 ||
128 (ImageMajorVersion == 3 && ImageMinorVersion >= 10))
134 DPRINT1(
"Accepting image version %lu.%lu, although ReactOS is an NT %hu.%hu OS!\n",
161 DPRINT1(
"Egad! This is a ReactOS Compute Server and we should prevent you from using certain APIs...but we won't.");
165 DPRINT1(
"Gasp! This is a ReactOS Storage Server and we should prevent you from using certain APIs...but we won't.");
169 DPRINT1(
"Golly! This is a ReactOS Web Blade Server and we should prevent you from using certain APIs...but we won't.");
249 sizeof(
L"EmbdTrst.DLL"));
257 "ImageOkToRunOnEmbeddedNT");
333 NextEntry = NextEntry->
Flink;
388 &SaferiReplaceProcessThreadTokens,
433 if (Handles->Section)
440 if (Handles->ViewBase.QuadPart)
499 PWCHAR Remaining, DllPathString, ScanChar;
501 PVOID RemoteAppCompatData;
552 if (StartupInfo->lpDesktop)
560 if (StartupInfo->lpReserved)
568 if (StartupInfo->lpTitle)
582 if (!AppCompatData) AppCompatDataSize = 0;
585 ProcessParameters =
NULL;
589 DPRINT(
"CmdLine : '%wZ'\n", &CommandLine);
593 DPRINT(
"Runtime : '%wZ'\n", &Runtime);
626 ScanChar = lpEnvironment;
630 while (*ScanChar++)
while (*ScanChar++);
664 ProcessParameters->
StartingX = StartupInfo->dwX;
665 ProcessParameters->
StartingY = StartupInfo->dwY;
666 ProcessParameters->
CountX = StartupInfo->dwXSize;
667 ProcessParameters->
CountY = StartupInfo->dwYSize;
668 ProcessParameters->
CountCharsX = StartupInfo->dwXCountChars;
669 ProcessParameters->
CountCharsY = StartupInfo->dwYCountChars;
670 ProcessParameters->
FillAttribute = StartupInfo->dwFillAttribute;
671 ProcessParameters->
WindowFlags = StartupInfo->dwFlags;
675 if (StartupInfo->dwFlags &
702 if (!(StartupInfo->dwFlags &
706 if ((InheritHandles) ||
711 if ((InheritHandles) ||
716 if ((InheritHandles) ||
732 if (ParameterFlags & 1)
738 if (ParameterFlags & 2)
745 RemoteParameters =
NULL;
747 (
PVOID*)&RemoteParameters,
771 ProcessParameters->
Length,
777 &RemotePeb->ProcessParameters,
784 RemoteAppCompatData =
NULL;
788 Size = AppCompatDataSize;
790 &RemoteAppCompatData,
808 &RemotePeb->pShimData,
809 &RemoteAppCompatData,
818 &RemotePeb->ImageSubsystem,
820 sizeof(ImageSubsystem),
834 DPRINT1(
"Failure to create process parameters: %lx\n",
Status);
902 (
PVOID)&dwProcessAffinityMask,
903 sizeof(dwProcessAffinityMask));
930 sizeof(*ShutdownParametersRequest));
961 sizeof(*ShutdownParametersRequest));
1017 lpMinimumWorkingSetSize,
1018 lpMaximumWorkingSetSize,
1042 if ((dwMinimumWorkingSetSize) && (dwMaximumWorkingSetSize))
1056 sizeof(QuotaLimits));
1089 dwMinimumWorkingSetSize,
1090 dwMaximumWorkingSetSize,
1122 lpCreationTime->dwLowDateTime = Kut.
CreateTime.
u.LowPart;
1123 lpCreationTime->dwHighDateTime = Kut.
CreateTime.
u.HighPart;
1124 lpExitTime->dwLowDateTime = Kut.
ExitTime.
u.LowPart;
1125 lpExitTime->dwHighDateTime = Kut.
ExitTime.
u.HighPart;
1126 lpKernelTime->dwLowDateTime = Kut.
KernelTime.
u.LowPart;
1127 lpKernelTime->dwHighDateTime = Kut.
KernelTime.
u.HighPart;
1128 lpUserTime->dwLowDateTime = Kut.
UserTime.
u.LowPart;
1129 lpUserTime->dwHighDateTime = Kut.
UserTime.
u.HighPart;
1178 sizeof(ProcessBasic),
1209 sizeof(ProcessBasic),
1288 lpStartupInfo->lpReserved =
Params->ShellInfo.Buffer;
1289 lpStartupInfo->lpDesktop =
Params->DesktopInfo.Buffer;
1290 lpStartupInfo->lpTitle =
Params->WindowTitle.Buffer;
1291 lpStartupInfo->dwX =
Params->StartingX;
1292 lpStartupInfo->dwY =
Params->StartingY;
1293 lpStartupInfo->dwXSize =
Params->CountX;
1294 lpStartupInfo->dwYSize =
Params->CountY;
1295 lpStartupInfo->dwXCountChars =
Params->CountCharsX;
1296 lpStartupInfo->dwYCountChars =
Params->CountCharsY;
1297 lpStartupInfo->dwFillAttribute =
Params->FillAttribute;
1298 lpStartupInfo->dwFlags =
Params->WindowFlags;
1299 lpStartupInfo->wShowWindow = (
WORD)
Params->ShowWindowFlags;
1300 lpStartupInfo->cbReserved2 =
Params->RuntimeData.Length;
1301 lpStartupInfo->lpReserved2 = (
LPBYTE)
Params->RuntimeData.Buffer;
1309 lpStartupInfo->hStdInput =
Params->StandardInput;
1310 lpStartupInfo->hStdOutput =
Params->StandardOutput;
1311 lpStartupInfo->hStdError =
Params->StandardError;
1323 ANSI_STRING TitleString, ShellString, DesktopString;
1332 while (!StartupInfo)
1337 sizeof(*StartupInfo));
1346 StartupInfo->
cb =
sizeof(*StartupInfo);
1424 lpStartupInfo->cb = StartupInfo->
cb;
1425 lpStartupInfo->lpReserved = StartupInfo->
lpReserved;
1426 lpStartupInfo->lpDesktop = StartupInfo->
lpDesktop;
1427 lpStartupInfo->lpTitle = StartupInfo->
lpTitle;
1428 lpStartupInfo->dwX = StartupInfo->
dwX;
1429 lpStartupInfo->dwY = StartupInfo->
dwY;
1430 lpStartupInfo->dwXSize = StartupInfo->
dwXSize;
1431 lpStartupInfo->dwYSize = StartupInfo->
dwYSize;
1435 lpStartupInfo->dwFlags = StartupInfo->
dwFlags;
1436 lpStartupInfo->wShowWindow = StartupInfo->
wShowWindow;
1437 lpStartupInfo->cbReserved2 = StartupInfo->
cbReserved2;
1438 lpStartupInfo->lpReserved2 = StartupInfo->
lpReserved2;
1441 if (lpStartupInfo->dwFlags &
1445 lpStartupInfo->hStdInput = StartupInfo->
hStdInput;
1446 lpStartupInfo->hStdOutput = StartupInfo->
hStdOutput;
1447 lpStartupInfo->hStdError = StartupInfo->
hStdError;
1506 ExitProcessRequest->
uExitCode = uExitCode;
1510 sizeof(*ExitProcessRequest));
1666 sizeof(PriorityClass),
1700 switch (dwPriorityClass)
1805 sizeof(ProcessBasicInfo),
1833 sizeof(VersionData),
1918 IN BOOL bDisablePriorityBoost)
1960 *pdwHandleCount = phc;
1994 *Wow64Process = (
pbi != 0);
2033 (
PVOID)lpBaseAddress,
2039 if (lpNumberOfBytesRead) *lpNumberOfBytesRead =
nSize;
2070 Base = lpBaseAddress;
2102 if (lpNumberOfBytesWritten) *lpNumberOfBytesWritten =
nSize;
2140 if (lpNumberOfBytesWritten) *lpNumberOfBytesWritten =
nSize;
2205 &SessionInformation,
2206 sizeof(SessionInformation),
2214 *pSessionId = SessionInformation.
SessionId;
2225#define AddToHandle(x,y) ((x) = (HANDLE)((ULONG_PTR)(x) | (y)))
2226#define RemoveFromHandle(x,y) ((x) = (HANDLE)((ULONG_PTR)(x) & ~(y)))
2259 ULONG ParameterFlags, PrivilegeValue, HardErrorMode, ErrorResponse;
2261 BOOLEAN InJob, SaferNeeded, UseLargePages, HavePrivilege;
2262 BOOLEAN QuerySection, SkipSaferAndAppCompat;
2272 NTSTATUS Status, AppCompatStatus, SaferStatus, IFEOStatus, ImageDbgStatus;
2290 SIZE_T EnvironmentLength, CmdLineLength;
2295 BOOLEAN SearchRetry, QuotesNeeded, CmdLineIsAppName, HasQuotes;
2301#if _SXS_SUPPORT_ENABLED_
2309 PVOID CapturedStrings[3];
2313 PWCHAR SxsConglomeratedBuffer, StaticBuffer;
2314 ULONG ConglomeratedBufferSizeBytes, StaticBufferSize,
i;
2321 PWCHAR FilePart, PathBuffer, FreeBuffer;
2329 PVOID AppCompatSxsData, AppCompatData;
2330 ULONG AppCompatSxsDataSize, AppCompatDataSize;
2334 ULONG BinarySubType, VdmBinaryType, VdmTask, VdmReserve;
2344 QuerySection =
FALSE;
2346 SkipSaferAndAppCompat =
FALSE;
2353 SectionHandle =
NULL;
2355 ThreadHandle =
NULL;
2360 AppCompatData =
NULL;
2361 AppCompatDataSize = 0;
2362 AppCompatSxsData =
NULL;
2363 AppCompatSxsDataSize = 0;
2364 CaptureBuffer =
NULL;
2365#if _SXS_SUPPORT_ENABLED_
2366 SxsConglomeratedBuffer =
NULL;
2371 DebuggerCmdLine =
NULL;
2381 QuotedCmdLine =
NULL;
2391 VdmWaitObject =
NULL;
2392 UseVdmReserve =
FALSE;
2401#if _SXS_SUPPORT_ENABLED_
2407 RtlZeroMemory(&LocalProcessAttributes,
sizeof(LocalProcessAttributes));
2408 RtlZeroMemory(&LocalThreadAttributes,
sizeof(LocalThreadAttributes));
2411 RtlZeroMemory(lpProcessInformation,
sizeof(*lpProcessInformation));
2412 if (hNewToken) *hNewToken =
NULL;
2416 dwCreationFlags &= ~CREATE_NO_WINDOW;
2418#if _SXS_SUPPORT_ENABLED_
2420 SxsStaticBuffers[0] = &SxsWin32ManifestPath;
2421 SxsStaticBuffers[1] = &SxsWin32PolicyPath;
2422 SxsStaticBuffers[2] = &SxsWin32AssemblyDirectory;
2423 SxsStaticBuffers[3] = &SxsNtManifestPath;
2424 SxsStaticBuffers[4] = &SxsNtPolicyPath;
2425 ExePathPair.
Win32 = &SxsWin32ExePath;
2426 ExePathPair.
Nt = &SxsNtExePath;
2427 ManifestPathPair.
Win32 = &SxsWin32ManifestPath.
String;
2428 ManifestPathPair.
Nt = &SxsNtManifestPath.
String;
2429 PolicyPathPair.
Win32 = &SxsWin32PolicyPath.
String;
2430 PolicyPathPair.
Nt = &SxsNtPolicyPath.
String;
2433 DPRINT(
"CreateProcessInternalW: '%S' '%S' %lx\n", lpApplicationName, lpCommandLine, dwCreationFlags);
2443 DPRINT1(
"Invalid flag combo used\n");
2493 DPRINT1(
"Invalid WOW flags\n");
2509 dwCreationFlags = (dwCreationFlags &~ CREATE_SHARED_WOW_VDM) |
2518 while ((*pcScan) || (*(pcScan + 1))) ++pcScan;
2521 EnvironmentLength = (pcScan +
sizeof(
ANSI_NULL) - (
PCHAR)lpEnvironment);
2564 lpEnvironment = UnicodeEnv.
Buffer;
2568 StartupInfo = *lpStartupInfo;
2575 StartupInfo.
dwFlags &= ~STARTF_USESTDHANDLES;
2604 QuotesNeeded =
FALSE;
2605 CmdLineIsAppName =
FALSE;
2608 if (!lpApplicationName)
2625 lpApplicationName = NullBuffer = ScanString = lpCommandLine;
2628 if (*lpCommandLine ==
L'\"')
2631 SearchRetry =
FALSE;
2633 lpApplicationName = ScanString;
2637 if (*ScanString ==
L'\"')
2640 NullBuffer = ScanString;
2647 NullBuffer = ScanString;
2654 lpApplicationName = lpCommandLine;
2658 if ((*ScanString ==
L' ') || (*ScanString ==
L'\t'))
2661 NullBuffer = ScanString;
2667 NullBuffer = ScanString;
2672 SaveChar = *NullBuffer;
2718 DPRINT(
"Length: %lu Buffer: %S\n",
Length, NameBuffer);
2724 *NullBuffer = SaveChar;
2725 lpApplicationName = NameBuffer;
2769 *NullBuffer = SaveChar;
2770 lpApplicationName = NameBuffer;
2773 if (!(*ScanString) || !(SearchRetry))
2782 NullBuffer = ScanString;
2785 QuotesNeeded =
TRUE;
2790 else if (!(lpCommandLine) || !(*lpCommandLine))
2793 CmdLineIsAppName =
TRUE;
2794 lpCommandLine = (
LPWSTR)lpApplicationName;
2801 &SxsWin32RelativePath);
2802 if (!TranslationStatus)
2805 DPRINT1(
"Path translation for SxS failed\n");
2813 FreeBuffer = PathName.
Buffer;
2824 RtlInitEmptyUnicodeString(&PathBufferString,
NULL, 0);
2843 SxsWin32ExePath = PathBufferString;
2844 PathBuffer = PathBufferString.
Buffer;
2846 DPRINT(
"SxS Path: %S\n", PathBuffer);
2850#if _SXS_SUPPORT_ENABLED_
2851 SxsNtExePath = PathName;
2876 &LocalObjectAttributes,
2886 &LocalObjectAttributes,
2895 DPRINT1(
"Open file failed: %lx (%wZ)\n",
Status, &PathName);
2948 DPRINT1(
"Invalid Blade hashes!\n");
2958 DPRINT1(
"Tampered Blade hashes!\n");
2975 SectionHandle =
NULL;
2991 UseVdmReserve =
TRUE;
2995 SectionHandle =
NULL;
2998 QuerySection =
FALSE;
3003 if (!SkipSaferAndAppCompat)
3015 AppCompatData =
NULL;
3016 AppCompatSxsData =
NULL;
3033 sizeof(ImageInformation),
3041 QuerySection =
TRUE;
3042 ImageMachine = ImageInformation.
Machine;
3054 &AppCompatSxsDataSize,
3059 DPRINT1(
"App compat launch failure: %lx\n", AppCompatStatus);
3076 SectionHandle =
NULL;
3089 if (!(SkipSaferAndAppCompat) &&
3111 SaferNeeded =
FALSE;
3123 (
LPWSTR)lpApplicationName,
3128 if (SaferStatus == 0xFFFFFFFF)
3131 DPRINT1(
"WinSafer blocking process launch\n");
3140 DPRINT1(
"Error checking WinSafer: %lx\n", SaferStatus);
3165 DPRINT1(
"VDM environment for WOW app failed\n");
3173 VdmBinaryType = (dwCreationFlags &
3218 if (UseVdmReserve) VdmReserve = 1;
3228 DPRINT1(
"VDM Configuration failed for WOW\n");
3234 lpCommandLine = VdmString.
Buffer;
3235 lpApplicationName =
NULL;
3256 DPRINT1(
"VDM is not ready for WOW\n");
3269 if (VdmWaitObject)
goto VdmShortCircuit;
3272 bInheritHandles =
FALSE;
3275 if ((lpEnvironment) &&
3282 SkipSaferAndAppCompat =
TRUE;
3310 DPRINT1(
"VDM environment for DOS failed\n");
3346 DPRINT1(
"Detached process but no VDM, not allowed\n");
3359 DPRINT1(
"VDM Configuration failed for DOS\n");
3365 lpCommandLine = VdmString.
Buffer;
3366 lpApplicationName =
NULL;
3379 DPRINT1(
"VDM is not ready for DOS\n");
3392 if (VdmWaitObject)
goto VdmShortCircuit;
3395 bInheritHandles =
FALSE;
3398 if ((lpEnvironment) &&
3405 lpEnvironment = VdmUnicodeEnv.
Buffer;
3417 DPRINT1(
"'%wZ': Invalid EXE, and not a batch or script file\n", &PathName);
3424 CmdQuoteLength = CmdLineIsAppName || HasQuotes;
3425 if (!CmdLineIsAppName)
3427 if (HasQuotes) CmdQuoteLength++;
3435 CmdLineLength =
wcslen(lpCommandLine);
3437 CmdLineLength += CmdQuoteLength +
sizeof(
ANSI_NULL);
3438 CmdLineLength *=
sizeof(
WCHAR);
3444 if (!AnsiCmdCommand)
3453 if ((CmdLineIsAppName) || (HasQuotes))
3455 wcscat(AnsiCmdCommand,
L"\"");
3457 wcscat(AnsiCmdCommand, lpCommandLine);
3458 if ((CmdLineIsAppName) || (HasQuotes))
3460 wcscat(AnsiCmdCommand,
L"\"");
3467 lpCommandLine = DebuggerString.
Buffer;
3468 lpApplicationName =
NULL;
3469 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3473 SkipSaferAndAppCompat =
TRUE;
3480 DPRINT1(
"64-bit binary, failing\n");
3489 DPRINT1(
"File is offline, failing\n");
3515 dwCreationFlags &= ~CREATE_SEPARATE_WOW_VDM;
3525 sizeof(ImageInformation),
3530 DPRINT1(
"Section query failed\n");
3537 QuerySection =
TRUE;
3544 DPRINT1(
"Trying to launch a DLL, failing\n");
3551 Flags &= ~PROCESS_CREATE_FLAGS_LARGE_PAGES;
3554 ParameterFlags &= ~2;
3570 if (!DebuggerCmdLine)
3576 if (!DebuggerCmdLine)
3597 (ResultSize <
sizeof(
WCHAR)) ||
3601 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3602 DebuggerCmdLine =
NULL;
3610 sizeof(UseLargePages),
3612 if ((
NT_SUCCESS(IFEOStatus)) && (UseLargePages))
3630 ErrorParameters[0] = (
ULONG_PTR)&PathName;
3649 DPRINT1(
"Invalid image architecture: %lx\n", ImageInformation.
Machine);
3660 SectionHandle =
NULL;
3661 QuerySection =
FALSE;
3680 DPRINT1(
"Subsystem command line failed\n");
3685 lpCommandLine = DebuggerString.
Buffer;
3686 lpApplicationName =
NULL;
3689 SkipSaferAndAppCompat =
TRUE;
3690 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3700 DPRINT1(
"Invalid subsystem version: %hu.%hu\n",
3708 if (DebuggerCmdLine)
3715 lpCommandLine = (
LPWSTR)lpApplicationName;
3752 if (!DebuggerString.
Buffer)
3760 RtlInitEmptyUnicodeString(&DebuggerString,
3774 DbgPrint(
"BASE: Calling debugger with '%wZ'\n", &DebuggerString);
3777 lpCommandLine = DebuggerString.
Buffer;
3778 lpApplicationName =
NULL;
3782 SectionHandle =
NULL;
3783 QuerySection =
FALSE;
3790 RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
3791 DebuggerCmdLine =
NULL;
3792 DPRINT1(
"Retrying with: %S\n", lpCommandLine);
3798 lpProcessAttributes,
3804 LocalProcessAttributes = *lpProcessAttributes;
3807 &LocalProcessAttributes,
3825 DPRINT1(
"Failed to connect to DbgUI!\n");
3846 HavePrivilege =
FALSE;
3847 PrivilegeState =
NULL;
3856 HavePrivilege =
TRUE;
3897 RealTimePrivilegeState =
NULL;
3948 DPRINT1(
"Failed to update VDM with wait object\n");
3949 VdmWaitObject =
NULL;
3987 sizeof(ImageInformation),
3999 QuerySection =
TRUE;
4006 DPRINT(
"Image should receive SxS Fusion Isolation\n");
4013 if (lpCurrentDirectory)
4016 DPRINT(
"Current directory: %S\n", lpCurrentDirectory);
4048 DPRINT1(
"Current directory is invalid\n");
4056 if ((QuotesNeeded) || (CmdLineIsAppName))
4071 SaveChar = *NullBuffer;
4076 wcscat(QuotedCmdLine, lpCommandLine);
4082 *NullBuffer = SaveChar;
4083 wcscat(QuotedCmdLine, NullBuffer);
4089 if (QuotesNeeded) QuotesNeeded =
FALSE;
4090 if (CmdLineIsAppName) CmdLineIsAppName =
FALSE;
4095 if (CreateProcessMsg->
Sxs.
Flags & 1) ParameterFlags |= 1;
4098 if ((QuotesNeeded) || (CmdLineIsAppName)) lpCommandLine = QuotedCmdLine;
4109 dwCreationFlags | NoWindow,
4117 DPRINT1(
"BasePushProcessParameters failed\n");
4126 if (!(VdmBinaryType) &&
4127 !(bInheritHandles) &&
4196 LocalThreadAttributes = *lpThreadAttributes;
4199 &LocalThreadAttributes,
4229 DPRINT(
"TODO: WOW64 is not supported yet\n");
4237 switch (ImageInformation.
Machine)
4252 DbgPrint(
"kernel32: No mapping for ImageInformation.Machine == %04x\n",
4302 CreateProcessMsg->
VdmTask = VdmTask;
4304 else if (VdmReserve)
4314 DPRINT1(
"This is an SxS Message -- should not happen yet\n");
4326 sizeof(*CreateProcessMsg));
4332 CaptureBuffer =
NULL;
4339 DPRINT1(
"Failed to tell csrss about new process\n");
4401 lpProcessInformation->hProcess = VdmWaitObject;
4416 lpProcessInformation->hProcess = VdmWaitObject;
4429 lpProcessInformation->hThread = ThreadHandle;
4435 ThreadHandle =
NULL;
4439 if (DebuggerCmdLine)
RtlFreeHeap(RtlGetProcessHeap(), 0, DebuggerCmdLine);
4445 RtlInitEmptyUnicodeString(&SxsWin32ExePath,
NULL, 0);
4446 SxsWin32ExePath.
Length = 0;
4452#if _SXS_SUPPORT_ENABLED_
4461 if (SxsConglomeratedBuffer)
4464 for (
i = 0;
i < 5;
i++)
4467 ThisBuffer = SxsStaticBuffers[
i];
4472 if ((ThisBuffer != (
PVOID)-8) && (ByteBuffer->
Buffer))
4488 RtlInitEmptyUnicodeString(&ThisBuffer->
String,
4509 lpEnvironment =
NULL;
4513 RtlFreeHeap(RtlGetProcessHeap(), 0, QuotedCmdLine);
4520 if (SectionHandle)
NtClose(SectionHandle);
4534 if (JobHandle)
NtClose(JobHandle);
4576 if (VdmWaitObject)
NtClose(VdmWaitObject);
4596 BOOL bInheritHandles,
4597 DWORD dwCreationFlags,
4607 lpProcessAttributes,
4614 lpProcessInformation,
4624 LPCSTR lpApplicationName,
4625 LPSTR lpCommandLine,
4628 BOOL bInheritHandles,
4629 DWORD dwCreationFlags,
4631 LPCSTR lpCurrentDirectory,
4642 DPRINT(
"dwCreationFlags %x, lpEnvironment %p, lpCurrentDirectory %p, "
4643 "lpStartupInfo %p, lpProcessInformation %p\n",
4644 dwCreationFlags, lpEnvironment, lpCurrentDirectory,
4645 lpStartupInfo, lpProcessInformation);
4648 RtlMoveMemory(&StartupInfo, lpStartupInfo,
sizeof(*lpStartupInfo));
4666 if (lpApplicationName)
4671 if (lpCurrentDirectory)
4674 lpCurrentDirectory);
4698 lpProcessAttributes,
4705 lpProcessInformation,
4742 LPSTR lpCommandLine,
4745 BOOL bInheritHandles,
4746 DWORD dwCreationFlags,
4748 LPCSTR lpCurrentDirectory,
4756 lpProcessAttributes,
4763 lpProcessInformation,
4794 &ProcessInformation))
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
static IN ULONG IN PWSTR OUT PCWSTR OUT PBOOLEAN OUT PATH_TYPE_AND_UNKNOWN * PathType
#define DECLSPEC_HOTPATCH
NTSTATUS WINAPI BasepCheckBadapp(IN HANDLE FileHandle, IN PWCHAR ApplicationName, IN PWCHAR Environment, IN USHORT ExeType, IN PVOID *SdbQueryAppCompatData, IN PULONG SdbQueryAppCompatDataSize, IN PVOID *SxsData, IN PULONG SxsDataSize, OUT PULONG FusionFlags)
VOID WINAPI BasepFreeAppCompatData(IN PVOID AppCompatData, IN PVOID AppCompatSxsData)
#define FILE_NON_DIRECTORY_FILE
WCHAR CurrentDirectory[1024]
@ BasepGetProcessShutdownParam
@ BasepSetProcessShutdownParam
#define BASESRV_SERVERDLL_INDEX
#define UlongToHandle(ul)
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
SIZE_T LPPROCESS_INFORMATION
#define CSR_CREATE_API_NUMBER(ServerId, ApiId)
static TAGREF LPCWSTR LPDWORD LPVOID lpBuffer
NTSTATUS NTAPI DbgUiConnectToDbg(VOID)
HANDLE NTAPI DbgUiGetThreadDebugObject(VOID)
#define ERROR_NOT_ENOUGH_MEMORY
#define NT_SUCCESS(StatCode)
NTSYSAPI NTSTATUS NTAPI RtlComputeImportTableHash(IN HANDLE FileHandle, OUT PCHAR Hash, IN ULONG ImportTableHashSize)
static const WCHAR Title[]
#define ReadProcessMemory(a, b, c, d, e)
#define ERROR_INVALID_PARAMETER
#define GetProcAddress(x, y)
#define INVALID_HANDLE_VALUE
@ ThreadQuerySetWin32StartAddress
#define GetCurrentProcess()
#define ERROR_INVALID_HANDLE
#define FILE_ATTRIBUTE_NORMAL
#define ERROR_ACCESS_DENIED
PBASE_STATIC_SERVER_DATA BaseStaticServerData
BOOLEAN BaseRunningInServerProcess
LONG WINAPI UnhandledExceptionFilter(IN PEXCEPTION_POINTERS ExceptionInfo)
BOOL NTAPI IsBadWritePtr(IN LPVOID lp, IN UINT_PTR ucb)
DWORD WINAPI GetFileAttributesW(LPCWSTR lpFileName)
LPWSTR WINAPI BaseComputeProcessDllPath(IN LPWSTR FullPath, IN PVOID Environment)
LPWSTR WINAPI BaseComputeProcessExePath(IN LPWSTR FullPath)
DWORD WINAPI SearchPathW(IN LPCWSTR lpPath OPTIONAL, IN LPCWSTR lpFileName, IN LPCWSTR lpExtension OPTIONAL, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart OPTIONAL)
UINT WINAPI GetSystemDirectoryW(OUT LPWSTR lpBuffer, IN UINT uSize)
DWORD WINAPI GetFullPathNameW(IN LPCWSTR lpFileName, IN DWORD nBufferLength, OUT LPWSTR lpBuffer, OUT LPWSTR *lpFilePart)
BOOL NTAPI WriteProcessMemory(IN HANDLE hProcess, IN LPVOID lpBaseAddress, IN LPCVOID lpBuffer, IN SIZE_T nSize, OUT SIZE_T *lpNumberOfBytesWritten)
VOID WINAPI FatalAppExitA(UINT uAction, LPCSTR lpMessageText)
VOID WINAPI FatalExit(IN int ExitCode)
BOOL WINAPI CreateProcessInternalA(HANDLE hToken, LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, PHANDLE hNewToken)
BOOLEAN WINAPI BasePushProcessParameters(IN ULONG ParameterFlags, IN HANDLE ProcessHandle, IN PPEB RemotePeb, IN LPCWSTR ApplicationPathName, IN LPWSTR lpCurrentDirectory, IN LPWSTR lpCommandLine, IN LPVOID lpEnvironment, IN LPSTARTUPINFOW StartupInfo, IN DWORD CreationFlags, IN BOOL InheritHandles, IN ULONG ImageSubsystem, IN PVOID AppCompatData, IN ULONG AppCompatDataSize)
NTSTATUS NTAPI BasepConfigureAppCertDlls(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
BOOL WINAPI CreateProcessInternalW(IN HANDLE hUserToken, IN LPCWSTR lpApplicationName, IN LPWSTR lpCommandLine, IN LPSECURITY_ATTRIBUTES lpProcessAttributes, IN LPSECURITY_ATTRIBUTES lpThreadAttributes, IN BOOL bInheritHandles, IN DWORD dwCreationFlags, IN LPVOID lpEnvironment, IN LPCWSTR lpCurrentDirectory, IN LPSTARTUPINFOW lpStartupInfo, IN LPPROCESS_INFORMATION lpProcessInformation, OUT PHANDLE hNewToken)
BOOL WINAPI FlushInstructionCache(IN HANDLE hProcess, IN LPCVOID lpBaseAddress, IN SIZE_T nSize)
BOOL WINAPI GetProcessWorkingSetSizeEx(IN HANDLE hProcess, OUT PSIZE_T lpMinimumWorkingSetSize, OUT PSIZE_T lpMaximumWorkingSetSize, OUT PDWORD Flags)
NTSTATUS WINAPI BasepCheckWebBladeHashes(IN HANDLE FileHandle)
PBASEP_APPCERT_EMBEDDED_FUNC fEmbeddedCertFunc
BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
BOOL WINAPI GetExitCodeProcess(IN HANDLE hProcess, IN LPDWORD lpExitCode)
RTL_QUERY_REGISTRY_TABLE BasepAppCertTable[2]
UNICODE_STRING BasePathVariableName
VOID WINAPI ExitProcess(IN UINT uExitCode)
VOID WINAPI StuffStdHandle(IN HANDLE ProcessHandle, IN HANDLE StandardHandle, IN PHANDLE Address)
RTL_CRITICAL_SECTION gcsAppCert
BOOLEAN WINAPI BuildSubSysCommandLine(IN LPCWSTR SubsystemName, IN LPCWSTR ApplicationName, IN LPCWSTR CommandLine, OUT PUNICODE_STRING SubsysCommandLine)
DWORD WINAPI GetProcessVersion(IN DWORD ProcessId)
LIST_ENTRY BasepAppCertDllsList
UNICODE_STRING BaseUnicodeCommandLine
WaitForInputIdleType UserWaitForInputIdleRoutine
BOOLEAN g_AppCertInitialized
BOOL WINAPI DECLSPEC_HOTPATCH CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
BOOL WINAPI TerminateProcess(IN HANDLE hProcess, IN UINT uExitCode)
NTSTATUS WINAPI BasepIsProcessAllowed(IN LPWSTR ApplicationName)
ANSI_STRING BaseAnsiCommandLine
#define AddToHandle(x, y)
HANDLE WINAPI OpenProcess(IN DWORD dwDesiredAccess, IN BOOL bInheritHandle, IN DWORD dwProcessId)
BOOL WINAPI GetProcessPriorityBoost(IN HANDLE hProcess, OUT PBOOL pDisablePriorityBoost)
BOOL WINAPI GetProcessTimes(IN HANDLE hProcess, IN LPFILETIME lpCreationTime, IN LPFILETIME lpExitTime, IN LPFILETIME lpKernelTime, IN LPFILETIME lpUserTime)
PLDR_DATA_TABLE_ENTRY BasepExeLdrEntry
BOOL WINAPI SetProcessWorkingSetSizeEx(IN HANDLE hProcess, IN SIZE_T dwMinimumWorkingSetSize, IN SIZE_T dwMaximumWorkingSetSize, IN DWORD Flags)
NTSTATUS WINAPI BasepReplaceProcessThreadTokens(IN HANDLE TokenHandle, IN HANDLE ProcessHandle, IN HANDLE ThreadHandle)
BOOL WINAPI SetProcessWorkingSetSize(IN HANDLE hProcess, IN SIZE_T dwMinimumWorkingSetSize, IN SIZE_T dwMaximumWorkingSetSize)
BOOL WINAPI GetProcessHandleCount(IN HANDLE hProcess, OUT PDWORD pdwHandleCount)
BOOL WINAPI SetProcessShutdownParameters(IN DWORD dwLevel, IN DWORD dwFlags)
BOOL WINAPI ProcessIdToSessionId(IN DWORD dwProcessId, OUT PDWORD pSessionId)
VOID WINAPI RegisterWaitForInputIdle(WaitForInputIdleType lpfnRegisterWaitForInputIdle)
DWORD WINAPI GetPriorityClass(IN HANDLE hProcess)
DECLSPEC_NORETURN VOID WINAPI BaseProcessStartup(_In_ PPROCESS_START_ROUTINE lpStartAddress)
LPSTR WINAPI GetCommandLineA(VOID)
BOOL WINAPI GetProcessIoCounters(IN HANDLE hProcess, OUT PIO_COUNTERS lpIoCounters)
LPWSTR WINAPI GetCommandLineW(VOID)
VOID WINAPI FatalAppExitW(IN UINT uAction, IN LPCWSTR lpMessageText)
BOOL WINAPI SetProcessPriorityBoost(IN HANDLE hProcess, IN BOOL bDisablePriorityBoost)
VOID WINAPI InitCommandLines(VOID)
BOOL WINAPI GetProcessWorkingSetSize(IN HANDLE hProcess, OUT PSIZE_T lpMinimumWorkingSetSize, OUT PSIZE_T lpMaximumWorkingSetSize)
PSAFER_REPLACE_PROCESS_THREAD_TOKENS g_SaferReplaceProcessThreadTokens
BOOL WINAPI SetPriorityClass(IN HANDLE hProcess, IN DWORD dwPriorityClass)
VOID WINAPI GetStartupInfoW(IN LPSTARTUPINFOW lpStartupInfo)
BOOL WINAPI GetProcessShutdownParameters(OUT LPDWORD lpdwLevel, OUT LPDWORD lpdwFlags)
VOID WINAPI BasepSxsCloseHandles(IN PBASE_MSG_SXS_HANDLES Handles)
#define RemoveFromHandle(x, y)
BOOL WINAPI SetProcessAffinityMask(IN HANDLE hProcess, IN DWORD_PTR dwProcessAffinityMask)
BOOLEAN WINAPI BasepIsImageVersionOk(IN ULONG ImageMajorVersion, IN ULONG ImageMinorVersion)
VOID WINAPI GetStartupInfoA(IN LPSTARTUPINFOA lpStartupInfo)
LPSTARTUPINFOA BaseAnsiStartupInfo
NTSTATUS NTAPI BasepSaveAppCertRegistryValue(IN PLIST_ENTRY List, IN PWCHAR ComponentName, IN PWCHAR DllName)
UINT WINAPI DECLSPEC_HOTPATCH WinExec(LPCSTR lpCmdLine, UINT uCmdShow)
BOOL WINAPI GetProcessAffinityMask(IN HANDLE hProcess, OUT PDWORD_PTR lpProcessAffinityMask, OUT PDWORD_PTR lpSystemAffinityMask)
VOID WINAPI ExitThread(IN DWORD uExitCode)
NTSTATUS WINAPI BaseCreateStack(_In_ HANDLE hProcess, _In_opt_ SIZE_T StackCommit, _In_opt_ SIZE_T StackReserve, _Out_ PINITIAL_TEB InitialTeb)
BOOLEAN WINAPI Basep8BitStringToDynamicUnicodeString(OUT PUNICODE_STRING UnicodeString, IN LPCSTR String)
VOID WINAPI BaseInitializeContext(IN PCONTEXT Context, IN PVOID Parameter, IN PVOID StartAddress, IN PVOID StackAddress, IN ULONG ContextType)
POBJECT_ATTRIBUTES WINAPI BaseFormatObjectAttributes(OUT POBJECT_ATTRIBUTES ObjectAttributes, IN PSECURITY_ATTRIBUTES SecurityAttributes OPTIONAL, IN PUNICODE_STRING ObjectName)
VOID WINAPI BasepAnsiStringToHeapUnicodeString(IN LPCSTR AnsiString, OUT LPWSTR *UnicodeString)
NTSTATUS WINAPI BasepCheckWinSaferRestrictions(IN HANDLE UserToken, IN LPWSTR ApplicationName, IN HANDLE FileHandle, OUT PBOOLEAN InJob, OUT PHANDLE NewToken, OUT PHANDLE JobHandle)
PVOID WINAPI BasepIsRealtimeAllowed(IN BOOLEAN Keep)
ULONG WINAPI BaseIsDosApplication(IN PUNICODE_STRING PathName, IN NTSTATUS Status)
BOOL NTAPI BaseDestroyVDMEnvironment(IN PANSI_STRING AnsiEnv, IN PUNICODE_STRING UnicodeEnv)
BOOL WINAPI BaseGetVdmConfigInfo(IN LPCWSTR CommandLineReserved, IN ULONG DosSeqId, IN ULONG BinaryType, IN PUNICODE_STRING CmdLineString, OUT PULONG VdmSize)
BOOL WINAPI BaseCheckForVDM(IN HANDLE ProcessHandle, OUT LPDWORD ExitCode)
BOOL WINAPI BaseUpdateVDMEntry(IN ULONG UpdateIndex, IN OUT PHANDLE WaitHandle, IN ULONG IndexInfo, IN ULONG BinaryType)
BOOL NTAPI BaseCreateVDMEnvironment(IN PWCHAR lpEnvironment, OUT PANSI_STRING AnsiEnv, OUT PUNICODE_STRING UnicodeEnv)
NTSTATUS WINAPI BaseCheckVDM(IN ULONG BinaryType, IN PCWCH ApplicationName, IN PCWCH CommandLine, IN PCWCH CurrentDirectory, IN PANSI_STRING AnsiEnvironment, IN PBASE_API_MESSAGE ApiMessage, IN OUT PULONG iTask, IN DWORD CreationFlags, IN LPSTARTUPINFOW StartupInfo, IN HANDLE hUserToken OPTIONAL)
#define HANDLE_CREATE_NEW_CONSOLE
#define HANDLE_CREATE_NO_WINDOW
#define HANDLE_DETACHED_PROCESS
static int Hash(const char *)
#define IsListEmpty(ListHead)
NTSTATUS RtlAppendUnicodeToString(IN PUNICODE_STRING Str1, IN PWSTR Str2)
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
_Must_inspect_result_ _In_opt_ PFLT_INSTANCE _Out_ PHANDLE FileHandle
#define FILE_SYNCHRONOUS_IO_NONALERT
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
NTSTATUS NTAPI NtRaiseHardError(IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, IN PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response)
_In_ GUID _In_ PVOID ValueData
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define PROCESS_CREATE_FLAGS_BREAKAWAY
#define PROCESS_QUERY_INFORMATION
#define PROCESS_PRIORITY_CLASS_IDLE
#define PROCESS_CREATE_FLAGS_INHERIT_HANDLES
#define PROCESS_PRIORITY_CLASS_INVALID
#define PROCESS_PRIORITY_CLASS_NORMAL
#define PROCESS_PRIORITY_CLASS_HIGH
#define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL
#define PROCESS_CREATE_FLAGS_LARGE_PAGES
#define PROCESS_PRIORITY_CLASS_BELOW_NORMAL
#define PROCESS_PRIORITY_CLASS_REALTIME
#define PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT
#define OBJ_CASE_INSENSITIVE
@ ProcessBasicInformation
@ ProcessWow64Information
NTSYSAPI void WINAPI RtlReleasePebLock(void)
NTSYSAPI void WINAPI RtlAcquirePebLock(void)
NTSYSAPI void WINAPI DbgBreakPoint(void)
NTSYSAPI void WINAPI LdrShutdownProcess(void)
NTSYSAPI NTSTATUS WINAPI RtlQueryRegistryValues(ULONG, PCWSTR, PRTL_QUERY_REGISTRY_TABLE, PVOID, PVOID)
@ ProcessSessionInformation
@ ProcessDefaultHardErrorMode
#define InterlockedCompareExchangePointer
NTSTATUS(NTAPI * PSAFER_REPLACE_PROCESS_THREAD_TOKENS)(IN HANDLE Token, IN HANDLE Process, IN HANDLE Thread)
#define STARTF_SHELLPRIVATE
DWORD(* WaitForInputIdleType)(HANDLE hProcess, DWORD dwMilliseconds)
NTSTATUS(NTAPI * PBASEP_APPCERT_EMBEDDED_FUNC)(IN LPWSTR ApplicationName)
DWORD(WINAPI * PPROCESS_START_ROUTINE)(VOID)
NTSTATUS NTAPI LdrUnloadDll(_In_ PVOID BaseAddress)
NTSTATUS NTAPI LdrGetProcedureAddress(_In_ PVOID BaseAddress, _In_opt_ _When_(Ordinal==0, _Notnull_) PANSI_STRING Name, _In_opt_ _When_(Name==NULL, _In_range_(>, 0)) ULONG Ordinal, _Out_ PVOID *ProcedureAddress)
NTSTATUS NTAPI LdrQueryImageFileKeyOption(_In_ HANDLE KeyHandle, _In_ PCWSTR ValueName, _In_ ULONG Type, _Out_ PVOID Buffer, _In_ ULONG BufferSize, _Out_opt_ PULONG ReturnedLength)
NTSTATUS NTAPI LdrOpenImageFileOptionsKey(_In_ PUNICODE_STRING SubKey, _In_ BOOLEAN Wow64, _Out_ PHANDLE NewKeyHandle)
_In_ BOOL _In_ HANDLE hProcess
PVOID PVOID PWCHAR PVOID USHORT PULONG PVOID PULONG PVOID PULONG PULONG FusionFlags
PVOID PVOID PWCHAR ApplicationName
#define SE_INC_BASE_PRIORITY_PRIVILEGE
#define SE_LOCK_MEMORY_PRIVILEGE
static const char const char * DllPath
static const char * ImageName
static OUT PIO_STATUS_BLOCK IoStatusBlock
static BOOL bInheritHandle
#define InitializeObjectAttributes(p, n, a, r, s)
_In_ NDIS_ERROR_CODE ErrorCode
_Must_inspect_result_ _Out_ PNDIS_STATUS _In_ NDIS_HANDLE _In_ ULONG _Out_ PNDIS_STRING _Out_ PNDIS_HANDLE KeyHandle
#define HARDERROR_OVERRIDE_ERRORMODE
#define PROCESSOR_ARCHITECTURE_IA64
#define PROCESSOR_ARCHITECTURE_UNKNOWN
#define PROCESSOR_ARCHITECTURE_AMD64
#define PROCESSOR_ARCHITECTURE_INTEL
_In_ HANDLE ProcessHandle
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
__kernel_entry _Inout_ _Inout_ PSIZE_T RegionSize
@ SectionImageInformation
#define DUPLICATE_SAME_ATTRIBUTES
_In_ ACCESS_MASK _In_ ULONG _Out_ PHANDLE TokenHandle
NTSYSAPI NTSTATUS NTAPI RtlDestroyProcessParameters(_In_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters)
NTSYSAPI NTSTATUS NTAPI RtlCreateProcessParameters(_Out_ PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, _In_ PUNICODE_STRING ImagePathName, _In_opt_ PUNICODE_STRING DllPath, _In_opt_ PUNICODE_STRING CurrentDirectory, _In_opt_ PUNICODE_STRING CommandLine, _In_opt_ PWSTR Environment, _In_opt_ PUNICODE_STRING WindowTitle, _In_opt_ PUNICODE_STRING DesktopInfo, _In_opt_ PUNICODE_STRING ShellInfo, _In_opt_ PUNICODE_STRING RuntimeInfo)
NTSYSAPI ULONG NTAPI RtlIsDosDeviceName_U(_In_ PCWSTR Name)
NTSYSAPI NTSTATUS NTAPI RtlAcquirePrivilege(_In_ PULONG Privilege, _In_ ULONG NumPriv, _In_ ULONG Flags, _Out_ PVOID *ReturnedState)
_In_ PCWSTR _Inout_ _At_ QueryTable EntryContext
NTSTATUS NTAPI RtlGetFullPathName_UstrEx(_In_ PUNICODE_STRING FileName, _In_opt_ PUNICODE_STRING StaticString, _In_opt_ PUNICODE_STRING DynamicString, _Out_opt_ PUNICODE_STRING *StringUsed, _Out_opt_ PSIZE_T FilePartSize, _Out_opt_ PBOOLEAN NameInvalid, _Out_ RTL_PATH_TYPE *PathType, _Out_opt_ PSIZE_T LengthNeeded)
VOID NTAPI RtlReleaseRelativeName(_In_ PRTL_RELATIVE_NAME_U RelativeName)
NTSYSAPI VOID NTAPI RtlDestroyEnvironment(_In_ PWSTR Environment)
NTSYSAPI RTL_PATH_TYPE NTAPI RtlDetermineDosPathNameType_U(_In_ PCWSTR Path)
NTSYSAPI VOID NTAPI RtlReleasePrivilege(_In_ PVOID ReturnedState)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
NTSYSAPI ULONG NTAPI DbgPrompt(_In_z_ PCCH Prompt, _Out_writes_bytes_(MaximumResponseLength) PCH Response, _In_ ULONG MaximumResponseLength)
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToRelativeNtPathName_U(_In_ PCWSTR DosName, _Out_ PUNICODE_STRING NtName, _Out_ PCWSTR *PartName, _Out_ PRTL_RELATIVE_NAME_U RelativeName)
#define RTL_USER_PROCESS_PARAMETERS_IMAGE_KEY_MISSING
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_KERNEL
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_SERVER
#define SEM_FAILCRITICALERRORS
#define RTL_USER_PROCESS_PARAMETERS_LOCAL_DLL_PATH
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER
@ RtlPathTypeRootLocalDevice
@ RtlPathTypeDriveAbsolute
enum _RTL_PATH_TYPE RTL_PATH_TYPE
#define RTL_USER_PROCESS_PARAMETERS_DISABLE_HEAP_CHECKS
#define THREAD_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
#define RTL_REGISTRY_CONTROL
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI NTSTATUS NTAPI NtOpenKey(OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI VOID NTAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define SECTION_ALL_ACCESS
#define FILE_READ_ATTRIBUTES
#define PROCESS_ALL_ACCESS
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSTATUS NTAPI NtTerminateProcess(HANDLE ProcessHandle, LONG ExitStatus)
#define NtCurrentProcess()
#define FILE_SHARE_DELETE
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
#define PAGE_EXECUTE_WRITECOPY
#define FILE_ATTRIBUTE_DIRECTORY
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
NTSYSAPI NTSTATUS NTAPI NtCreateThread(OUT PHANDLE phThread, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE hProcess, OUT PCLIENT_ID pClientId, IN PCONTEXT pContext, OUT PSTACKINFO pStackInfo, IN BOOLEAN bSuspended)
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
#define PAGE_EXECUTE_READWRITE
#define DECLSPEC_ALIGN(x)
#define UNICODE_STRING_MAX_CHARS
#define UNICODE_STRING_MAX_BYTES
#define VER_SUITE_DATACENTER
#define DECLSPEC_NORETURN
#define VER_SUITE_STORAGE_SERVER
#define VER_SUITE_COMPUTE_SERVER
#define VER_SUITE_PERSONAL
#define VER_SUITE_EMBEDDEDNT
_In_ ULONG _In_ ULONG _In_ ULONG Length
#define RTL_CONSTANT_OBJECT_ATTRIBUTES(n, a)
#define IMAGE_SUBSYSTEM_POSIX_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_CUI
#define IMAGE_SUBSYSTEM_WINDOWS_GUI
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
#define IMAGE_FILE_MACHINE_AMD64
#define IMAGE_FILE_MACHINE_IA64
NTSTATUS NTAPI NtFreeVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *UBaseAddress, IN PSIZE_T URegionSize, IN ULONG FreeType)
NTSTATUS NTAPI NtWriteVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN SIZE_T NumberOfBytesToWrite, OUT PSIZE_T NumberOfBytesWritten OPTIONAL)
NTSTATUS NTAPI NtProtectVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UnsafeBaseAddress, IN OUT SIZE_T *UnsafeNumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG UnsafeOldAccessProtection)
NTSTATUS NTAPI NtReadVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OUT PSIZE_T NumberOfBytesRead OPTIONAL)
NTSTATUS NTAPI NtAllocateVirtualMemory(IN HANDLE ProcessHandle, IN OUT PVOID *UBaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T URegionSize, IN ULONG AllocationType, IN ULONG Protect)
NTSTATUS NTAPI NtFlushInstructionCache(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, _In_ SIZE_T FlushSize)
NTSTATUS NTAPI NtIsProcessInJob(IN HANDLE ProcessHandle, IN HANDLE JobHandle OPTIONAL)
NTSTATUS NTAPI NtAssignProcessToJobObject(HANDLE JobHandle, HANDLE ProcessHandle)
NTSTATUS NTAPI NtCreateProcessEx(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN ULONG Flags, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN BOOLEAN InJob)
NTSTATUS NTAPI NtOpenProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI NtSetInformationThread(IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength)
NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
NTSTATUS NTAPI NtResumeThread(IN HANDLE ThreadHandle, OUT PULONG SuspendCount OPTIONAL)
#define STATUS_INVALID_IMAGE_WIN_64
#define STATUS_INVALID_IMAGE_WIN_16
#define STATUS_INVALID_IMAGE_NE_FORMAT
#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE
#define STATUS_INVALID_IMAGE_FORMAT
#define STATUS_FATAL_APP_EXIT
#define STATUS_INVALID_IMAGE_NOT_MZ
#define STATUS_INVALID_IMAGE_PROTECT
#define STATUS_VDM_DISALLOWED
#define STATUS_ENTRYPOINT_NOT_FOUND
#define STATUS_ACCESS_VIOLATION
#define STATUS_NOT_IMPLEMENTED
#define STATUS_FILE_IS_OFFLINE
#define STATUS_NAME_TOO_LONG
NTSTATUS NTAPI NtDuplicateObject(IN HANDLE SourceProcessHandle, IN HANDLE SourceHandle, IN HANDLE TargetProcessHandle OPTIONAL, OUT PHANDLE TargetHandle OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Options)
#define IMAGE_FILE_MACHINE_I386
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_GetExceptionInformation()
#define _SEH2_YIELD(__stmt)
DWORD BaseSetLastNTError(IN NTSTATUS Status)
_CRTIMP wchar_t *__cdecl wcscpy(_Out_writes_z_(_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_CRTIMP wchar_t *__cdecl wcscat(_Inout_updates_z_(_String_length_(_Dest)+_String_length_(_Source)+1) wchar_t *_Dest, _In_z_ const wchar_t *_Source)
_Check_return_ _CRTIMP int __cdecl _wcsnicmp(_In_reads_or_z_(_MaxCount) const wchar_t *_Str1, _In_reads_or_z_(_MaxCount) const wchar_t *_Str2, _In_ size_t _MaxCount)
VOID NTAPI CsrFreeCaptureBuffer(_In_ _Frees_ptr_ PCSR_CAPTURE_BUFFER CaptureBuffer)
NTSTATUS NTAPI CsrClientCallServer(_Inout_ PCSR_API_MESSAGE ApiMessage, _Inout_opt_ PCSR_CAPTURE_BUFFER CaptureBuffer, _In_ CSR_API_NUMBER ApiNumber, _In_ ULONG DataLength)
#define IsConsoleHandle(h)
#define VDM_UNDO_COMPLETED
#define BINARY_TYPE_WOW_EX
#define BINARY_TYPE_SEPARATE_WOW
NTSTATUS NTAPI NtQuerySection(_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T SectionInformationLength, _Out_opt_ PSIZE_T ResultLength)
base of all file and directory entries
BASE_CREATE_PROCESS CreateProcessRequest
BASE_EXIT_PROCESS ExitProcessRequest
BASE_GETSET_PROCESS_SHUTDOWN_PARAMS ShutdownParametersRequest
union _BASE_API_MESSAGE::@3533 Data
BASE_CHECK_VDM CheckVDMRequest
HANDLE WaitObjectForParent
BASE_SXS_CREATEPROCESS_MSG Sxs
USHORT ProcessorArchitecture
BOOLEAN DefaultSeparateVDM
SYSTEM_BASIC_INFORMATION SysInfo
struct _LIST_ENTRY * Flink
PVOID ArbitraryUserPointer
BOOLEAN ReadImageFileExecOptions
PRTL_USER_PROCESS_PARAMETERS ProcessParameters
ULONG ImageSubsystemMajorVersion
SIZE_T MaximumWorkingSetSize
SIZE_T MinimumWorkingSetSize
UNICODE_STRING RelativeName
HANDLE ContainingDirectory
UNICODE_STRING DesktopInfo
LPVOID lpSecurityDescriptor
#define RTL_CONSTANT_STRING(s)
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define RtlMoveMemory(Destination, Source, Length)
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define STATUS_UNSUCCESSFUL
#define STATUS_OBJECT_NAME_NOT_FOUND
struct _LARGE_INTEGER::@2290 u
BOOL Privilege(LPTSTR pszPrivilege, BOOL bEnable)
#define INVALID_FILE_ATTRIBUTES
static int Shell(const char **args)
_Must_inspect_result_ _In_ WDFDEVICE _In_ ULONG _In_ ACCESS_MASK _In_opt_ PWDF_OBJECT_ATTRIBUTES KeyAttributes
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ LPCGUID _Out_ PINTERFACE _In_ USHORT _In_ USHORT Version
_In_ WDFIOTARGET _In_ _Strict_type_match_ WDF_IO_TARGET_SENT_IO_ACTION Action
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG _Out_opt_ PULONG _Out_opt_ PULONG ValueType
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING ValueName
_Must_inspect_result_ _In_ WDFKEY _In_ PCUNICODE_STRING _In_ ULONG ValueLength
_In_ WDFREQUEST _In_ NTSTATUS _In_ CCHAR PriorityBoost
_In_ WDFIOTARGET _In_ PWDF_REQUEST_COMPLETION_PARAMS Params
_Must_inspect_result_ _In_ WDFCMRESLIST List
#define NORMAL_PRIORITY_CLASS
struct _STARTUPINFOA STARTUPINFOA
#define STARTF_FORCEOFFFEEDBACK
DWORD WINAPI GetLastError(void)
HANDLE WINAPI GetCurrentThread(void)
#define REALTIME_PRIORITY_CLASS
#define BELOW_NORMAL_PRIORITY_CLASS
#define CREATE_UNICODE_ENVIRONMENT
#define HIGH_PRIORITY_CLASS
DWORD WINAPI GetCurrentProcessId(void)
#define CREATE_SHARED_WOW_VDM
#define CREATE_DEFAULT_ERROR_MODE
#define CREATE_SEPARATE_WOW_VDM
#define CREATE_NEW_PROCESS_GROUP
#define DEBUG_ONLY_THIS_PROCESS
#define STARTF_USESTDHANDLES
#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL
#define IDLE_PRIORITY_CLASS
#define STARTF_FORCEONFEEDBACK
#define CREATE_NEW_CONSOLE
*nSize LPSTR _Inout_ LPDWORD nSize
struct _STARTUPINFOW STARTUPINFOW
#define ABOVE_NORMAL_PRIORITY_CLASS
_In_ PCCERT_CONTEXT _In_ DWORD dwFlags
_Inout_ PERBANDINFO * pbi
#define ERROR_PATH_NOT_FOUND
#define ERROR_BAD_EXE_FORMAT
#define ERROR_CHILD_NOT_COMPLETE
#define ERROR_ACCESS_DISABLED_BY_POLICY
#define ERROR_EXE_MACHINE_TYPE_MISMATCH
#define ERROR_ACCESS_DISABLED_WEBBLADE_TAMPER
#define ERROR_ACCESS_DISABLED_WEBBLADE
#define ERROR_FILE_OFFLINE
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
_Must_inspect_result_ _In_ ULONG Flags
_Out_ PCLIENT_ID ClientId
#define DUPLICATE_SAME_ACCESS
#define NtCurrentThread()