进程创建过程详解 CreateProcess

转载请您注明出处:http://www.cnblogs.com/lsh123/p/7405796.html

0x01 CreateProcessW

  CreateProcess的使用有ANSI版本的CreateProcessA和UNICODE版本的CreateProcessW:

  不过查看源码就可以发现其实CreateProcessA内部调用的还是CreateProcessW:

BOOL
WINAPI
CreateProcessA(
    LPCSTR lpApplicationName,
    LPSTR lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL bInheritHandles,
    DWORD dwCreationFlags,
    LPVOID lpEnvironment,
    LPCSTR lpCurrentDirectory,
    LPSTARTUPINFOA lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    )

/*++

    ANSI thunk to CreateProcessW

--*/

{
    NTSTATUS Status;
    PUNICODE_STRING CommandLine;
    UNICODE_STRING ApplicationName;
    UNICODE_STRING CurrentDirectory;
    STARTUPINFOW StartupInfo;
    ANSI_STRING AnsiString;
    UNICODE_STRING Unicode;
    UNICODE_STRING DynamicCommandLine;
    UNICODE_STRING NullUnicodeString;
    BOOL ReturnStatus;

    if (ARGUMENT_PRESENT (lpCommandLine)) {
        if ( (strlen( lpCommandLine ) + 1) * sizeof( WCHAR ) <
             NtCurrentTeb()->StaticUnicodeString.MaximumLength ) {

            DynamicCommandLine.Buffer = NULL;

            CommandLine = Basep8BitStringToStaticUnicodeString( lpCommandLine );
            if (CommandLine == NULL) {
                return FALSE;
            }
        } else {
            if (!Basep8BitStringToDynamicUnicodeString( &DynamicCommandLine,
                                                        lpCommandLine )) {
                return FALSE;
            }
        }
    } else {
         DynamicCommandLine.Buffer = NULL;
         CommandLine = &NullUnicodeString;
         CommandLine->Buffer = NULL;
    }

    ApplicationName.Buffer = NULL;
    ApplicationName.Buffer = NULL;
    CurrentDirectory.Buffer = NULL;
    RtlMoveMemory(&StartupInfo,lpStartupInfo,sizeof(*lpStartupInfo));
    ASSERT(sizeof(StartupInfo) == sizeof(*lpStartupInfo));
    StartupInfo.lpReserved = NULL;
    StartupInfo.lpDesktop = NULL;
    StartupInfo.lpTitle = NULL;

    try {
        try {
            if (ARGUMENT_PRESENT(lpApplicationName)) {

                if (!Basep8BitStringToDynamicUnicodeString( &ApplicationName,
                                                            lpApplicationName )) {
                    ReturnStatus = FALSE;
                    goto tryexit;
                }
            }

            if (ARGUMENT_PRESENT(lpCurrentDirectory)) {
                if (!Basep8BitStringToDynamicUnicodeString( &CurrentDirectory,
                                                            lpCurrentDirectory )) {
                    ReturnStatus = FALSE;
                    goto tryexit;
                }
            }

            if (ARGUMENT_PRESENT(lpStartupInfo->lpReserved)) {

                //
                // Win95 does not touch reserved, and Intergraph Voxtel passes
                // garbage for this. Handle this by probing lpReserved, and if
                // the pointer is bad, ignore it
                //

                try {

                    RtlInitAnsiString(&AnsiString,lpStartupInfo->lpReserved);

                    }
                except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION
                            ? EXCEPTION_EXECUTE_HANDLER
                            : EXCEPTION_CONTINUE_SEARCH) {
                    goto bail_on_reserved;
                    }

                Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ;
                StartupInfo.lpReserved = RtlAllocateHeap( RtlProcessHeap(),
                                                          MAKE_TAG( TMP_TAG ),
                                                          Unicode.MaximumLength);
                if ( !StartupInfo.lpReserved ) {
                    BaseSetLastNTError(STATUS_NO_MEMORY);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                Unicode.Buffer = StartupInfo.lpReserved;
                Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE);
                if ( !NT_SUCCESS(Status) ) {
                    BaseSetLastNTError(Status);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                }

bail_on_reserved:
            if (ARGUMENT_PRESENT(lpStartupInfo->lpDesktop)) {
                RtlInitAnsiString(&AnsiString,lpStartupInfo->lpDesktop);
                Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ;
                StartupInfo.lpDesktop = RtlAllocateHeap( RtlProcessHeap(),
                                                         MAKE_TAG( TMP_TAG ),
                                                         Unicode.MaximumLength);
                if ( !StartupInfo.lpDesktop ) {
                    BaseSetLastNTError(STATUS_NO_MEMORY);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                Unicode.Buffer = StartupInfo.lpDesktop;
                Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE);
                if ( !NT_SUCCESS(Status) ) {
                    BaseSetLastNTError(Status);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                }

            if (ARGUMENT_PRESENT(lpStartupInfo->lpTitle)) {
                RtlInitAnsiString(&AnsiString,lpStartupInfo->lpTitle);
                Unicode.MaximumLength = (USHORT)RtlAnsiStringToUnicodeSize(&AnsiString) ;
                StartupInfo.lpTitle = RtlAllocateHeap( RtlProcessHeap(),
                                                       MAKE_TAG( TMP_TAG ),
                                                       Unicode.MaximumLength);
                if ( !StartupInfo.lpTitle ) {
                    BaseSetLastNTError(STATUS_NO_MEMORY);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                Unicode.Buffer = StartupInfo.lpTitle;
                Status = RtlAnsiStringToUnicodeString(&Unicode,&AnsiString,FALSE);
                if ( !NT_SUCCESS(Status) ) {
                    BaseSetLastNTError(Status);
                    ReturnStatus = FALSE;
                    goto tryexit;
                    }
                }
            }
        except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION
                    ? EXCEPTION_EXECUTE_HANDLER
                    : EXCEPTION_CONTINUE_SEARCH) {
            BaseSetLastNTError(GetExceptionCode());
            ReturnStatus = FALSE;
            goto tryexit;
            }
        ReturnStatus = CreateProcessW(
                            ApplicationName.Buffer,
                            DynamicCommandLine.Buffer ? DynamicCommandLine.Buffer
                                                      : CommandLine->Buffer,
                            lpProcessAttributes,
                            lpThreadAttributes,
                            bInheritHandles,
                            dwCreationFlags,
                            lpEnvironment,
                            CurrentDirectory.Buffer,
                            &StartupInfo,
                            lpProcessInformation
                            );
tryexit:;
        }
    finally {
        RtlFreeUnicodeString(&DynamicCommandLine);
        RtlFreeUnicodeString(&ApplicationName);
        RtlFreeUnicodeString(&CurrentDirectory);
        RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpReserved);
        RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpDesktop);
        RtlFreeHeap(RtlProcessHeap(), 0,StartupInfo.lpTitle);
        }

    return ReturnStatus;

}

  CreateProcessW的十个参数:

WINBASEAPI
BOOL
WINAPI
CreateProcessW(
    LPCWSTR lpApplicationName,    //指向一个NULL结尾的,新进程的可执行文件的名称
    LPWSTR lpCommandLine,          //指向一个NULL结尾的,传给新进程的命令行字符串
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    //指向一个SECURITY_ATTRIBUTES结构体,分配给新的进程对象
    //SECURITY_ATTRIBUTES结构可以决定是否返回的句柄可以被子进程继承(bInheritHandle )。如果lpProcessAttributes参数为空(NULL),那么句柄不能被继承。
    //SECURITY_ATTRIBUTES结构的lpSecurityDescriptor成员可以指定新进程的安全描述符,如果参数为空,新进程使用默认的安全描述符。
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    //指向一个SECURITY_ATTRIBUTES结构体,分配给新的线程对象
    BOOL bInheritHandles,
    //标识新进程是否可以从调用进程处继承所有可继承的句柄。被继承的句柄与原进程拥有完全相同的值和访问权限。
    DWORD dwCreationFlags,
    //标识了影响新进程创建方式的标志,多个标志按位或进行组合
    LPVOID lpEnvironment,
    //指向一块内存,其中包含新进程要使用的环境字符串。如果此参数为空,新进程继承父进程的一组环境字符串。
    LPCWSTR lpCurrentDirectory,
    //指向一个以NULL结尾的字符串,用来设置新进程的当前驱动器和目录,这个字符串必须是一个包含驱动器名的绝对路径。如果这个参数为空,新进程将使用与父进程相同的驱动器和目录。
    LPSTARTUPINFOW lpStartupInfo,
    //指向一个用于决定新进程的主窗体如何显示的STARTUPINFO结构体。
    LPPROCESS_INFORMATION lpProcessInformation
    //指向一个用来接收新进程的识别信息的PROCESS_INFORMATION结构体。 
    );

  (1)STARTUPINFO 和 PROCESS_INFORMATION的使用前初始化为空:

  STARTUPINFO StartupInfo = { 0 };
  StartupInfo.cb = sizeof(STARTUPINFO);
  PROCESS_INFORMATION ProcessInfo = { 0 };

 

  (2)第六参数:dwCreationFlags 的部分标志:

  ⑴值:CREATE_DEFAULT_ERROR_MODE
  含义:新的进程不继承调用进程的错误模式。CreateProcess函数赋予新进程当前的默认错误模式作为替代。应用程序可以调用SetErrorMode函数设置当前的默认错误模式。
  这个标志对于那些运行在没有硬件错误环境下的多线程外壳程序是十分有用的。
  对于CreateProcess函数,默认的行为是为新进程继承调用者的错误模式。设置这个标志以改变默认的处理方式。
 
  ⑵值:CREATE_NEW_CONSOLE
  含义:新的进程将使用一个新的控制台,而不是继承父进程的控制台。这个标志不能与DETACHED_PROCESS标志一起使用。
 
  ⑶值:CREATE_NEW_PROCESS_GROUP
  含义:新进程将是一个进程树的根进程。进程树中的全部进程都是根进程的子进程。新进程树的用户标识符与这个进程的标识符是相同的,由lpProcessInformation参数返回。进程树经常使用GenerateConsoleCtrlEvent函数允许发送CTRL+C或   CTRL+BREAK信号到一组控制台进程。
 
  ⑷值:CREATE_SEPARATE_WOW_VDM
  如果被设置,新进程将会在一个私有的虚拟DOS机(VDM)中运行。另外,默认情况下所有的16位Windows应用程序都会在同一个共享的VDM中以线程的方式运行。单独运行一个16位程序的优点是一个应用程序的崩溃只会结束这一个VDM的运行;其他那些在不同VDM中运行的程序会继续正常的运行。同样的,在不同VDM中运行的16位Windows应用程序拥有不同的输入队列,这意味着如果一个程序暂时失去响应,在独立的VDM中的应用程序能够继续获得输入。
 
  ⑸值:CREATE_SHARED_WOW_VDM
如果WIN.INI中的Windows段的DefaultSeparateVDM选项被设置为真,这个标识使得CreateProcess函数越过这个选项并在共享的虚拟DOS机中运行新进程。
 
  ⑹值:CREATE_SUSPENDED
  含义:新进程的主线程会以挂起的状态被创建,直到调用ResumeThread函数被调用时才运行。
 
  ⑺值:CREATE_UNICODE_ENVIRONMENT
  含义:如果被设置,由lpEnvironment参数指定环境块使用Unicode字符,如果为空,环境块默认使用ANSI字符。
 
  ⑻值:DEBUG_PROCESS
  含义:如果这个标志被设置,调用进程将被当做一个调试程序,并且新进程会被当做被调试的进程。系统把被调试程序发生的所有调试事件通知给调试器。
  如果你使用这个标志创建进程,只有调用进程(调用CreateProcess函数的进程)可以调用WaitForDebugEvent函数。
 
  ⑼值:DEBUG_ONLY_THIS_PROCESS
  含义:如果此标志没有被设置且调用进程正在被调试,新进程将成为调试调用进程的调试器的另一个调试对象。如果调用进程没有被调试,有关调试的行为就不会产生。
 
  ⑽值:DETACHED_PROCESS
  含义:对于控制台进程,新进程没有访问父进程控制台的权限。新进程可以通过AllocConsole函数自己创建一个新的控制台。这个标志不可以与CREATE_NEW_CONSOLE标志一起使用。
 
  〔11〕值:CREATE_NO_WINDOW
  含义:系统不为新进程创建CUI窗口,使用该标志可以创建不含窗口的CUI程序。
 
 
 
 
 
 
 
 
 
 
0x02  创建进程详细步骤1:打开目标映像文件,创建进程对象,线程对象
    
   CreateProcessW源代码(windows2000)
   
   1 BOOL
   2 WINAPI
   3 CreateProcessW(
   4     LPCWSTR lpApplicationName,
   5     LPWSTR lpCommandLine,
   6     LPSECURITY_ATTRIBUTES lpProcessAttributes,
   7     LPSECURITY_ATTRIBUTES lpThreadAttributes,
   8     BOOL bInheritHandles,
   9     DWORD dwCreationFlags,
  10     LPVOID lpEnvironment,
  11     LPCWSTR lpCurrentDirectory,
  12     LPSTARTUPINFOW lpStartupInfo,
  13     LPPROCESS_INFORMATION lpProcessInformation
  14     )
  15 
  16 {
  17     NTSTATUS Status;
  18     OBJECT_ATTRIBUTES Obja;
  19     POBJECT_ATTRIBUTES pObja;
  20     HANDLE ProcessHandle, ThreadHandle, VdmWaitHandle = NULL;
  21     HANDLE FileHandle, SectionHandle;
  22     CLIENT_ID ClientId;
  23     UNICODE_STRING PathName;
  24     IO_STATUS_BLOCK IoStatusBlock;
  25     BOOLEAN TranslationStatus;
  26     RTL_RELATIVE_NAME RelativeName;
  27     PVOID FreeBuffer;
  28     LPWSTR NameBuffer;
  29     LPWSTR WhiteScan;
  30     ULONG Length,i;
  31     PROCESS_BASIC_INFORMATION ProcessInfo;
  32     SECTION_IMAGE_INFORMATION ImageInformation;
  33     NTSTATUS StackStatus;
  34     BOOLEAN bStatus;
  35     INITIAL_TEB InitialTeb;
  36     CONTEXT ThreadContext;
  37     PPEB Peb;
  38     BASE_API_MSG m;
  39     PBASE_CREATEPROCESS_MSG a= (PBASE_CREATEPROCESS_MSG)&m.u.CreateProcess;
  40     PBASE_CHECKVDM_MSG b= (PBASE_CHECKVDM_MSG)&m.u.CheckVDM;
  41     PWCH TempNull = NULL;
  42     WCHAR TempChar;
  43     UNICODE_STRING VdmNameString;
  44     PVOID BaseAddress;
  45     ULONG VdmReserve;
  46     SIZE_T BigVdmReserve;
  47     ULONG iTask=0;
  48     LPWSTR CurdirBuffer, CurdirFilePart;
  49     DWORD CurdirLength,CurdirLength2;
  50     ULONG VDMCreationState=0;
  51     ULONG VdmBinaryType = 0;
  52     UNICODE_STRING  SubSysCommandLine;
  53     PIMAGE_NT_HEADERS NtHeaders;
  54     DWORD dwNoWindow = (dwCreationFlags & CREATE_NO_WINDOW);
  55     ANSI_STRING AnsiStringVDMEnv;
  56     UNICODE_STRING UnicodeStringVDMEnv;
  57     WCHAR ImageFileDebuggerCommand[ 64 ];
  58     LPWSTR QuotedBuffer;
  59     BOOLEAN QuoteInsert;
  60     BOOLEAN QuoteCmdLine = FALSE;
  61     BOOLEAN QuoteFound;
  62     BOOLEAN SearchRetry;
  63     BOOLEAN IsWowBinary = FALSE;
  64     STARTUPINFOW StartupInfo;
  65     DWORD LastError;
  66     DWORD fileattr;
  67     PROCESS_PRIORITY_CLASS PriClass;
  68     PVOID State;
  69 #if defined(BUILD_WOW6432) || defined(_WIN64)
  70     LPCWSTR lpOriginalApplicationName = lpApplicationName;
  71     LPWSTR lpOriginalCommandLine = lpCommandLine;
  72 #endif
  73 
  74 #if defined(WX86) || defined(_AXP64_)
  75     HANDLE Wx86Info = NULL;
  76 #endif
  77 
  78 #if defined WX86
  79     BOOLEAN UseKnownWx86Dll;
  80     UseKnownWx86Dll = NtCurrentTeb()->Wx86Thread.UseKnownWx86Dll;
  81     NtCurrentTeb()->Wx86Thread.UseKnownWx86Dll = FALSE;
  82 #endif
  83 
  84 
  85     RtlZeroMemory(lpProcessInformation,sizeof(*lpProcessInformation));
  86 
  87     // Private VDM flag should be ignored; Its meant for internal use only.
  88     dwCreationFlags &= (ULONG)~CREATE_NO_WINDOW;
  89 
  90     //
  91     // CREATE_WITH_USERPROFILE is the new Create Flag that is used
  92     // only by CreateProcessWithLogonW.  If this flags ends up getting
  93     // passed to CreateProcess, we must reject it.
  94     //
  95     if (dwCreationFlags & CREATE_WITH_USERPROFILE ) {
  96         SetLastError(ERROR_INVALID_PARAMETER);
  97         return FALSE;
  98         }
  99 
 100     if ((dwCreationFlags & (DETACHED_PROCESS | CREATE_NEW_CONSOLE)) ==
 101         (DETACHED_PROCESS | CREATE_NEW_CONSOLE)) {
 102 
 103         SetLastError(ERROR_INVALID_PARAMETER);
 104         return FALSE;
 105         }
 106 
 107     AnsiStringVDMEnv.Buffer = NULL;
 108     UnicodeStringVDMEnv.Buffer = NULL;
 109 
 110     //
 111     // the lowest specified priority class is used.
 112     //
 113 
 114     if (dwCreationFlags & IDLE_PRIORITY_CLASS ) {
 115         PriClass.PriorityClass = PROCESS_PRIORITY_CLASS_IDLE;
 116         }
 117     else if (dwCreationFlags & BELOW_NORMAL_PRIORITY_CLASS ) {
 118         PriClass.PriorityClass = PROCESS_PRIORITY_CLASS_BELOW_NORMAL;
 119         }
 120     else if (dwCreationFlags & NORMAL_PRIORITY_CLASS ) {
 121         PriClass.PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL;
 122         }
 123     else if (dwCreationFlags & ABOVE_NORMAL_PRIORITY_CLASS ) {
 124         PriClass.PriorityClass = PROCESS_PRIORITY_CLASS_ABOVE_NORMAL;
 125         }
 126     else if (dwCreationFlags & HIGH_PRIORITY_CLASS ) {
 127         PriClass.PriorityClass =  PROCESS_PRIORITY_CLASS_HIGH;
 128         }
 129     else if (dwCreationFlags & REALTIME_PRIORITY_CLASS ) {
 130         if ( BasepIsRealtimeAllowed(FALSE) ) {
 131             PriClass.PriorityClass =  PROCESS_PRIORITY_CLASS_REALTIME;
 132             }
 133         else {
 134             PriClass.PriorityClass =  PROCESS_PRIORITY_CLASS_HIGH;
 135             }
 136         }
 137     else {
 138         PriClass.PriorityClass = PROCESS_PRIORITY_CLASS_UNKNOWN;
 139         }
 140     PriClass.Foreground = FALSE;
 141 
 142     dwCreationFlags = (dwCreationFlags & ~PRIORITY_CLASS_MASK );
 143 
 144     //
 145     // Default separate/shared VDM option if not explicitly specified.
 146     //
 147 
 148     if (dwCreationFlags & CREATE_SEPARATE_WOW_VDM) {
 149         if (dwCreationFlags & CREATE_SHARED_WOW_VDM) {
 150             SetLastError(ERROR_INVALID_PARAMETER);
 151 
 152             return FALSE;
 153             }
 154         }
 155     else
 156     if ((dwCreationFlags & CREATE_SHARED_WOW_VDM) == 0) {
 157         if (BaseStaticServerData->DefaultSeparateVDM) {
 158             dwCreationFlags |= CREATE_SEPARATE_WOW_VDM;
 159             }
 160         }
 161 
 162     if ((dwCreationFlags & CREATE_SEPARATE_WOW_VDM) == 0) {
 163         //
 164         // If the creator is running inside a job object, always
 165         // set SEPERATE_WOW_VDM so the VDM is part of the job.
 166         //
 167         JOBOBJECT_BASIC_UI_RESTRICTIONS UiRestrictions;
 168 
 169         Status = NtQueryInformationJobObject(NULL,
 170                                              JobObjectBasicUIRestrictions,
 171                                              &UiRestrictions,
 172                                              sizeof(UiRestrictions),
 173                                              NULL);
 174         if (Status != STATUS_ACCESS_DENIED) {
 175             //
 176             // Anything other than STATUS_ACCESS_DENIED indicates the
 177             // current process is inside a job.
 178             //
 179             dwCreationFlags = (dwCreationFlags & (~CREATE_SHARED_WOW_VDM)) |
 180                                   CREATE_SEPARATE_WOW_VDM;
 181             }
 182         }
 183 
 184 
 185     //
 186     //  If ANSI environment, convert to Unicode
 187     //
 188 
 189     if (lpEnvironment && !(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT) ) {
 190         PUCHAR s;
 191         STRING Ansi;
 192         UNICODE_STRING Unicode;
 193         MEMORY_BASIC_INFORMATION MemoryInformation;
 194 
 195         Ansi.Buffer = s = lpEnvironment;
 196         while (*s || *(s+1))            // find end of block
 197             s++;
 198 
 199         Ansi.Length = (USHORT)(s - Ansi.Buffer) + 1;
 200         Ansi.MaximumLength = Ansi.Length + 1;
 201         MemoryInformation.RegionSize = Ansi.MaximumLength * sizeof(WCHAR);
 202         Unicode.Buffer = NULL;
 203         Status = NtAllocateVirtualMemory( NtCurrentProcess(),
 204                                           &Unicode.Buffer,
 205                                           0,
 206                                           &MemoryInformation.RegionSize,
 207                                           MEM_COMMIT,
 208                                           PAGE_READWRITE
 209                                         );
 210         if (!NT_SUCCESS(Status) ) {
 211             BaseSetLastNTError(Status);
 212 
 213             return FALSE;
 214             }
 215 
 216         Unicode.MaximumLength = (USHORT)MemoryInformation.RegionSize;
 217         Status = RtlAnsiStringToUnicodeString(&Unicode, &Ansi, FALSE);
 218         if (!NT_SUCCESS(Status) ) {
 219             NtFreeVirtualMemory( NtCurrentProcess(),
 220                                  &Unicode.Buffer,
 221                                  &MemoryInformation.RegionSize,
 222                                  MEM_RELEASE
 223                                );
 224             BaseSetLastNTError(Status);
 225 
 226             return FALSE;
 227             }
 228         lpEnvironment = Unicode.Buffer;
 229         }
 230 
 231     FileHandle = NULL;
 232     SectionHandle = NULL;
 233     ProcessHandle = NULL;
 234     ThreadHandle = NULL;
 235     FreeBuffer = NULL;
 236     NameBuffer = NULL;
 237     VdmNameString.Buffer = NULL;
 238     BaseAddress = (PVOID)1;
 239     VdmReserve = 0;
 240     CurdirBuffer = NULL;
 241     CurdirFilePart = NULL;
 242     SubSysCommandLine.Buffer = NULL;
 243     QuoteFound = FALSE;
 244     QuoteInsert = FALSE;
 245     QuotedBuffer = NULL;
 246 
 247     try {
 248 
 249         //
 250         // Make a copy of the startup info so we can change it.
 251         //
 252 
 253         StartupInfo = *lpStartupInfo;
 254 
 255         //
 256         // STARTF_USEHOTKEY means hStdInput is really the hotkey value.
 257         // STARTF_HASSHELLDATA means std handles are used for shell-private
 258         // data.  This flag is used if an icon is passed to ShellExecuteEx.
 259         // As a result they cannot be specified with STARTF_USESTDHANDLES.
 260         // Consistent with Win95, USESTDHANDLES is ignored.
 261         //
 262 
 263         if (StartupInfo.dwFlags & STARTF_USESTDHANDLES &&
 264             StartupInfo.dwFlags & (STARTF_USEHOTKEY | STARTF_HASSHELLDATA)) {
 265 
 266             StartupInfo.dwFlags &= ~STARTF_USESTDHANDLES;
 267             }
 268 
 269 VdmRetry:
 270         LastError = 0;
 271         SearchRetry = TRUE;
 272         QuoteInsert = FALSE;
 273         QuoteCmdLine = FALSE;
 274         if (!ARGUMENT_PRESENT( lpApplicationName )) {
 275 
 276             //
 277             // Locate the image
 278             //
 279 
 280             // forgot to free NameBuffer before goto VdmRetry???
 281             ASSERT(NameBuffer == NULL);
 282 
 283             NameBuffer = RtlAllocateHeap( RtlProcessHeap(),
 284                                           MAKE_TAG( TMP_TAG ),
 285                                           MAX_PATH * sizeof( WCHAR ));
 286             if ( !NameBuffer ) {
 287                 BaseSetLastNTError(STATUS_NO_MEMORY);
 288                 return FALSE;
 289                 }
 290             lpApplicationName = lpCommandLine;
 291             TempNull = (PWCH)lpApplicationName;
 292             WhiteScan = (LPWSTR)lpApplicationName;
 293 
 294             //
 295             // check for lead quote
 296             //
 297             if ( *WhiteScan == L'\"' ) {
 298                 SearchRetry = FALSE;
 299                 WhiteScan++;
 300                 lpApplicationName = WhiteScan;
 301                 while(*WhiteScan) {
 302                     if ( *WhiteScan == (WCHAR)'\"' ) {
 303                         TempNull = (PWCH)WhiteScan;
 304                         QuoteFound = TRUE;
 305                         break;
 306                         }
 307                     WhiteScan++;
 308                     TempNull = (PWCH)WhiteScan;
 309                     }
 310                 }
 311             else {
 312 retrywsscan:
 313                 lpApplicationName = lpCommandLine;
 314                 while(*WhiteScan) {
 315                     if ( *WhiteScan == (WCHAR)' ' ||
 316                          *WhiteScan == (WCHAR)'\t' ) {
 317                         TempNull = (PWCH)WhiteScan;
 318                         break;
 319                         }
 320                     WhiteScan++;
 321                     TempNull = (PWCH)WhiteScan;
 322                     }
 323                 }
 324             TempChar = *TempNull;
 325             *TempNull = UNICODE_NULL;
 326 
 327 #ifdef WX86
 328 
 329             //
 330             // Wx86 applications must use x86 version of known exes
 331             // for compatibility.
 332             //
 333 
 334             if (UseKnownWx86Dll) {
 335                LPWSTR KnownName;
 336 
 337                NtCurrentTeb()->Wx86Thread.UseKnownWx86Dll = FALSE;
 338 
 339                KnownName = BasepWx86KnownExe(lpApplicationName);
 340                if (KnownName) {
 341                   lpApplicationName = KnownName;
 342                   }
 343                }
 344 #endif
 345 
 346 
 347             Length = SearchPathW(
 348                         NULL,
 349                         lpApplicationName,
 350                         (PWSTR)L".exe",
 351                         MAX_PATH,
 352                         NameBuffer,
 353                         NULL
 354                         )*2;
 355 
 356             if (Length != 0 && Length < MAX_PATH * sizeof( WCHAR )) {
 357                 //
 358                 // SearchPathW worked, but file might be a directory
 359                 // if this happens, we need to keep trying
 360                 //
 361                 fileattr = GetFileAttributesW(NameBuffer);
 362                 if ( fileattr != 0xffffffff &&
 363                      (fileattr & FILE_ATTRIBUTE_DIRECTORY) ) {
 364                     Length = 0;
 365                 } else {
 366                     Length++;
 367                     Length++;
 368                 }
 369             }
 370 
 371             if ( !Length || Length >= MAX_PATH<<1 ) {
 372 
 373                 //
 374                 // If we search pathed, then return file not found.
 375                 // otherwise, try to be more specific.
 376                 //
 377                 RTL_PATH_TYPE PathType;
 378                 HANDLE hFile;
 379 
 380                 PathType = RtlDetermineDosPathNameType_U(lpApplicationName);
 381                 if ( PathType != RtlPathTypeRelative ) {
 382 
 383                     //
 384                     // The failed open should set get last error properly.
 385                     //
 386 
 387                     hFile = CreateFileW(
 388                                 lpApplicationName,
 389                                 GENERIC_READ,
 390                                 FILE_SHARE_READ | FILE_SHARE_WRITE,
 391                                 NULL,
 392                                 OPEN_EXISTING,
 393                                 FILE_ATTRIBUTE_NORMAL,
 394                                 NULL
 395                                 );
 396                     if ( hFile != INVALID_HANDLE_VALUE ) {
 397                         CloseHandle(hFile);
 398                         BaseSetLastNTError(STATUS_OBJECT_NAME_NOT_FOUND);
 399                         }
 400                     }
 401                 else {
 402                     BaseSetLastNTError(STATUS_OBJECT_NAME_NOT_FOUND);
 403                     }
 404 
 405                 //
 406                 // remember initial last error value for the retry scan path
 407                 //
 408 
 409                 if ( LastError ) {
 410                     SetLastError(LastError);
 411                     }
 412                 else {
 413                     LastError = GetLastError();
 414                     }
 415 
 416                 //
 417                 // restore the command line
 418                 //
 419 
 420                 *TempNull = TempChar;
 421                 lpApplicationName = NameBuffer;
 422 
 423                 //
 424                 // If we still have command line left, then keep going
 425                 // the point is to march through the command line looking
 426                 // for whitespace so we can try to find an image name
 427                 // launches of things like:
 428                 // c:\word 95\winword.exe /embedding -automation
 429                 // require this. Our first iteration will stop at c:\word, our next
 430                 // will stop at c:\word 95\winword.exe
 431                 //
 432                 if (*WhiteScan && SearchRetry) {
 433                     WhiteScan++;
 434                     TempNull = WhiteScan;
 435                     QuoteInsert = TRUE;
 436                     QuoteFound = TRUE;
 437                     goto retrywsscan;
 438                 }
 439 
 440                 return FALSE;
 441                 }
 442             //
 443             // restore the command line
 444             //
 445 
 446             *TempNull = TempChar;
 447             lpApplicationName = NameBuffer;
 448             }
 449         else
 450         if (!ARGUMENT_PRESENT( lpCommandLine ) || *lpCommandLine == UNICODE_NULL ) {
 451             QuoteCmdLine = TRUE;
 452             lpCommandLine = (LPWSTR)lpApplicationName;
 453             }
 454 
 455 
 456 #ifdef WX86
 457 
 458        //
 459        // Wx86 applications must use x86 version of known exes
 460        // for compatibility.
 461        //
 462 
 463        if (UseKnownWx86Dll) {
 464            LPWSTR KnownName;
 465 
 466            NtCurrentTeb()->Wx86Thread.UseKnownWx86Dll = FALSE;
 467 
 468            KnownName = BasepWx86KnownExe(lpApplicationName);
 469            if (KnownName) {
 470 
 471                RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
 472                NameBuffer = KnownName;
 473                lpApplicationName = KnownName;
 474                }
 475            }
 476 
 477 #endif
 478 
 479 
 480         //
 481         // Translate to an NT name.
 482         //
 483 
 484         TranslationStatus = RtlDosPathNameToNtPathName_U(
 485                                 lpApplicationName,
 486                                 &PathName,
 487                                 NULL,
 488                                 &RelativeName
 489                                 );
 490 
 491         if ( !TranslationStatus ) {
 492             SetLastError(ERROR_PATH_NOT_FOUND);
 493 
 494             return FALSE;
 495             }
 496 
 497         // forgot to free FreeBuffer before goto VdmRetry????
 498         ASSERT(FreeBuffer == NULL);
 499         FreeBuffer = PathName.Buffer;
 500 
 501         if ( RelativeName.RelativeName.Length ) {
 502             PathName = *(PUNICODE_STRING)&RelativeName.RelativeName;
 503             }
 504         else {
 505             RelativeName.ContainingDirectory = NULL;
 506             }
 507 
 508         InitializeObjectAttributes(
 509             &Obja,
 510             &PathName,
 511             OBJ_CASE_INSENSITIVE,
 512             RelativeName.ContainingDirectory,
 513             NULL
 514             );
 515 
 516         //
 517         // Open the file for execute access
 518         //
 519 
 520         Status = NtOpenFile(
 521                     &FileHandle,
 522                     SYNCHRONIZE | FILE_EXECUTE,
 523                     &Obja,
 524                     &IoStatusBlock,
 525                     FILE_SHARE_READ | FILE_SHARE_DELETE,
 526                     FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE
 527                     );
 528         if (!NT_SUCCESS(Status) ) {
 529 
 530             //
 531             // if we failed, see if this is a device. If it is a device,
 532             // then just return invalid image format
 533             //
 534 
 535             if ( RtlIsDosDeviceName_U((PWSTR)lpApplicationName) ) {
 536                 SetLastError(ERROR_BAD_DEVICE);
 537                 }
 538             else {
 539                 BaseSetLastNTError(Status);
 540                 }
 541 
 542             return FALSE;
 543             }
 544 
 545         //
 546         // If no desktop has been specified, use the caller's
 547         // desktop.
 548         //
 549 
 550         if (StartupInfo.lpDesktop == NULL) {
 551             StartupInfo.lpDesktop =
 552                     (LPWSTR)((PRTL_USER_PROCESS_PARAMETERS)NtCurrentPeb()->
 553                         ProcessParameters)->DesktopInfo.Buffer;
 554             }
 555 
 556         //
 557         // Create a section object backed by the file
 558         //
 559 
 560         Status = NtCreateSection(
 561                     &SectionHandle,
 562                     SECTION_ALL_ACCESS,
 563                     NULL,
 564                     NULL,
 565                     PAGE_EXECUTE,
 566                     SEC_IMAGE,
 567                     FileHandle
 568                     );
 569 
 570 
 571         NtClose(FileHandle);
 572         FileHandle = NULL;
 573 
 574 
 575 
 576         //
 577         // App Certification DLL
 578         //
 579 
 580        if (NT_SUCCESS(Status)) {
 581 
 582           Status = BasepIsProcessAllowed(lpApplicationName);
 583 
 584           if (!NT_SUCCESS(Status)) {
 585             BaseSetLastNTError(Status);
 586             return FALSE;
 587           }
 588 
 589        }
 590 
 591 
 592 
 593         if (!NT_SUCCESS(Status)) {
 594 
 595             switch (Status) {
 596                 // 16 bit OS/2 exe
 597                 case STATUS_INVALID_IMAGE_NE_FORMAT:
 598 #ifdef i386
 599                 //
 600                 // Use OS/2 if x86 (OS/2 not supported on risc),
 601                 //    and CreationFlags don't have forcedos bit
 602                 //    and Registry didn't specify ForceDos
 603                 //
 604                 // else execute as a DOS bound app.
 605                 //
 606                 //
 607 
 608                 if (!(dwCreationFlags & CREATE_FORCEDOS) &&
 609                     !BaseStaticServerData->ForceDos)
 610                   {
 611 
 612                     if ( !BuildSubSysCommandLine( L"OS2 /P ",
 613                                                   lpApplicationName,
 614                                                   lpCommandLine,
 615                                                   &SubSysCommandLine
 616                                                 ) ) {
 617                         return FALSE;
 618                         }
 619 
 620                     lpCommandLine = SubSysCommandLine.Buffer;
 621 
 622                     lpApplicationName = NULL;
 623 
 624                     RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 625                     FreeBuffer = NULL;
 626                     RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
 627                     NameBuffer = NULL;
 628                     goto VdmRetry;
 629                     }
 630 #endif
 631                     // Falls into Dos case, so that stub message will be
 632                     // printed, and bound apps will run w/o OS/2 subsytem
 633 
 634                 // Dos .exe or .com
 635 
 636                 case STATUS_INVALID_IMAGE_PROTECT:
 637                 case STATUS_INVALID_IMAGE_NOT_MZ:
 638 ForceDos:
 639                     {
 640                     ULONG BinarySubType;
 641 
 642                     BinarySubType = BINARY_TYPE_DOS_EXE;
 643                     if (Status == STATUS_INVALID_IMAGE_PROTECT   ||
 644                         Status == STATUS_INVALID_IMAGE_NE_FORMAT ||
 645                        (BinarySubType = BaseIsDosApplication(&PathName,Status)) )
 646                        {
 647                         VdmBinaryType = BINARY_TYPE_DOS;
 648 
 649                         // create the environment before going to the
 650                         // server. This was done becuase we want NTVDM
 651                         // to have the new environment when it gets
 652                         // created.
 653                         if (!BaseCreateVDMEnvironment(
 654                                     lpEnvironment,
 655                                     &AnsiStringVDMEnv,
 656                                     &UnicodeStringVDMEnv
 657                                     ))
 658                             return FALSE;
 659 
 660                         if(!BaseCheckVDM(VdmBinaryType | BinarySubType,
 661                                          lpApplicationName,
 662                                          lpCommandLine,
 663                                          lpCurrentDirectory,
 664                                          &AnsiStringVDMEnv,
 665                                          &m,
 666                                          &iTask,
 667                                          dwCreationFlags,
 668                                          &StartupInfo
 669                                          ))
 670                             return FALSE;
 671 
 672 
 673                         // Check the return value from the server
 674                         switch (b->VDMState & VDM_STATE_MASK){
 675                             case VDM_NOT_PRESENT:
 676                                 // mark this so the server can undo
 677                                 // creation if something goes wrong.
 678                                 // We marked it "partitially created" because
 679                                 // the NTVDM has yet not been fully created.
 680                                 // a call to UpdateVdmEntry to update
 681                                 // process handle will signal the NTVDM
 682                                 // process completed creation
 683                                 VDMCreationState = VDM_PARTIALLY_CREATED;
 684                                 // fail the call if NTVDM process is being
 685                                 // created DETACHED.
 686                                 // note that, we let it go if NTVDM process
 687                                 // is already running.
 688                                 if (dwCreationFlags & DETACHED_PROCESS) {
 689                                     SetLastError(ERROR_ACCESS_DENIED);
 690                                     return FALSE;
 691                                     }
 692                                 if (!BaseGetVdmConfigInfo(lpCommandLine,
 693                                                           iTask,
 694                                                           VdmBinaryType,
 695                                                           &VdmNameString,
 696                                                           &VdmReserve
 697                                                           ))
 698                                    {
 699                                     BaseSetLastNTError(Status);
 700                                     return FALSE;
 701                                     }
 702 
 703                                 lpCommandLine = VdmNameString.Buffer;
 704                                 lpApplicationName = NULL;
 705 
 706                                 break;
 707 
 708                             case VDM_PRESENT_NOT_READY:
 709                                 SetLastError (ERROR_NOT_READY);
 710                                 return FALSE;
 711 
 712                             case VDM_PRESENT_AND_READY:
 713                                 VDMCreationState = VDM_BEING_REUSED;
 714                                 VdmWaitHandle = b->WaitObjectForParent;
 715                                 break;
 716                             }
 717                          RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 718                          FreeBuffer = NULL;
 719                          RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
 720                          NameBuffer = NULL;
 721                          VdmReserve--;               // we reserve from addr 1
 722                          if(VdmWaitHandle)
 723                             goto VdmExists;
 724                          else{
 725                             bInheritHandles = FALSE;
 726                             if (lpEnvironment &&
 727                                 !(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT)){
 728                                 RtlDestroyEnvironment(lpEnvironment);
 729                                 }
 730                             lpEnvironment = UnicodeStringVDMEnv.Buffer;
 731                             goto VdmRetry;
 732                             }
 733                         }
 734                     else {
 735 
 736                         //
 737                         //  must be a .bat or .cmd file
 738                         //
 739 
 740                         static PWCHAR CmdPrefix = L"cmd /c ";
 741                         PWCHAR NewCommandLine;
 742                         ULONG Length;
 743                         PWCHAR Last4 = &PathName.Buffer[PathName.Length / sizeof( WCHAR )-4];
 744 
 745                         if ( PathName.Length < 8 ) {
 746                             SetLastError(ERROR_BAD_EXE_FORMAT);
 747                             return FALSE;
 748                             }
 749 
 750                         if (_wcsnicmp( Last4, L".bat", 4 ) && _wcsnicmp( Last4, L".cmd", 4 )) {
 751                             SetLastError(ERROR_BAD_EXE_FORMAT);
 752                             return FALSE;
 753                         }
 754 
 755                         Length = wcslen( CmdPrefix )
 756                                  + (QuoteCmdLine || QuoteFound )
 757                                  + wcslen( lpCommandLine )
 758                                  + (QuoteCmdLine || QuoteFound)
 759                                  + 1;
 760 
 761                         NewCommandLine = RtlAllocateHeap( RtlProcessHeap( ),
 762                                                           MAKE_TAG( TMP_TAG ),
 763                                                           Length * sizeof( WCHAR ) );
 764 
 765                         if (NewCommandLine == NULL) {
 766                             BaseSetLastNTError(STATUS_NO_MEMORY);
 767                             return FALSE;
 768                         }
 769 
 770                         wcscpy( NewCommandLine, CmdPrefix );
 771                         if (QuoteCmdLine || QuoteFound) {
 772                             wcscat( NewCommandLine, L"\"" );
 773                         }
 774                         wcscat( NewCommandLine, lpCommandLine );
 775                         if (QuoteCmdLine || QuoteFound) {
 776                             wcscat( NewCommandLine, L"\"" );
 777                         }
 778 
 779                         RtlInitUnicodeString( &SubSysCommandLine, NewCommandLine );
 780 
 781                         lpCommandLine = SubSysCommandLine.Buffer;
 782 
 783                         lpApplicationName = NULL;
 784 
 785                         RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 786                         FreeBuffer = NULL;
 787                         RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
 788                         NameBuffer = NULL;
 789                         goto VdmRetry;
 790 
 791                         }
 792 
 793                     }
 794 
 795                 // 16 bit windows exe
 796                 case STATUS_INVALID_IMAGE_WIN_16:
 797 #if defined(BUILD_WOW6432) || defined(_WIN64)
 798                    if (lpOriginalApplicationName == NULL) {
 799                        // pass in the part of the command line after the exe name
 800                        // including whitespace
 801                        lpCommandLine = ((*TempNull == '\"') ? TempNull + 1 : TempNull);
 802                    } else {
 803                        lpCommandLine = lpOriginalCommandLine;
 804                    }
 805                    return NtVdm64CreateProcess(lpOriginalApplicationName == NULL,
 806                                                lpApplicationName,             // this is now the real file name we've loaded
 807                                                lpCommandLine,
 808                                                lpProcessAttributes,
 809                                                lpThreadAttributes,
 810                                                bInheritHandles,
 811                                                (dwCreationFlags & ~CREATE_UNICODE_ENVIRONMENT),  // the environment has already been converted to unicode
 812                                                lpEnvironment,
 813                                                lpCurrentDirectory,
 814                                                lpStartupInfo,
 815                                                lpProcessInformation
 816                                                );
 817 #endif
 818                    if (dwCreationFlags & CREATE_FORCEDOS) {
 819                        goto ForceDos;
 820                        }
 821 
 822                     IsWowBinary = TRUE;
 823                     if (!BaseCreateVDMEnvironment(lpEnvironment,
 824                                                   &AnsiStringVDMEnv,
 825                                                   &UnicodeStringVDMEnv
 826                                                   ))
 827                        {
 828                         return FALSE;
 829                         }
 830 
 831 
 832 
 833 RetrySepWow:
 834                     VdmBinaryType = dwCreationFlags & CREATE_SEPARATE_WOW_VDM
 835                                      ? BINARY_TYPE_SEPWOW : BINARY_TYPE_WIN16;
 836 
 837                     if (!BaseCheckVDM(VdmBinaryType,
 838                                       lpApplicationName,
 839                                       lpCommandLine,
 840                                       lpCurrentDirectory,
 841                                       &AnsiStringVDMEnv,
 842                                       &m,
 843                                       &iTask,
 844                                       dwCreationFlags,
 845                                       &StartupInfo
 846                                       ))
 847                        {
 848                         //
 849                         // If we failed with access denied, caller may not
 850                         // be allowed allowed to access the shared wow's
 851                         // desktop, so retry as a separate wow
 852                         //
 853                         if (VdmBinaryType == BINARY_TYPE_WIN16 &&
 854                             GetLastError() == ERROR_ACCESS_DENIED)
 855                           {
 856                            dwCreationFlags |= CREATE_SEPARATE_WOW_VDM;
 857                            }
 858                         else {
 859                            return FALSE;
 860                            }
 861                         goto RetrySepWow;
 862                         }
 863 
 864 
 865                     // Check the return value from the server
 866                     switch (b->VDMState & VDM_STATE_MASK){
 867                         case VDM_NOT_PRESENT:
 868                             // mark this so the server can undo
 869                             // creation if something goes wrong.
 870                             // We marked it "partitially created" because
 871                             // the NTVDM has yet not been fully created.
 872                             // a call to UpdateVdmEntry to update
 873                             // process handle will signal the NTVDM
 874                             // process completed creation
 875 
 876                             VDMCreationState = VDM_PARTIALLY_CREATED;
 877 
 878                             if (!BaseGetVdmConfigInfo(
 879                                     lpCommandLine,
 880                                     iTask,
 881                                     VdmBinaryType,
 882                                     &VdmNameString,
 883                                     &VdmReserve
 884                                     ))
 885                                {
 886                                 BaseSetLastNTError(Status);
 887                                 return FALSE;
 888                                 }
 889 
 890                             lpCommandLine = VdmNameString.Buffer;
 891                             lpApplicationName = NULL;
 892 
 893 
 894                             //
 895                             // Wow must have a hidden console
 896                             // Throw away DETACHED_PROCESS flag which isn't
 897                             // meaningful for Win16 apps.
 898                             //
 899 
 900                             dwCreationFlags |= CREATE_NO_WINDOW;
 901                             dwCreationFlags &= ~(CREATE_NEW_CONSOLE | DETACHED_PROCESS);
 902 
 903 
 904                             //
 905                             // We're starting a WOW VDM, turn on feedback unless
 906                             // the creator passed STARTF_FORCEOFFFEEDBACK.
 907                             //
 908 
 909                             StartupInfo.dwFlags |= STARTF_FORCEONFEEDBACK;
 910 
 911                             break;
 912 
 913                         case VDM_PRESENT_NOT_READY:
 914                             SetLastError (ERROR_NOT_READY);
 915                             return FALSE;
 916 
 917                         case VDM_PRESENT_AND_READY:
 918                             VDMCreationState = VDM_BEING_REUSED;
 919                             VdmWaitHandle = b->WaitObjectForParent;
 920                             break;
 921                         }
 922 
 923                     RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 924                     FreeBuffer = NULL;
 925                     RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
 926                     NameBuffer = NULL;
 927                     VdmReserve--;               // we reserve from addr 1
 928                     if(VdmWaitHandle)
 929                         goto VdmExists;
 930                     else {
 931                         bInheritHandles = FALSE;
 932                         // replace the environment with ours
 933                         if (lpEnvironment &&
 934                             !(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT)) {
 935                             RtlDestroyEnvironment(lpEnvironment);
 936                             }
 937                         lpEnvironment = UnicodeStringVDMEnv.Buffer;
 938                         goto VdmRetry;
 939                         }
 940 
 941 
 942                 default :
 943                     SetLastError(ERROR_BAD_EXE_FORMAT);
 944                     return FALSE;
 945             }
 946         }
 947 
 948         //
 949         // Make sure only WOW apps can have the CREATE_SEPARATE_WOW_VDM flag.
 950         //
 951 
 952         if (!IsWowBinary && (dwCreationFlags & CREATE_SEPARATE_WOW_VDM)) {
 953             dwCreationFlags &= ~CREATE_SEPARATE_WOW_VDM;
 954         }
 955 
 956         //
 957         // Query the section to determine the stack parameters and
 958         // image entrypoint.
 959         //
 960 
 961         Status = NtQuerySection(
 962                     SectionHandle,
 963                     SectionImageInformation,
 964                     &ImageInformation,
 965                     sizeof( ImageInformation ),
 966                     NULL
 967                     );
 968 
 969         if (!NT_SUCCESS( Status )) {
 970             BaseSetLastNTError(Status);
 971             RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 972             FreeBuffer = NULL;
 973             return FALSE;
 974             }
 975 
 976         if (ImageInformation.ImageCharacteristics & IMAGE_FILE_DLL) {
 977             SetLastError(ERROR_BAD_EXE_FORMAT);
 978             RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
 979             FreeBuffer = NULL;
 980             return FALSE;
 981             }
 982 
 983         ImageFileDebuggerCommand[ 0 ] = UNICODE_NULL;
 984         if (!(dwCreationFlags & (DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS)) ||
 985             NtCurrentPeb()->ReadImageFileExecOptions
 986            ) {
 987             LdrQueryImageFileExecutionOptions( &PathName,
 988                                                L"Debugger",
 989                                                REG_SZ,
 990                                                ImageFileDebuggerCommand,
 991                                                sizeof( ImageFileDebuggerCommand ),
 992                                                NULL
 993                                              );
 994             }
 995 
 996 
 997 
 998         if ((ImageInformation.Machine < USER_SHARED_DATA->ImageNumberLow) ||
 999             (ImageInformation.Machine > USER_SHARED_DATA->ImageNumberHigh)) {
1000 #if defined(WX86) || defined(_AXP64_)
1001             if (ImageInformation.Machine == IMAGE_FILE_MACHINE_I386)
1002                {
1003                 Wx86Info = (HANDLE)UIntToPtr(sizeof(WX86TIB));
1004                 }
1005             else
1006 #endif // WX86
1007 #if defined(_AXP64_)
1008             if (ImageInformation.Machine == IMAGE_FILE_MACHINE_ALPHA) {
1009                // Fall through since this is a valid machine type.
1010                 }
1011              else
1012 #elif defined(_IA64_)
1013             if (ImageInformation.Machine == IMAGE_FILE_MACHINE_I386) {
1014                // Fall through since this is a valid machine type.
1015                 }
1016              else
1017 #endif // _AXP64_
1018 #if defined(BUILD_WOW6432)
1019             // 32-bit kernel32.dll on NT64 can run 64-bit binaries
1020 #if defined(_ALPHA_)
1021             if (ImageInformation.Machine == IMAGE_FILE_MACHINE_ALPHA) {
1022                // Fall through since this is a valid machine type.
1023                 }
1024              else
1025 #elif defined(_X86_)
1026             if (ImageInformation.Machine == IMAGE_FILE_MACHINE_I386) {
1027                // Fall through since this is a valid machine type.
1028                 }
1029              else
1030 #endif  // ALPHA or IA64
1031 #endif  // BUILD_WOW6432
1032                 {
1033                 ULONG_PTR ErrorParameters[2];
1034                 ULONG ErrorResponse;
1035 
1036                 ErrorResponse = ResponseOk;
1037                 ErrorParameters[0] = (ULONG_PTR)&PathName;
1038 
1039                 NtRaiseHardError( STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE,
1040                                   1,
1041                                   1,
1042                                   ErrorParameters,
1043                                   OptionOk,
1044                                   &ErrorResponse
1045                                 );
1046                 if ( NtCurrentPeb()->ImageSubsystemMajorVersion <= 3 ) {
1047                     SetLastError(ERROR_BAD_EXE_FORMAT);
1048                     }
1049                 else {
1050                     SetLastError(ERROR_EXE_MACHINE_TYPE_MISMATCH);
1051                     }
1052                 RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
1053                 FreeBuffer = NULL;
1054                 return FALSE;
1055                 }
1056             }
1057 
1058         RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
1059         FreeBuffer = NULL;
1060         if ( ImageInformation.SubSystemType != IMAGE_SUBSYSTEM_WINDOWS_GUI &&
1061              ImageInformation.SubSystemType != IMAGE_SUBSYSTEM_WINDOWS_CUI ) {
1062 
1063             // POSIX exe
1064 
1065             NtClose(SectionHandle);
1066             SectionHandle = NULL;
1067 
1068             if ( ImageInformation.SubSystemType == IMAGE_SUBSYSTEM_POSIX_CUI ) {
1069 
1070                 if ( !BuildSubSysCommandLine( L"POSIX /P ",
1071                                               lpApplicationName,
1072                                               lpCommandLine,
1073                                               &SubSysCommandLine
1074                                             ) ) {
1075                     return FALSE;
1076                 }
1077 
1078                 lpCommandLine = SubSysCommandLine.Buffer;
1079 
1080                 lpApplicationName = NULL;
1081                 RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
1082                 NameBuffer = NULL;
1083                 goto VdmRetry;
1084                 }
1085             else {
1086                 SetLastError(ERROR_CHILD_NOT_COMPLETE);
1087                 return FALSE;
1088                 }
1089             }
1090         else {
1091             if (!BasepIsImageVersionOk( ImageInformation.SubSystemMajorVersion,
1092                                         ImageInformation.SubSystemMinorVersion) ) {
1093                 SetLastError(ERROR_BAD_EXE_FORMAT);
1094                 return FALSE;
1095                 }
1096             }
1097 
1098         if (ImageFileDebuggerCommand[ 0 ] != UNICODE_NULL) {
1099             USHORT n;
1100 
1101             n = (USHORT)wcslen( lpCommandLine );
1102             if (n == 0) {
1103                 lpCommandLine = (LPWSTR)lpApplicationName;
1104                 n = (USHORT)wcslen( lpCommandLine );
1105                 }
1106 
1107             n += wcslen( ImageFileDebuggerCommand ) + 1 + 2;
1108             n *= sizeof( WCHAR );
1109 
1110             SubSysCommandLine.Buffer = RtlAllocateHeap( RtlProcessHeap(), MAKE_TAG( TMP_TAG ), n );
1111             SubSysCommandLine.Length = 0;
1112             SubSysCommandLine.MaximumLength = n;
1113             RtlAppendUnicodeToString( &SubSysCommandLine, ImageFileDebuggerCommand );
1114             RtlAppendUnicodeToString( &SubSysCommandLine, L" " );
1115             RtlAppendUnicodeToString( &SubSysCommandLine, (PWSTR)lpCommandLine );
1116 #if DBG
1117             DbgPrint( "BASE: Calling debugger with '%wZ'\n", &SubSysCommandLine );
1118 #endif
1119             lpCommandLine = SubSysCommandLine.Buffer;
1120             lpApplicationName = NULL;
1121 
1122             NtClose(SectionHandle);
1123             SectionHandle = NULL;
1124             RtlFreeHeap(RtlProcessHeap(), 0, NameBuffer);
1125             NameBuffer = NULL;
1126             goto VdmRetry;
1127             }
1128 
1129         //
1130         // Create the process object
1131         //
1132 
1133         pObja = BaseFormatObjectAttributes(&Obja,lpProcessAttributes,NULL);
1134 
1135         if (dwCreationFlags & CREATE_BREAKAWAY_FROM_JOB ) {
1136             SectionHandle = (HANDLE)( (UINT_PTR)SectionHandle | 1);
1137             }
1138 
1139         Status = NtCreateProcess(
1140                     &ProcessHandle,
1141                     PROCESS_ALL_ACCESS,
1142                     pObja,
1143                     NtCurrentProcess(),
1144                     (BOOLEAN)bInheritHandles,
1145                     SectionHandle,
1146                     NULL,
1147                     NULL
1148                     );
1149         if ( !NT_SUCCESS(Status) ) {
1150             BaseSetLastNTError(Status);
1151             return FALSE;
1152             }
1153 
1154         //
1155         // NtCreateProcess will set to normal OR inherit if parent is IDLE or Below
1156         // only override if a mask is given during the create.
1157         //
1158 
1159         if ( PriClass.PriorityClass != PROCESS_PRIORITY_CLASS_UNKNOWN ) {
1160             State = NULL;
1161             if ( PriClass.PriorityClass ==  PROCESS_PRIORITY_CLASS_REALTIME ) {
1162                 State = BasepIsRealtimeAllowed(TRUE);
1163                 }
1164             Status = NtSetInformationProcess(
1165                         ProcessHandle,
1166                         ProcessPriorityClass,
1167                         (PVOID)&PriClass,
1168                         sizeof(PriClass)
1169                         );
1170             if ( State ) {
1171                 BasepReleasePrivilege( State );
1172                 }
1173 
1174             if ( !NT_SUCCESS(Status) ) {
1175                 BaseSetLastNTError(Status);
1176                 return FALSE;
1177                 }
1178             }
1179 
1180         NtClose(SectionHandle);
1181         SectionHandle = NULL;
1182 
1183         if (dwCreationFlags & CREATE_DEFAULT_ERROR_MODE) {
1184             UINT NewMode;
1185             NewMode = SEM_FAILCRITICALERRORS;
1186             NtSetInformationProcess(
1187                 ProcessHandle,
1188                 ProcessDefaultHardErrorMode,
1189                 (PVOID) &NewMode,
1190                 sizeof(NewMode)
1191                 );
1192             }
1193 
1194         //
1195         // If the process is being created for a VDM call the server with
1196         // process handle.
1197         //
1198 
1199         if (VdmBinaryType) {
1200             VdmWaitHandle = ProcessHandle;
1201             if (!BaseUpdateVDMEntry(UPDATE_VDM_PROCESS_HANDLE,
1202                                     &VdmWaitHandle,
1203                                     iTask,
1204                                     VdmBinaryType
1205                                     ))
1206                {
1207                 //make sure we don't close the handle twice --
1208                 //(VdmWaitHandle == ProcessHandle) if we don't do this.
1209                 VdmWaitHandle = NULL;
1210                 return FALSE;
1211                 }
1212 
1213             //
1214             // For Sep wow the VdmWaitHandle = NULL (there is none!)
1215             //
1216 
1217             VDMCreationState |= VDM_FULLY_CREATED;
1218             }
1219 
1220         //
1221         // if we're a detached priority, we don't have the focus, so
1222         // don't create with boosted priority.
1223         //
1224 
1225         if (dwCreationFlags & DETACHED_PROCESS) {
1226             KPRIORITY SetBasePriority;
1227 
1228             SetBasePriority = (KPRIORITY)NORMAL_BASE_PRIORITY;
1229             Status =  NtSetInformationProcess(ProcessHandle,
1230                                               ProcessBasePriority,
1231                                               (PVOID) &SetBasePriority,
1232                                               sizeof(SetBasePriority)
1233                                               );
1234             ASSERT(NT_SUCCESS(Status));
1235         }
1236 
1237 #if defined(i386) || defined(_IA64_)
1238         //
1239         // Reserve memory in the new process' address space if necessary
1240         // (for vdms). This is required only for x86 system.
1241         //
1242 
1243     if ( VdmReserve ) {
1244             BigVdmReserve = VdmReserve;
1245             Status = NtAllocateVirtualMemory(
1246                         ProcessHandle,
1247                         &BaseAddress,
1248                         0L,
1249                         &BigVdmReserve,
1250                         MEM_RESERVE,
1251                         PAGE_EXECUTE_READWRITE
1252                         );
1253             if ( !NT_SUCCESS(Status) ){
1254                 BaseSetLastNTError(Status);
1255                 return FALSE;
1256             }
1257     }
1258 #endif
1259 
1260         //
1261         // Determine the location of the
1262         // processes PEB.
1263         //
1264 
1265         Status = NtQueryInformationProcess(
1266                     ProcessHandle,
1267                     ProcessBasicInformation,
1268                     &ProcessInfo,
1269                     sizeof( ProcessInfo ),
1270                     NULL
1271                     );
1272         if ( !NT_SUCCESS( Status ) ) {
1273             BaseSetLastNTError(Status);
1274             return FALSE;
1275             }
1276 
1277         Peb = ProcessInfo.PebBaseAddress;
1278 
1279         //
1280         // Push the parameters into the address space of the new process
1281         //
1282 
1283         if ( ARGUMENT_PRESENT(lpCurrentDirectory) ) {
1284             CurdirBuffer = RtlAllocateHeap( RtlProcessHeap(),
1285                                             MAKE_TAG( TMP_TAG ),
1286                                             (MAX_PATH + 1) * sizeof( WCHAR ) );
1287             if ( !CurdirBuffer ) {
1288                 BaseSetLastNTError(STATUS_NO_MEMORY);
1289                 return FALSE;
1290                 }
1291             CurdirLength2 = GetFullPathNameW(
1292                                 lpCurrentDirectory,
1293                                 MAX_PATH,
1294                                 CurdirBuffer,
1295                                 &CurdirFilePart
1296                                 );
1297             if ( CurdirLength2 > MAX_PATH ) {
1298                 SetLastError(ERROR_DIRECTORY);
1299                 return FALSE;
1300                 }
1301 
1302             //
1303             // now make sure the directory exists
1304             //
1305 
1306             CurdirLength = GetFileAttributesW(CurdirBuffer);
1307             if ( (CurdirLength == 0xffffffff) ||
1308                  !(CurdirLength & FILE_ATTRIBUTE_DIRECTORY) ) {
1309                 SetLastError(ERROR_DIRECTORY);
1310                 return FALSE;
1311                 }
1312             }
1313 
1314 
1315         if ( QuoteInsert || QuoteCmdLine) {
1316             QuotedBuffer = RtlAllocateHeap(RtlProcessHeap(),0,wcslen(lpCommandLine)*2+6);
1317 
1318             if ( QuotedBuffer ) {
1319                 wcscpy(QuotedBuffer,L"\"");
1320 
1321                 if ( QuoteInsert ) {
1322                     TempChar = *TempNull;
1323                     *TempNull = UNICODE_NULL;
1324                     }
1325 
1326                 wcscat(QuotedBuffer,lpCommandLine);
1327                 wcscat(QuotedBuffer,L"\"");
1328 
1329                 if ( QuoteInsert ) {
1330                     *TempNull = TempChar;
1331                     wcscat(QuotedBuffer,TempNull);
1332                     }
1333 
1334                 }
1335             else {
1336                 if ( QuoteInsert ) {
1337                     QuoteInsert = FALSE;
1338                     }
1339                 if ( QuoteCmdLine ) {
1340                     QuoteCmdLine = FALSE;
1341                     }
1342                 }
1343             }
1344 
1345 
1346         if (!BasePushProcessParameters(
1347                 ProcessHandle,
1348                 Peb,
1349                 lpApplicationName,
1350                 CurdirBuffer,
1351                 QuoteInsert || QuoteCmdLine ? QuotedBuffer : lpCommandLine,
1352                 lpEnvironment,
1353                 &StartupInfo,
1354                 dwCreationFlags | dwNoWindow,
1355                 bInheritHandles,
1356                 IsWowBinary ? IMAGE_SUBSYSTEM_WINDOWS_GUI : 0
1357                 ) ) {
1358             return FALSE;
1359             }
1360 
1361 
1362         RtlFreeUnicodeString(&VdmNameString);
1363         VdmNameString.Buffer = NULL;
1364 
1365         //
1366         // Stuff in the standard handles if needed
1367         //
1368         if (!VdmBinaryType &&
1369             !bInheritHandles &&
1370             !(StartupInfo.dwFlags & STARTF_USESTDHANDLES) &&
1371             !(dwCreationFlags & (DETACHED_PROCESS | CREATE_NEW_CONSOLE | CREATE_NO_WINDOW)) &&
1372             ImageInformation.SubSystemType == IMAGE_SUBSYSTEM_WINDOWS_CUI
1373            ) {
1374             PRTL_USER_PROCESS_PARAMETERS ParametersInNewProcess;
1375 
1376             Status = NtReadVirtualMemory( ProcessHandle,
1377                                           &Peb->ProcessParameters,
1378                                           &ParametersInNewProcess,
1379                                           sizeof( ParametersInNewProcess ),
1380                                           NULL
1381                                         );
1382             if (NT_SUCCESS( Status )) {
1383                 if (!CONSOLE_HANDLE( NtCurrentPeb()->ProcessParameters->StandardInput )) {
1384                     StuffStdHandle( ProcessHandle,
1385                                     NtCurrentPeb()->ProcessParameters->StandardInput,
1386                                     &ParametersInNewProcess->StandardInput
1387                                   );
1388                     }
1389                 if (!CONSOLE_HANDLE( NtCurrentPeb()->ProcessParameters->StandardOutput )) {
1390                     StuffStdHandle( ProcessHandle,
1391                                     NtCurrentPeb()->ProcessParameters->StandardOutput,
1392                                     &ParametersInNewProcess->StandardOutput
1393                                   );
1394                     }
1395                 if (!CONSOLE_HANDLE( NtCurrentPeb()->ProcessParameters->StandardError )) {
1396                     StuffStdHandle( ProcessHandle,
1397                                     NtCurrentPeb()->ProcessParameters->StandardError,
1398                                     &ParametersInNewProcess->StandardError
1399                                   );
1400                     }
1401                 }
1402             }
1403 
1404         //
1405         // Create the thread...
1406         //
1407 
1408         //
1409         // Allocate a stack for this thread in the address space of the target
1410         // process.
1411         //
1412 
1413         StackStatus = BaseCreateStack(
1414                         ProcessHandle,
1415                         ImageInformation.CommittedStackSize,
1416                         (ImageInformation.MaximumStackSize < 256*1024) ? 256*1024 : ImageInformation.MaximumStackSize,
1417                         &InitialTeb
1418                         );
1419 
1420         if ( !NT_SUCCESS(StackStatus) ) {
1421             BaseSetLastNTError(StackStatus);
1422             return FALSE;
1423             }
1424 
1425 
1426         //
1427         // Create an initial context for the new thread.
1428         //
1429 
1430         BaseInitializeContext(
1431             &ThreadContext,
1432             Peb,
1433             ImageInformation.TransferAddress,
1434             InitialTeb.StackBase,
1435             BaseContextTypeProcess
1436             );
1437 
1438 
1439         //
1440         // Create the actual thread object
1441         //
1442 
1443         pObja = BaseFormatObjectAttributes(&Obja,lpThreadAttributes,NULL);
1444 
1445         Status = NtCreateThread(
1446                     &ThreadHandle,
1447                     THREAD_ALL_ACCESS,
1448                     pObja,
1449                     ProcessHandle,
1450                     &ClientId,
1451                     &ThreadContext,
1452                     &InitialTeb,
1453                     TRUE
1454                     );
1455 
1456         if (!NT_SUCCESS(Status) ) {
1457             BaseSetLastNTError(Status);
1458             return FALSE;
1459             }
1460 
1461         //
1462         // From here on out, do not modify the address space of the
1463         // new process.  WOW64's implementation of NtCreateThread()
1464         // reshuffles the new process' address space if the current
1465         // process is 32-bit and the new process is 64-bit.
1466         //
1467 #if DBG
1468         Peb = NULL;
1469 #endif
1470 
1471 #if defined(WX86) || defined(_AXP64_)
1472 
1473         //
1474         // if this is a Wx86 Process, setup for a Wx86 emulated Thread
1475         //
1476 
1477         if (Wx86Info) {
1478 
1479             //
1480             // create a WX86Tib and initialize it's Teb->Vdm.
1481             //
1482             Status = BaseCreateWx86Tib(ProcessHandle,
1483                                        ThreadHandle,
1484                                        (ULONG)((ULONG_PTR)ImageInformation.TransferAddress),
1485                                        (ULONG)ImageInformation.CommittedStackSize,
1486                                        (ULONG)ImageInformation.MaximumStackSize,
1487                                        TRUE
1488                                        );
1489 
1490             if (!NT_SUCCESS(Status)) {
1491                 BaseSetLastNTError(Status);
1492                 return( FALSE );
1493                 }
1494 
1495 
1496             //
1497             // Mark Process as WX86
1498             //
1499             Status = NtSetInformationProcess (ProcessHandle,
1500                                               ProcessWx86Information,
1501                                               &Wx86Info,
1502                                               sizeof(Wx86Info)
1503                                               );
1504 
1505             if (!NT_SUCCESS(Status)) {
1506                 BaseSetLastNTError(Status);
1507                 return( FALSE );
1508                 }
1509             }
1510 #endif
1511 
1512 
1513         //
1514         // Call the Windows server to let it know about the
1515         // process.
1516         //
1517 
1518         a->ProcessHandle = ProcessHandle;
1519         a->ThreadHandle = ThreadHandle;
1520         a->ClientId = ClientId;
1521         a->CreationFlags = dwCreationFlags;
1522 
1523         if ( dwCreationFlags & (DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS) ) {
1524             Status = DbgUiConnectToDbg();
1525             if ( !NT_SUCCESS(Status) ) {
1526                 NtTerminateProcess(ProcessHandle, Status);
1527                 BaseSetLastNTError(Status);
1528                 return FALSE;
1529                 }
1530             a->DebuggerClientId = NtCurrentTeb()->ClientId;
1531             }
1532         else {
1533             a->DebuggerClientId.UniqueProcess = NULL;
1534             a->DebuggerClientId.UniqueThread = NULL;
1535             }
1536 
1537         //
1538         // Set the 2 bit if a gui app is starting. The window manager needs to
1539         // know this so it can synchronize the startup of this app
1540         // (WaitForInputIdle api). This info is passed using the process
1541         // handle tag bits.  The 1 bit asks the window manager to turn on
1542         // or turn off the application start cursor (hourglass/pointer).
1543         //
1544         // When starting a WOW process, lie and tell UserSrv NTVDM.EXE is a GUI
1545         // process.  We also turn on bit 0x8 so that UserSrv can ignore the
1546         // UserNotifyConsoleApplication call made by the console during startup.
1547         //
1548 
1549         if ( ImageInformation.SubSystemType == IMAGE_SUBSYSTEM_WINDOWS_GUI ||
1550              IsWowBinary ) {
1551 
1552             a->ProcessHandle = (HANDLE)((ULONG_PTR)a->ProcessHandle | 2);
1553 
1554             //
1555             // If the creating process is a GUI app, turn on the app. start cursor
1556             // by default.  This can be overridden by STARTF_FORCEOFFFEEDBACK.
1557             //
1558 
1559             NtHeaders = RtlImageNtHeader((PVOID)GetModuleHandle(NULL));
1560             if ( NtHeaders->OptionalHeader.Subsystem == IMAGE_SUBSYSTEM_WINDOWS_GUI )
1561                 a->ProcessHandle = (HANDLE)((ULONG_PTR)a->ProcessHandle | 1);
1562 
1563             }
1564 
1565 
1566         //
1567         // If feedback is forced on, turn it on. If forced off, turn it off.
1568         // Off overrides on.
1569         //
1570 
1571         if (StartupInfo.dwFlags & STARTF_FORCEONFEEDBACK)
1572             a->ProcessHandle = (HANDLE)((ULONG_PTR)a->ProcessHandle | 1);
1573         if (StartupInfo.dwFlags & STARTF_FORCEOFFFEEDBACK)
1574             a->ProcessHandle = (HANDLE)((ULONG_PTR)a->ProcessHandle & ~1);
1575 
1576         a->VdmBinaryType = VdmBinaryType; // just tell server the truth
1577 
1578         if (VdmBinaryType){
1579            a->hVDM    = iTask ? 0 : NtCurrentPeb()->ProcessParameters->ConsoleHandle;
1580            a->VdmTask = iTask;
1581         }
1582 
1583 #if defined(BUILD_WOW6432)
1584         m.ReturnValue = CsrBasepCreateProcess(a);
1585 #else
1586         CsrClientCallServer( (PCSR_API_MSG)&m,
1587                              NULL,
1588                              CSR_MAKE_API_NUMBER( BASESRV_SERVERDLL_INDEX,
1589                                                   BasepCreateProcess
1590                                                 ),
1591                              sizeof( *a )
1592                            );
1593 #endif
1594 
1595         if (!NT_SUCCESS((NTSTATUS)m.ReturnValue)) {
1596             BaseSetLastNTError((NTSTATUS)m.ReturnValue);
1597             NtTerminateProcess(ProcessHandle, (NTSTATUS)m.ReturnValue);
1598             return FALSE;
1599             }
1600 
1601 
1602         if (!( dwCreationFlags & CREATE_SUSPENDED) ) {
1603             NtResumeThread(ThreadHandle,&i);
1604             }
1605 
1606 VdmExists:
1607         bStatus = TRUE;
1608         if (VDMCreationState)
1609             VDMCreationState |= VDM_CREATION_SUCCESSFUL;
1610 
1611         try {
1612             if (VdmWaitHandle) {
1613 
1614                 //
1615                 // tag Shared WOW VDM handles so that wait for input idle has a
1616                 // chance to work.  Shared WOW VDM "process" handles are actually
1617                 // event handles,  Separate WOW VDM handles are real process
1618                 // handles. Also mark DOS handles with 0x1 so WaitForInputIdle
1619                 // has a way to distinguish DOS apps and not block forever.
1620                 //
1621 
1622                 if (VdmBinaryType == BINARY_TYPE_WIN16)  {
1623                     lpProcessInformation->hProcess =
1624                             (HANDLE)((ULONG_PTR)VdmWaitHandle | 0x2);
1625 
1626                     //
1627                     // Shared WOW doesn't always start a process, so
1628                     // we don't have a process ID or thread ID to
1629                     // return if the VDM already existed.
1630                     //
1631                     // Separate WOW doesn't hit this codepath
1632                     // (no VdmWaitHandle).
1633                     //
1634 
1635                     if (VDMCreationState & VDM_BEING_REUSED) {
1636                         ClientId.UniqueProcess = 0;
1637                         ClientId.UniqueThread = 0;
1638                         }
1639 
1640                     }
1641                 else  {
1642                     lpProcessInformation->hProcess =
1643                             (HANDLE)((ULONG_PTR)VdmWaitHandle | 0x1);
1644                     }
1645 
1646 
1647                 //
1648                 // Close the ProcessHandle, since we are returning the
1649                 // VdmProcessHandle instead.
1650                 //
1651 
1652                 if (ProcessHandle != NULL)
1653                     NtClose(ProcessHandle);
1654                 }
1655             else{
1656                 lpProcessInformation->hProcess = ProcessHandle;
1657                 }
1658 
1659             lpProcessInformation->hThread = ThreadHandle;
1660             lpProcessInformation->dwProcessId = HandleToUlong(ClientId.UniqueProcess);
1661             lpProcessInformation->dwThreadId = HandleToUlong(ClientId.UniqueThread);
1662             ProcessHandle = NULL;
1663             ThreadHandle = NULL;
1664             }
1665         except ( EXCEPTION_EXECUTE_HANDLER ) {
1666             NtClose( ProcessHandle );
1667             NtClose( ThreadHandle );
1668             ProcessHandle = NULL;
1669             ThreadHandle = NULL;
1670             if (VDMCreationState)
1671                 VDMCreationState &= ~VDM_CREATION_SUCCESSFUL;
1672             }
1673         }
1674     finally {
1675         if (lpEnvironment && !(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT) ) {
1676             RtlDestroyEnvironment(lpEnvironment);
1677             lpEnvironment = NULL;
1678             }
1679         RtlFreeHeap(RtlProcessHeap(), 0,QuotedBuffer);
1680         RtlFreeHeap(RtlProcessHeap(), 0,NameBuffer);
1681         RtlFreeHeap(RtlProcessHeap(), 0,CurdirBuffer);
1682         RtlFreeHeap(RtlProcessHeap(), 0,FreeBuffer);
1683         if ( FileHandle ) {
1684             NtClose(FileHandle);
1685             }
1686         if ( SectionHandle ) {
1687             NtClose(SectionHandle);
1688             }
1689         if ( ThreadHandle ) {
1690             NtTerminateProcess(ProcessHandle,STATUS_SUCCESS);
1691             NtClose(ThreadHandle);
1692             }
1693         if ( ProcessHandle ) {
1694             NtClose(ProcessHandle);
1695             }
1696         RtlFreeUnicodeString(&VdmNameString);
1697         RtlFreeUnicodeString(&SubSysCommandLine);
1698         if (AnsiStringVDMEnv.Buffer || UnicodeStringVDMEnv.Buffer)
1699             BaseDestroyVDMEnvironment(&AnsiStringVDMEnv, &UnicodeStringVDMEnv);
1700 
1701         if (VDMCreationState && !(VDMCreationState & VDM_CREATION_SUCCESSFUL)){
1702             BaseUpdateVDMEntry (
1703                 UPDATE_VDM_UNDO_CREATION,
1704                 (HANDLE *)&iTask,
1705                 VDMCreationState,
1706                 VdmBinaryType
1707                 );
1708             if(VdmWaitHandle) {
1709                 NtClose(VdmWaitHandle);
1710                 }
1711             }
1712         }
1713 
1714     if (lpEnvironment && !(dwCreationFlags & CREATE_UNICODE_ENVIRONMENT) ) {
1715         RtlDestroyEnvironment(lpEnvironment);
1716         }
1717     return bStatus;
1718 }
CreateProcessW

 

  暂且忽略掉之前的一些环境字符串等等相关操作,注意到第一个值得关注的函数:NtOpenFile()打开其目标文件获取到了文件句柄FIileHandle
 
  
        //
        // Open the file for execute access
        //

        Status = NtOpenFile(
                    &FileHandle,
                    SYNCHRONIZE | FILE_EXECUTE,
                    &Obja,
                    &IoStatusBlock,
                    FILE_SHARE_READ | FILE_SHARE_DELETE,
                    FILE_SYNCHRONOUS_IO_NONALERT | FILE_NON_DIRECTORY_FILE
                    );

  

  紧接其后的是NtCreateSectiont通过文件句柄创建一个Section文件映射区,将文件内容映射进来
        //
        // Create a section object backed by the file
        //

        Status = NtCreateSection(
                    &SectionHandle,
                    SECTION_ALL_ACCESS,
                    NULL,
                    NULL,
                    PAGE_EXECUTE,
                    SEC_IMAGE,
                    FileHandle
                    );

  

  继续向下看关键函数:NtCreateProcess出现啦!

        Status = NtCreateProcess(
                    &ProcessHandle,
                    PROCESS_ALL_ACCESS,
                    pObja,
                    NtCurrentProcess(),
                    (BOOLEAN)bInheritHandles,
                    SectionHandle,
                    NULL,
                    NULL
                    );

  在源码中继续延伸,发现调用过程是NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess(Windows2000源码中是没有NtCreateProcessEx函数这个中间过程的,我是在另外一套源码中找到的NtCreateProcessEx函数,但无奈另一套较新的源码中又没有CreateProcessW的定义,故而开始参考的是Windows2000 源码)

 

  NtCreateProcess函数和NtCreateProcessEx函数:

NTSTATUS
NtCreateProcess(
    __out PHANDLE ProcessHandle,
    __in ACCESS_MASK DesiredAccess,
    __in_opt POBJECT_ATTRIBUTES ObjectAttributes,
    __in HANDLE ParentProcess,
    __in BOOLEAN InheritObjectTable,
    __in_opt HANDLE SectionHandle,
    __in_opt HANDLE DebugPort,
    __in_opt HANDLE ExceptionPort
    )
{
    ULONG Flags = 0;

    if ((ULONG_PTR)SectionHandle & 1) {
        Flags |= PROCESS_CREATE_FLAGS_BREAKAWAY;
    }

    if ((ULONG_PTR) DebugPort & 1) {
        Flags |= PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT;
    }

    if (InheritObjectTable) {
        Flags |= PROCESS_CREATE_FLAGS_INHERIT_HANDLES;
    }

    return NtCreateProcessEx (ProcessHandle,
                              DesiredAccess,
                              ObjectAttributes OPTIONAL,
                              ParentProcess,
                              Flags,
                              SectionHandle,
                              DebugPort,
                              ExceptionPort,
                              0);
}

NTSTATUS
NtCreateProcessEx(
    __out PHANDLE ProcessHandle,
    __in ACCESS_MASK DesiredAccess,
    __in_opt POBJECT_ATTRIBUTES ObjectAttributes,
    __in HANDLE ParentProcess,
    __in ULONG Flags,
    __in_opt HANDLE SectionHandle,
    __in_opt HANDLE DebugPort,
    __in_opt HANDLE ExceptionPort,
    __in ULONG JobMemberLevel
    )



{
    NTSTATUS Status;

    PAGED_CODE();

    if (KeGetPreviousMode() != KernelMode) {

        //
        // Probe all arguments
        //

        try {
            ProbeForWriteHandle (ProcessHandle);
        } except (EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode ();
        }
    }

    if (ARGUMENT_PRESENT (ParentProcess)) {
        Status = PspCreateProcess (ProcessHandle,
                                   DesiredAccess,
                                   ObjectAttributes,
                                   ParentProcess,
                                   Flags,
                                   SectionHandle,
                                   DebugPort,
                                   ExceptionPort,
                                   JobMemberLevel);
    } else {
        Status = STATUS_INVALID_PARAMETER;
    }

    return Status;
}

  

  看以看到NtCreateProcess函数简单地对处理一下参数,然后把创建进程的任务交给NtCreateProcessEx函数。

  NtCreateProcessEx函数的流程。它也只是简单地检查ProcessHandle参数代表的句柄是否可写,ParentProcess是否不为空。真正的创建工作交给PspCreateProcess函数。

  

NTSTATUS
PspCreateProcess(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess OPTIONAL,
    IN ULONG Flags,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN ULONG JobMemberLevel
    )
/*++

Routine Description:

    This routine creates and initializes a process object.  It implements the
    foundation for NtCreateProcess and for system initialization process
    creation.

--*/

{

    NTSTATUS Status;
    PEPROCESS Process;
    PEPROCESS CurrentProcess;
    PEPROCESS Parent;
    PETHREAD CurrentThread;
    KAFFINITY Affinity;
    KPRIORITY BasePriority;
    PVOID SectionObject;
    PVOID ExceptionPortObject;
    PVOID DebugPortObject;
    ULONG WorkingSetMinimum, WorkingSetMaximum;
    HANDLE LocalProcessHandle;
    KPROCESSOR_MODE PreviousMode;
    INITIAL_PEB InitialPeb;
    BOOLEAN CreatePeb;
    ULONG_PTR DirectoryTableBase[2];
    BOOLEAN AccessCheck;
    BOOLEAN MemoryAllocated;
    PSECURITY_DESCRIPTOR SecurityDescriptor;
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    NTSTATUS accesst;
    NTSTATUS SavedStatus;
    ULONG ImageFileNameSize;
    HANDLE_TABLE_ENTRY CidEntry;
    PEJOB Job;
    PPEB Peb;
    AUX_ACCESS_DATA AuxData;
    PACCESS_STATE AccessState;
    ACCESS_STATE LocalAccessState;
    BOOLEAN UseLargePages;
    SCHAR QuantumReset;
#if defined(_WIN64)
    INITIAL_PEB32 InitialPeb32;
#endif

    PAGED_CODE();

    CurrentThread = PsGetCurrentThread ();
    PreviousMode = KeGetPreviousModeByThread(&CurrentThread->Tcb);
    CurrentProcess = PsGetCurrentProcessByThread (CurrentThread);

    CreatePeb = FALSE;
    UseLargePages = FALSE;
    DirectoryTableBase[0] = 0;
    DirectoryTableBase[1] = 0;
    Peb = NULL;
    
    //
    // Reject bogus create parameters for future expansion
    //
    if (Flags&~PROCESS_CREATE_FLAGS_LEGAL_MASK) {
        return STATUS_INVALID_PARAMETER;
    }

    //
    // Parent
    //

    if (ARGUMENT_PRESENT (ParentProcess)) {
        Status = ObReferenceObjectByHandle (ParentProcess,
                                            PROCESS_CREATE_PROCESS,
                                            PsProcessType,
                                            PreviousMode,
                                            &Parent,
                                            NULL);
        if (!NT_SUCCESS (Status)) {
            return Status;
        }

        if (JobMemberLevel != 0 && Parent->Job == NULL) {
            ObDereferenceObject (Parent);
            return STATUS_INVALID_PARAMETER;
        }

        Affinity = Parent->Pcb.Affinity;
        WorkingSetMinimum = PsMinimumWorkingSet;
        WorkingSetMaximum = PsMaximumWorkingSet;


    } else {

        Parent = NULL;
        Affinity = KeActiveProcessors;
        WorkingSetMinimum = PsMinimumWorkingSet;
        WorkingSetMaximum = PsMaximumWorkingSet;
    }

    //
    // Create the process object
    //
    Status = ObCreateObject (PreviousMode,
                             PsProcessType,
                             ObjectAttributes,
                             PreviousMode,
                             NULL,
                             sizeof (EPROCESS),
                             0,
                             0,
                             &Process);

    if (!NT_SUCCESS (Status)) {
        goto exit_and_deref_parent;
    }

    //
    // The process object is created set to NULL. Errors
    // That occur after this step cause the process delete
    // routine to be entered.
    //
    // Teardown actions that occur in the process delete routine
    // do not need to be performed inline.
    //

    RtlZeroMemory (Process, sizeof(EPROCESS));
    ExInitializeRundownProtection (&Process->RundownProtect);
    PspInitializeProcessLock (Process);
    InitializeListHead (&Process->ThreadListHead);

#if defined(_WIN64)

    if (Flags & PROCESS_CREATE_FLAGS_OVERRIDE_ADDRESS_SPACE) {
        PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_OVERRIDE_ADDRESS_SPACE);
    }

#endif

    PspInheritQuota (Process, Parent);
    ObInheritDeviceMap (Process, Parent);
    if (Parent != NULL) {
        Process->DefaultHardErrorProcessing = Parent->DefaultHardErrorProcessing;
        Process->InheritedFromUniqueProcessId = Parent->UniqueProcessId;

    } else {
        Process->DefaultHardErrorProcessing = PROCESS_HARDERROR_DEFAULT;
        Process->InheritedFromUniqueProcessId = NULL;
    }

    //
    // Section
    //

    if (ARGUMENT_PRESENT (SectionHandle)) {
        Status = ObReferenceObjectByHandle (SectionHandle,
                                            SECTION_MAP_EXECUTE,
                                            MmSectionObjectType,
                                            PreviousMode,
                                            &SectionObject,
                                            NULL);
        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }

    } else {
        SectionObject = NULL;
        if (Parent != PsInitialSystemProcess) {

            //
            // Fetch the section pointer from the parent process
            // as we will be cloning. Since the section pointer
            // is removed at last thread exit we need to protect against
            // process exit here to be safe.
            //

            if (ExAcquireRundownProtection (&Parent->RundownProtect)) {
                SectionObject = Parent->SectionObject;
                if (SectionObject != NULL) {
                    ObReferenceObject (SectionObject);
                }

                ExReleaseRundownProtection (&Parent->RundownProtect);
            }

            if (SectionObject == NULL) {
                Status = STATUS_PROCESS_IS_TERMINATING;
                goto exit_and_deref;
            }
        }
    }

    Process->SectionObject = SectionObject;

    //
    // DebugPort
    //

    if (ARGUMENT_PRESENT (DebugPort)) {
        Status = ObReferenceObjectByHandle (DebugPort,
                                            DEBUG_PROCESS_ASSIGN,
                                            DbgkDebugObjectType,
                                            PreviousMode,
                                            &DebugPortObject,
                                            NULL);

        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }

        Process->DebugPort = DebugPortObject;
        if (Flags&PROCESS_CREATE_FLAGS_NO_DEBUG_INHERIT) {
            PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_NO_DEBUG_INHERIT);
        }

    } else {
        if (Parent != NULL) {
            DbgkCopyProcessDebugPort (Process, Parent);
        }
    }

    //
    // ExceptionPort
    //

    if (ARGUMENT_PRESENT (ExceptionPort)) {
        Status = ObReferenceObjectByHandle (ExceptionPort,
                                            0,
                                            LpcPortObjectType,
                                            PreviousMode,
                                            &ExceptionPortObject,
                                            NULL);

        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }

        Process->ExceptionPort = ExceptionPortObject;
    }

    Process->ExitStatus = STATUS_PENDING;

    //
    // Clone parent's object table.
    // If no parent (booting) then use the current object table created in
    // ObInitSystem.
    //

    if (Parent != NULL) {

        //
        // Calculate address space
        //
        //      If Parent == PspInitialSystem
        //

        if (!MmCreateProcessAddressSpace (WorkingSetMinimum,
                                          Process,
                                          &DirectoryTableBase[0])) {

            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto exit_and_deref;
        }

    } else {
        Process->ObjectTable = CurrentProcess->ObjectTable;

        //
        // Initialize the Working Set Mutex and address creation mutex
        // for this "hand built" process.
        // Normally, the call to MmInitializeAddressSpace initializes the
        // working set mutex, however, in this case, we have already initialized
        // the address space and we are now creating a second process using
        // the address space of the idle thread.
        //

        Status = MmInitializeHandBuiltProcess (Process, &DirectoryTableBase[0]);
        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }
    }

    PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_HAS_ADDRESS_SPACE);
    Process->Vm.MaximumWorkingSetSize = WorkingSetMaximum;
    KeInitializeProcess (&Process->Pcb,
                         NORMAL_BASE_PRIORITY,
                         Affinity,
                         &DirectoryTableBase[0],
                         (BOOLEAN)(Process->DefaultHardErrorProcessing & PROCESS_HARDERROR_ALIGNMENT_BIT));

    //
    //  Initialize the security fields of the process
    //  The parent may be null exactly once (during system init).
    //  Thereafter, a parent is always required so that we have a
    //  security context to duplicate for the new process.
    //

    Status = PspInitializeProcessSecurity (Parent, Process);
    if (!NT_SUCCESS (Status)) {
        goto exit_and_deref;
    }

    Process->PriorityClass = PROCESS_PRIORITY_CLASS_NORMAL;
    if (Parent != NULL) {
        if (Parent->PriorityClass == PROCESS_PRIORITY_CLASS_IDLE ||
            Parent->PriorityClass == PROCESS_PRIORITY_CLASS_BELOW_NORMAL) {
            Process->PriorityClass = Parent->PriorityClass;
        }

        //
        // if address space creation worked, then when going through
        // delete, we will attach. Of course, attaching means that the kprocess
        // must be initialized, so we delay the object stuff till here.
        //

        Status = ObInitProcess ((Flags&PROCESS_CREATE_FLAGS_INHERIT_HANDLES) ? Parent : NULL,
                                Process);

        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }

    } else {
        Status = MmInitializeHandBuiltProcess2 (Process);
        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }
    }

    Status = STATUS_SUCCESS;
    SavedStatus = STATUS_SUCCESS;

    //
    // Initialize the process address space
    // The address space has four possibilities
    //
    //      1 - Boot Process. Address space is initialized during
    //          MmInit. Parent is not specified.
    //
    //      2 - System Process. Address space is a virgin address
    //          space that only maps system space. Process is same
    //          as PspInitialSystemProcess.
    //
    //      3 - User Process (Cloned Address Space). Address space
    //          is cloned from the specified process.
    //
    //      4 - User Process (New Image Address Space). Address space
    //          is initialized so that it maps the specified section.
    //

    if (SectionHandle != NULL) {

        //
        // User Process (New Image Address Space). Don't specify Process to
        // clone, just SectionObject.
        //
        // Passing in the 4th parameter as below lets the EPROCESS struct contain its image file name, provided that
        // appropriate audit settings are enabled.  Memory is allocated inside of MmInitializeProcessAddressSpace
        // and pointed to by ImageFileName, so that must be freed in the process deletion routine (PspDeleteProcess())
        //

        Status = MmInitializeProcessAddressSpace (Process,
                                                  NULL,
                                                  SectionObject,
                                                  &Flags,
                                                  &(Process->SeAuditProcessCreationInfo.ImageFileName));

        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }

        //
        // In order to support relocating executables, the proper status
        // (STATUS_IMAGE_NOT_AT_BASE) must be returned, so save it here.
        //

        SavedStatus = Status;
        CreatePeb = TRUE;
        UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE);

    } else if (Parent != NULL) {
        if (Parent != PsInitialSystemProcess) {
            Process->SectionBaseAddress = Parent->SectionBaseAddress;

            //
            // User Process ( Cloned Address Space ).  Don't specify section to
            // map, just Process to clone.
            //

            Status = MmInitializeProcessAddressSpace (Process,
                                                      Parent,
                                                      NULL,
                                                      &Flags,
                                                      NULL);

            if (!NT_SUCCESS (Status)) {
                goto exit_and_deref;
            }

            CreatePeb = TRUE;
            UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE);
            
            //
            // A cloned process isn't started from an image file, so we give it the name
            // of the process of which it is a clone, provided the original has a name.
            //

            if (Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) {
                ImageFileNameSize = sizeof(OBJECT_NAME_INFORMATION) +
                                    Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength;

                Process->SeAuditProcessCreationInfo.ImageFileName =
                    ExAllocatePoolWithTag (PagedPool,
                                           ImageFileNameSize,
                                           'aPeS');

                if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) {
                    RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName,
                                   Parent->SeAuditProcessCreationInfo.ImageFileName,
                                   ImageFileNameSize);

                    //
                    // The UNICODE_STRING in the process is self contained, so calculate the
                    // offset for the buffer.
                    //

                    Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer =
                        (PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) +
                        sizeof(UNICODE_STRING));

                } else {
                    Status = STATUS_INSUFFICIENT_RESOURCES;
                    goto exit_and_deref;
                }
            }

        } else {

            //
            // System Process.  Don't specify Process to clone or section to map
            //

            Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS;
            Status = MmInitializeProcessAddressSpace (Process,
                                                      NULL,
                                                      NULL,
                                                      &Flags,
                                                      NULL);

            if (!NT_SUCCESS (Status)) {
                goto exit_and_deref;
            }

            //
            // In case the image file name of this system process is ever queried, we give
            // a zero length UNICODE_STRING.
            //

            Process->SeAuditProcessCreationInfo.ImageFileName =
                ExAllocatePoolWithTag (PagedPool,
                                       sizeof(OBJECT_NAME_INFORMATION),
                                       'aPeS');

            if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) {
                RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName,
                               sizeof(OBJECT_NAME_INFORMATION));
            } else {
                Status = STATUS_INSUFFICIENT_RESOURCES;
                goto exit_and_deref;
            }
        }
    }

    //
    // Create the process ID
    //

    CidEntry.Object = Process;
    CidEntry.GrantedAccess = 0;
    Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry);
    if (Process->UniqueProcessId == NULL) {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto exit_and_deref;
    }

    ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId);

    //
    // Audit the process creation.
    //

    if (SeDetailedAuditingWithToken (NULL)) {
        SeAuditProcessCreation (Process);
    }

    //
    // See if the parent has a job. If so reference the job
    // and add the process in.
    //

    if (Parent) {
        Job = Parent->Job;
        if (Job != NULL && !(Job->LimitFlags & JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK)) {
            if (Flags&PROCESS_CREATE_FLAGS_BREAKAWAY) {
                if (!(Job->LimitFlags & JOB_OBJECT_LIMIT_BREAKAWAY_OK)) {
                    Status = STATUS_ACCESS_DENIED;

                } else {
                    Status = STATUS_SUCCESS;
                }

            } else {
                Status = PspGetJobFromSet (Job, JobMemberLevel, &Process->Job);
                if (NT_SUCCESS (Status)) {
                    PACCESS_TOKEN Token, NewToken;
                    Job = Process->Job;
                    Status = PspAddProcessToJob (Job, Process);

                    //
                    // Duplicate a new process token if one is specified for the job
                    //

                    Token = Job->Token;
                    if (Token != NULL) {
                        Status = SeSubProcessToken (Token,
                                                    &NewToken,
                                                    FALSE,
                                                    Job->SessionId);

                        if (!NT_SUCCESS (Status)) {
                            goto exit_and_deref;
                        }

                        SeAssignPrimaryToken (Process, NewToken);    
                        ObDereferenceObject (NewToken);                    
                    }
                }
            }

            if (!NT_SUCCESS (Status)) {
                goto exit_and_deref;
            }
        }
    }

    if (Parent && CreatePeb) {

        //
        // For processes created w/ a section,
        // a new "virgin" PEB is created. Otherwise,
        // for forked processes, uses inherited PEB
        // with an updated mutant.
        //

        RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant));

        InitialPeb.Mutant = (HANDLE)(-1);
        InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages;
            
        if (SectionHandle != NULL) {
            Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb);
            if (!NT_SUCCESS (Status)) {
                Process->Peb = NULL;
                goto exit_and_deref;
            }

            Peb =  Process->Peb;

        } else {
            SIZE_T BytesCopied;

            InitialPeb.InheritedAddressSpace = TRUE;
            Process->Peb = Parent->Peb;
            MmCopyVirtualMemory (CurrentProcess,
                                 &InitialPeb,
                                 Process,
                                 Process->Peb,
                                 sizeof (INITIAL_PEB),
                                 KernelMode,
                                 &BytesCopied);

#if defined(_WIN64)
            if (Process->Wow64Process != NULL) {
                
                RtlZeroMemory (&InitialPeb32, FIELD_OFFSET(INITIAL_PEB32, Mutant));
                InitialPeb32.Mutant = -1;
                InitialPeb32.InheritedAddressSpace = TRUE;
                InitialPeb32.ImageUsesLargePages = (BOOLEAN) UseLargePages;

                MmCopyVirtualMemory (CurrentProcess,
                                     &InitialPeb32,
                                     Process,
                                     Process->Wow64Process->Wow64,
                                     sizeof (INITIAL_PEB32),
                                     KernelMode,
                                     &BytesCopied);
            }
#endif

        }
    }

    Peb = Process->Peb;

    //
    // Add the process to the global list of processes.
    //

    PspLockProcessList (CurrentThread);
    InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks);
    PspUnlockProcessList (CurrentThread);
    AccessState = NULL;
    if (!PsUseImpersonationToken) {
        AccessState = &LocalAccessState;
        Status = SeCreateAccessStateEx (NULL,
                                        (Parent == NULL || Parent != PsInitialSystemProcess)?
                                           PsGetCurrentProcessByThread (CurrentThread) :
                                           PsInitialSystemProcess,
                                        AccessState,
                                        &AuxData,
                                        DesiredAccess,
                                        &PsProcessType->TypeInfo.GenericMapping);
        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }
    }

    //
    // Insert the object. Once we do this is reachable from the outside world via
    // open by name. Open by ID is still disabled. Since its reachable
    // somebody might create a thread in the process and cause
    // rundown.
    //

    Status = ObInsertObject (Process,
                             AccessState,
                             DesiredAccess,
                             1,     // bias the refcnt by one for future process manipulations
                             NULL,
                             &LocalProcessHandle);

    if (AccessState != NULL) {
        SeDeleteAccessState (AccessState);
    }

    if (!NT_SUCCESS (Status)) {
        goto exit_and_deref_parent;
    }

    //
    // Compute the base priority and quantum reset values for the process and
    // set the memory priority.
    //

    ASSERT(IsListEmpty(&Process->ThreadListHead) == TRUE);

    BasePriority = PspComputeQuantumAndPriority(Process,
                                                PsProcessPriorityBackground,
                                                &QuantumReset);

    Process->Pcb.BasePriority = (SCHAR)BasePriority;
    Process->Pcb.QuantumReset = QuantumReset;

    //
    // As soon as a handle to the process is accessible, allow the process to
    // be deleted.
    //

    Process->GrantedAccess = PROCESS_TERMINATE;
    if (Parent && Parent != PsInitialSystemProcess) {
        Status = ObGetObjectSecurity (Process,
                                      &SecurityDescriptor,
                                      &MemoryAllocated);

        if (!NT_SUCCESS (Status)) {
            ObCloseHandle (LocalProcessHandle, PreviousMode);
            goto exit_and_deref;
        }

        //
        // Compute the subject security context
        //

        SubjectContext.ProcessAuditId = Process;
        SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
        SubjectContext.ClientToken = NULL;
        AccessCheck = SeAccessCheck (SecurityDescriptor,
                                     &SubjectContext,
                                     FALSE,
                                     MAXIMUM_ALLOWED,
                                     0,
                                     NULL,
                                     &PsProcessType->TypeInfo.GenericMapping,
                                     PreviousMode,
                                     &Process->GrantedAccess,
                                     &accesst);

        PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken);
        ObReleaseObjectSecurity (SecurityDescriptor,
                                 MemoryAllocated);

        if (!AccessCheck) {
            Process->GrantedAccess = 0;
        }

        //
        // It does not make any sense to create a process that can not
        // do anything to itself.
        // Note: Changes to this set of bits should be reflected in psquery.c
        // code, in PspSetPrimaryToken.
        //

        Process->GrantedAccess |= (PROCESS_VM_OPERATION |
                                   PROCESS_VM_READ |
                                   PROCESS_VM_WRITE |
                                   PROCESS_QUERY_INFORMATION |
                                   PROCESS_TERMINATE |
                                   PROCESS_CREATE_THREAD |
                                   PROCESS_DUP_HANDLE |
                                   PROCESS_CREATE_PROCESS |
                                   PROCESS_SET_INFORMATION |
                                   STANDARD_RIGHTS_ALL |
                                   PROCESS_SET_QUOTA);

    } else {
        Process->GrantedAccess = PROCESS_ALL_ACCESS;
    }

    KeQuerySystemTime (&Process->CreateTime);
    try {
        if (Peb != NULL && CurrentThread->Tcb.Teb != NULL) {
            ((PTEB)(CurrentThread->Tcb.Teb))->NtTib.ArbitraryUserPointer = Peb;
        }

        *ProcessHandle = LocalProcessHandle;

    } except (EXCEPTION_EXECUTE_HANDLER) {
        NOTHING;
    }

    if (SavedStatus != STATUS_SUCCESS) {
        Status = SavedStatus;
    }

exit_and_deref:
    ObDereferenceObject (Process);

exit_and_deref_parent:
    if (Parent != NULL) {
        ObDereferenceObject (Parent);
    }

    return Status;
}

  

 

 

 

  来具体分析一下PspCreateProcess所做的关键工作:

  (1)调用ObCreateObject 创建一个类型为PsProcessType的内核对象,置于局部变量Process中,对象体为EPROCESS,即创建EPROCESS

    Status = ObCreateObject (PreviousMode,
                             PsProcessType,
                             ObjectAttributes,
                             PreviousMode,
                             NULL,
                             sizeof (EPROCESS),
                             0,
                             0,
                             &Process);

 

  (2)MmCreateProcessAddressSpace创建新的地址空间

    if (Parent != NULL) {
        //创建新的地址空间
        if (!MmCreateProcessAddressSpace (WorkingSetMinimum,
                                          Process,
                                          &DirectoryTableBase[0])) {

            Status = STATUS_INSUFFICIENT_RESOURCES;
            goto exit_and_deref;
        }

  

  (3)MmInitializeProcessAddressSpace 初始化新进程的地址空间

if (Parent != PsInitialSystemProcess) {
       //根据父进程来初始化进程地址空间,并把父进程的映像名称拷贝到新进程对象的数据结构中。 Process->SectionBaseAddress = Parent->SectionBaseAddress; // // User Process ( Cloned Address Space ). Don't specify section to // map, just Process to clone. // Status = MmInitializeProcessAddressSpace (Process, Parent, NULL, &Flags, NULL); if (!NT_SUCCESS (Status)) { goto exit_and_deref; } CreatePeb = TRUE; UseLargePages = ((Flags & PROCESS_CREATE_FLAGS_LARGE_PAGES) != 0 ? TRUE : FALSE); // // A cloned process isn't started from an image file, so we give it the name // of the process of which it is a clone, provided the original has a name. // if (Parent->SeAuditProcessCreationInfo.ImageFileName != NULL) { ImageFileNameSize = sizeof(OBJECT_NAME_INFORMATION) + Parent->SeAuditProcessCreationInfo.ImageFileName->Name.MaximumLength; Process->SeAuditProcessCreationInfo.ImageFileName = ExAllocatePoolWithTag (PagedPool, ImageFileNameSize, 'aPeS'); if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { RtlCopyMemory (Process->SeAuditProcessCreationInfo.ImageFileName, Parent->SeAuditProcessCreationInfo.ImageFileName, ImageFileNameSize); // // The UNICODE_STRING in the process is self contained, so calculate the // offset for the buffer. // Process->SeAuditProcessCreationInfo.ImageFileName->Name.Buffer = (PUSHORT)(((PUCHAR) Process->SeAuditProcessCreationInfo.ImageFileName) + sizeof(UNICODE_STRING)); } else { Status = STATUS_INSUFFICIENT_RESOURCES; goto exit_and_deref; } } } else { // // System Process. Don't specify Process to clone or section to map // Flags &= ~PROCESS_CREATE_FLAGS_ALL_LARGE_PAGE_FLAGS; Status = MmInitializeProcessAddressSpace (Process, NULL, NULL, &Flags, NULL); if (!NT_SUCCESS (Status)) { goto exit_and_deref; } // // In case the image file name of this system process is ever queried, we give // a zero length UNICODE_STRING. // Process->SeAuditProcessCreationInfo.ImageFileName = ExAllocatePoolWithTag (PagedPool, sizeof(OBJECT_NAME_INFORMATION), 'aPeS'); if (Process->SeAuditProcessCreationInfo.ImageFileName != NULL) { RtlZeroMemory (Process->SeAuditProcessCreationInfo.ImageFileName, sizeof(OBJECT_NAME_INFORMATION)); } else { Status = STATUS_INSUFFICIENT_RESOURCES; goto exit_and_deref; } } }

  (4)ExCreateHandle函数在CID句柄表中创建一个进程ID项。

  

    CidEntry.Object = Process;
    CidEntry.GrantedAccess = 0;
    Process->UniqueProcessId = ExCreateHandle (PspCidTable, &CidEntry);
    if (Process->UniqueProcessId == NULL) {
        Status = STATUS_INSUFFICIENT_RESOURCES;
        goto exit_and_deref;
    }

    ExSetHandleTableOwner (Process->ObjectTable, Process->UniqueProcessId);

  (5)MmCreatePeb 创建一个PEB,如果进程通过映像内存区来创建,创建一个PEB,如果是进程拷贝,则使用继承的PEB。

  

 RtlZeroMemory (&InitialPeb, FIELD_OFFSET(INITIAL_PEB, Mutant));

        InitialPeb.Mutant = (HANDLE)(-1);
        InitialPeb.ImageUsesLargePages = (BOOLEAN) UseLargePages;
            
        if (SectionHandle != NULL) {
            Status = MmCreatePeb (Process, &InitialPeb, &Process->Peb);
            if (!NT_SUCCESS (Status)) {
                Process->Peb = NULL;
                goto exit_and_deref;
            }

            Peb =  Process->Peb;

        } else {
            SIZE_T BytesCopied;

            InitialPeb.InheritedAddressSpace = TRUE;
            Process->Peb = Parent->Peb;
            MmCopyVirtualMemory (CurrentProcess,
                                 &InitialPeb,
                                 Process,
                                 Process->Peb,
                                 sizeof (INITIAL_PEB),
                                 KernelMode,
                                 &BytesCopied);

  (6)InsertTailList 函数把新进程加入全局的LIST_ENTRY进程链表中(位置:PsActiveProcessHead)

    PspLockProcessList (CurrentThread);
    InsertTailList (&PsActiveProcessHead, &Process->ActiveProcessLinks);
    PspUnlockProcessList (CurrentThread);
    AccessState = NULL;
    if (!PsUseImpersonationToken) {
        AccessState = &LocalAccessState;
        Status = SeCreateAccessStateEx (NULL,
                                        (Parent == NULL || Parent != PsInitialSystemProcess)?
                                           PsGetCurrentProcessByThread (CurrentThread) :
                                           PsInitialSystemProcess,
                                        AccessState,
                                        &AuxData,
                                        DesiredAccess,
                                        &PsProcessType->TypeInfo.GenericMapping);
        if (!NT_SUCCESS (Status)) {
            goto exit_and_deref;
        }
    }

  (7)ObInsertObject 将新进程对象记录到当前进程的句柄表中。

Status = ObInsertObject (Process,
                             AccessState,
                             DesiredAccess,
                             1,     // bias the refcnt by one for future process manipulations
                             NULL,
                             &LocalProcessHandle);

  

  

  NtCreateProcess结束后,就创建好了进程,然而进程只不过是一个容器,接下来的代码就可以看到NtCreateThread函数的线程创建了:

NTSTATUS
NtCreateThread(
    __out PHANDLE ThreadHandle,
    __in ACCESS_MASK DesiredAccess,
    __in_opt POBJECT_ATTRIBUTES ObjectAttributes,
    __in HANDLE ProcessHandle,
    __out PCLIENT_ID ClientId,
    __in PCONTEXT ThreadContext,
    __in PINITIAL_TEB InitialTeb,
    __in BOOLEAN CreateSuspended
    )
/*++

Routine Description:

    This system service API creates and initializes a thread object.

--*/

{
    NTSTATUS Status;
    INITIAL_TEB CapturedInitialTeb;

    PAGED_CODE();


    //
    // Probe all arguments
    //

    try {
        if (KeGetPreviousMode () != KernelMode) {
            ProbeForWriteHandle (ThreadHandle);

            if (ARGUMENT_PRESENT (ClientId)) {
                ProbeForWriteSmallStructure (ClientId, sizeof (CLIENT_ID), sizeof (ULONG));
            }

            if (ARGUMENT_PRESENT (ThreadContext) ) {
                ProbeForReadSmallStructure (ThreadContext, sizeof (CONTEXT), CONTEXT_ALIGN);
            } else {
                return STATUS_INVALID_PARAMETER;
            }
            ProbeForReadSmallStructure (InitialTeb, sizeof (InitialTeb->OldInitialTeb), sizeof (ULONG));
        }

        CapturedInitialTeb.OldInitialTeb = InitialTeb->OldInitialTeb;
        if (CapturedInitialTeb.OldInitialTeb.OldStackBase == NULL &&
            CapturedInitialTeb.OldInitialTeb.OldStackLimit == NULL) {
            //
            // Since the structure size here is less than 64k we don't need to reprobe
            //
            CapturedInitialTeb = *InitialTeb;
        }
    } except (ExSystemExceptionFilter ()) {
        return GetExceptionCode ();
    }

    Status = PspCreateThread (ThreadHandle,
                              DesiredAccess,
                              ObjectAttributes,
                              ProcessHandle,
                              NULL,
                              ClientId,
                              ThreadContext,
                              &CapturedInitialTeb,
                              CreateSuspended,
                              NULL,
                              NULL);

    return Status;
}

  

 

 

 

  看到这里NtCreateThread函数还是调用了PspCreateThread函数来完成实际的工作。NtCreateThread——>PspCreateThread


NTSTATUS
PspCreateThread(
    OUT PHANDLE ThreadHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ProcessHandle,
    IN PEPROCESS ProcessPointer,
    OUT PCLIENT_ID ClientId OPTIONAL,
    IN PCONTEXT ThreadContext OPTIONAL,
    IN PINITIAL_TEB InitialTeb OPTIONAL,
    IN BOOLEAN CreateSuspended,
    IN PKSTART_ROUTINE StartRoutine OPTIONAL,
    IN PVOID StartContext
    )
/*++
Routine Description:
    This routine creates and initializes a thread object. It implements the
    foundation for NtCreateThread and for PsCreateSystemThread.
--*/

{

    HANDLE_TABLE_ENTRY CidEntry;
    NTSTATUS Status;
    PETHREAD Thread;
    PETHREAD CurrentThread;
    PEPROCESS Process;
    PTEB Teb;
    KPROCESSOR_MODE PreviousMode;
    HANDLE LocalThreadHandle;
    BOOLEAN AccessCheck;
    BOOLEAN MemoryAllocated;
    PSECURITY_DESCRIPTOR SecurityDescriptor;
    SECURITY_SUBJECT_CONTEXT SubjectContext;
    NTSTATUS accesst;
    LARGE_INTEGER CreateTime;
    ULONG OldActiveThreads;
    PEJOB Job;
    AUX_ACCESS_DATA AuxData;
    PACCESS_STATE AccessState;
    ACCESS_STATE LocalAccessState;

    PAGED_CODE();


    CurrentThread = PsGetCurrentThread ();

    if (StartRoutine != NULL) {
        PreviousMode = KernelMode;
    } else {
        PreviousMode = KeGetPreviousModeByThread (&CurrentThread->Tcb);
    }

    Teb = NULL;

    Thread = NULL;
    Process = NULL;

    if (ProcessHandle != NULL) {
        //
        // Process object reference count is biased by one for each thread.
        // This accounts for the pointer given to the kernel that remains
        // in effect until the thread terminates (and becomes signaled)
        //

        Status = ObReferenceObjectByHandle (ProcessHandle,
                                            PROCESS_CREATE_THREAD,
                                            PsProcessType,
                                            PreviousMode,
                                            &Process,
                                            NULL);
    } else {
        if (StartRoutine != NULL) {
            ObReferenceObject (ProcessPointer);
            Process = ProcessPointer;
            Status = STATUS_SUCCESS;
        } else {
            Status = STATUS_INVALID_HANDLE;
        }
    }

    if (!NT_SUCCESS (Status)) {
        return Status;
    }

    //
    // If the previous mode is user and the target process is the system
    // process, then the operation cannot be performed.
    //

    if ((PreviousMode != KernelMode) && (Process == PsInitialSystemProcess)) {
        ObDereferenceObject (Process);
        return STATUS_INVALID_HANDLE;
    }

    Status = ObCreateObject (PreviousMode,
                             PsThreadType,
                             ObjectAttributes,
                             PreviousMode,
                             NULL,
                             sizeof(ETHREAD),
                             0,
                             0,
                             &Thread);

    if (!NT_SUCCESS (Status)) {
        ObDereferenceObject (Process);
        return Status;
    }

    RtlZeroMemory (Thread, sizeof (ETHREAD));

    //
    // Initialize rundown protection for cross thread TEB refs etc.
    //
    ExInitializeRundownProtection (&Thread->RundownProtect);

    //
    // Assign this thread to the process so that from now on
    // we don't have to dereference in error paths.
    //
    Thread->ThreadsProcess = Process;

    Thread->Cid.UniqueProcess = Process->UniqueProcessId;

    CidEntry.Object = Thread;
    CidEntry.GrantedAccess = 0;
    Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry);

    if (Thread->Cid.UniqueThread == NULL) {
        ObDereferenceObject (Thread);
        return (STATUS_INSUFFICIENT_RESOURCES);
    }

    //
    // Initialize Mm
    //

    Thread->ReadClusterSize = MmReadClusterSize;

    //
    // Initialize LPC
    //

    KeInitializeSemaphore (&Thread->LpcReplySemaphore, 0L, 1L);
    InitializeListHead (&Thread->LpcReplyChain);

    //
    // Initialize Io
    //

    InitializeListHead (&Thread->IrpList);

    //
    // Initialize Registry
    //

    InitializeListHead (&Thread->PostBlockList);

    //
    // Initialize the thread lock
    //

    PspInitializeThreadLock (Thread);

    KeInitializeSpinLock (&Thread->ActiveTimerListLock);
    InitializeListHead (&Thread->ActiveTimerListHead);


    if (!ExAcquireRundownProtection (&Process->RundownProtect)) {
        ObDereferenceObject (Thread);
        return STATUS_PROCESS_IS_TERMINATING;
    }

    if (ARGUMENT_PRESENT (ThreadContext)) {

        //
        // User-mode thread. Create TEB etc
        //

        Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb);
        if (!NT_SUCCESS (Status)) {
            ExReleaseRundownProtection (&Process->RundownProtect);
            ObDereferenceObject (Thread);
            return Status;
        }


        try {
            //
            // Initialize kernel thread object for user mode thread.
            //

            Thread->StartAddress = (PVOID)CONTEXT_TO_PROGRAM_COUNTER(ThreadContext);

#if defined(_AMD64_)

            Thread->Win32StartAddress = (PVOID)ThreadContext->Rdx;

#elif defined(_X86_)

            Thread->Win32StartAddress = (PVOID)ThreadContext->Eax;

#else

#error "no target architecture"

#endif

        } except (EXCEPTION_EXECUTE_HANDLER) {

            Status = GetExceptionCode();
        }

        if (NT_SUCCESS (Status)) {
            Status = KeInitThread (&Thread->Tcb,
                                   NULL,
                                   PspUserThreadStartup,
                                   (PKSTART_ROUTINE)NULL,
                                   Thread->StartAddress,
                                   ThreadContext,
                                   Teb,
                                   &Process->Pcb);
       }


    } else {

        Teb = NULL;
        //
        // Set the system thread bit thats kept for all time
        //
        PS_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_SYSTEM);

        //
        // Initialize kernel thread object for kernel mode thread.
        //

        Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine;
        Status = KeInitThread (&Thread->Tcb,
                               NULL,
                               PspSystemThreadStartup,
                               StartRoutine,
                               StartContext,
                               NULL,
                               NULL,
                               &Process->Pcb);
    }


    if (!NT_SUCCESS (Status)) {
        if (Teb != NULL) {
            MmDeleteTeb(Process, Teb);
        }
        ExReleaseRundownProtection (&Process->RundownProtect);
        ObDereferenceObject (Thread);
        return Status;
    }

    PspLockProcessExclusive (Process, CurrentThread);
    //
    // Process is exiting or has had delete process called
    // We check the calling threads termination status so we
    // abort any thread creates while ExitProcess is being called --
    // but the call is blocked only if the new thread would be created
    // in the terminating thread's process.
    //
    if ((Process->Flags&PS_PROCESS_FLAGS_PROCESS_DELETE) != 0 ||
        (((CurrentThread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) != 0) &&
        (ThreadContext != NULL) &&
        (THREAD_TO_PROCESS(CurrentThread) == Process))) {

        PspUnlockProcessExclusive (Process, CurrentThread);

        KeUninitThread (&Thread->Tcb);

        if (Teb != NULL) {
            MmDeleteTeb(Process, Teb);
        }
        ExReleaseRundownProtection (&Process->RundownProtect);
        ObDereferenceObject(Thread);

        return STATUS_PROCESS_IS_TERMINATING;
    }


    OldActiveThreads = Process->ActiveThreads++;
    InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry);

    KeStartThread (&Thread->Tcb);

    PspUnlockProcessExclusive (Process, CurrentThread);

    ExReleaseRundownProtection (&Process->RundownProtect);

    //
    // Failures that occur after this point cause the thread to
    // go through PspExitThread
    //


    if (OldActiveThreads == 0) {
        PERFINFO_PROCESS_CREATE (Process);

        if (PspCreateProcessNotifyRoutineCount != 0) {
            ULONG i;
            PEX_CALLBACK_ROUTINE_BLOCK CallBack;
            PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;

            for (i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) {
                CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]);
                if (CallBack != NULL) {
                    Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack);
                    Rtn (Process->InheritedFromUniqueProcessId,
                         Process->UniqueProcessId,
                         TRUE);
                    ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i],
                                                CallBack);
                }
            }
        }
    }

    //
    // If the process has a job with a completion port,
    // AND if the process is really considered to be in the Job, AND
    // the process has not reported, report in
    //
    // This should really be done in add process to job, but can't
    // in this path because the process's ID isn't assigned until this point
    // in time
    //
    Job = Process->Job;
    if (Job != NULL && Job->CompletionPort &&
        !(Process->JobStatus & (PS_JOB_STATUS_NOT_REALLY_ACTIVE|PS_JOB_STATUS_NEW_PROCESS_REPORTED))) {

        PS_SET_BITS (&Process->JobStatus, PS_JOB_STATUS_NEW_PROCESS_REPORTED);

        KeEnterCriticalRegionThread (&CurrentThread->Tcb);
        ExAcquireResourceSharedLite (&Job->JobLock, TRUE);
        if (Job->CompletionPort != NULL) {
            IoSetIoCompletion (Job->CompletionPort,
                               Job->CompletionKey,
                               (PVOID)Process->UniqueProcessId,
                               STATUS_SUCCESS,
                               JOB_OBJECT_MSG_NEW_PROCESS,
                               FALSE);
        }
        ExReleaseResourceLite (&Job->JobLock);
        KeLeaveCriticalRegionThread (&CurrentThread->Tcb);
    }

    PERFINFO_THREAD_CREATE(Thread, InitialTeb);

    //
    // Notify registered callout routines of thread creation.
    //

    if (PspCreateThreadNotifyRoutineCount != 0) {
        ULONG i;
        PEX_CALLBACK_ROUTINE_BLOCK CallBack;
        PCREATE_THREAD_NOTIFY_ROUTINE Rtn;

        for (i = 0; i < PSP_MAX_CREATE_THREAD_NOTIFY; i++) {
            CallBack = ExReferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i]);
            if (CallBack != NULL) {
                Rtn = (PCREATE_THREAD_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack);
                Rtn (Thread->Cid.UniqueProcess,
                     Thread->Cid.UniqueThread,
                     TRUE);
                ExDereferenceCallBackBlock (&PspCreateThreadNotifyRoutine[i],
                                            CallBack);
            }
        }
    }


    //
    // Reference count of thread is biased once for itself and once for the handle if we create it.
    //

    ObReferenceObjectEx (Thread, 2);

    if (CreateSuspended) {
        try {
            KeSuspendThread (&Thread->Tcb);
        } except ((GetExceptionCode () == STATUS_SUSPEND_COUNT_EXCEEDED)?
                     EXCEPTION_EXECUTE_HANDLER :
                     EXCEPTION_CONTINUE_SEARCH) {
        }
        //
        // If deletion was started after we suspended then wake up the thread
        //
        if (Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_TERMINATED) {
            KeForceResumeThread (&Thread->Tcb);
        }
    }

    AccessState = NULL;
    if (!PsUseImpersonationToken) {
        AccessState = &LocalAccessState;
        Status = SeCreateAccessStateEx (NULL,
                                        ARGUMENT_PRESENT (ThreadContext)?PsGetCurrentProcessByThread (CurrentThread) : Process,
                                        AccessState,
                                        &AuxData,
                                        DesiredAccess,
                                        &PsThreadType->TypeInfo.GenericMapping);

        if (!NT_SUCCESS (Status)) {
            PS_SET_BITS (&Thread->CrossThreadFlags,
                         PS_CROSS_THREAD_FLAGS_DEADTHREAD);

            if (CreateSuspended) {
                (VOID) KeResumeThread (&Thread->Tcb);
            }
            KeReadyThread (&Thread->Tcb);
            ObDereferenceObjectEx (Thread, 2);

            return Status;
        }
    }

    Status = ObInsertObject (Thread,
                             AccessState,
                             DesiredAccess,
                             0,
                             NULL,
                             &LocalThreadHandle);

    if (AccessState != NULL) {
        SeDeleteAccessState (AccessState);
    }

    if (!NT_SUCCESS (Status)) {

        //
        // The insert failed. Terminate the thread.
        //

        //
        // This trick is used so that Dbgk doesn't report
        // events for dead threads
        //

        PS_SET_BITS (&Thread->CrossThreadFlags,
                     PS_CROSS_THREAD_FLAGS_DEADTHREAD);

        if (CreateSuspended) {
            KeResumeThread (&Thread->Tcb);
        }

    } else {

        try {

            *ThreadHandle = LocalThreadHandle;
            if (ARGUMENT_PRESENT (ClientId)) {
                *ClientId = Thread->Cid;
            }
        } except(EXCEPTION_EXECUTE_HANDLER) {

            PS_SET_BITS (&Thread->CrossThreadFlags,
                         PS_CROSS_THREAD_FLAGS_DEADTHREAD);

            if (CreateSuspended) {
                (VOID) KeResumeThread (&Thread->Tcb);
            }
            KeReadyThread (&Thread->Tcb);
            ObDereferenceObject (Thread);
            ObCloseHandle (LocalThreadHandle, PreviousMode);
            return GetExceptionCode();
        }
    }

    KeQuerySystemTime(&CreateTime);
    ASSERT ((CreateTime.HighPart & 0xf0000000) == 0);
    PS_SET_THREAD_CREATE_TIME(Thread, CreateTime);


    if ((Thread->CrossThreadFlags&PS_CROSS_THREAD_FLAGS_DEADTHREAD) == 0) {
        Status = ObGetObjectSecurity (Thread,
                                      &SecurityDescriptor,
                                      &MemoryAllocated);
        if (!NT_SUCCESS (Status)) {
            //
            // This trick us used so that Dbgk doesn't report
            // events for dead threads
            //
            PS_SET_BITS (&Thread->CrossThreadFlags,
                         PS_CROSS_THREAD_FLAGS_DEADTHREAD);

            if (CreateSuspended) {
                KeResumeThread(&Thread->Tcb);
            }
            KeReadyThread (&Thread->Tcb);
            ObDereferenceObject (Thread);
            ObCloseHandle (LocalThreadHandle, PreviousMode);
            return Status;
        }

        //
        // Compute the subject security context
        //

        SubjectContext.ProcessAuditId = Process;
        SubjectContext.PrimaryToken = PsReferencePrimaryToken(Process);
        SubjectContext.ClientToken = NULL;

        AccessCheck = SeAccessCheck (SecurityDescriptor,
                                     &SubjectContext,
                                     FALSE,
                                     MAXIMUM_ALLOWED,
                                     0,
                                     NULL,
                                     &PsThreadType->TypeInfo.GenericMapping,
                                     PreviousMode,
                                     &Thread->GrantedAccess,
                                     &accesst);

        PsDereferencePrimaryTokenEx (Process, SubjectContext.PrimaryToken);

        ObReleaseObjectSecurity (SecurityDescriptor,
                                 MemoryAllocated);

        if (!AccessCheck) {
            Thread->GrantedAccess = 0;
        }

        Thread->GrantedAccess |= (THREAD_TERMINATE | THREAD_SET_INFORMATION | THREAD_QUERY_INFORMATION);

    } else {
        Thread->GrantedAccess = THREAD_ALL_ACCESS;
    }

    KeReadyThread (&Thread->Tcb);
    ObDereferenceObject (Thread);

    return Status;
}

  继续分析PspCreateThread函数实现的关键步骤:

 

  (1)ObCreateObject创建一个线程对象ETHREAD,并初始化为零。

    Status = ObCreateObject (PreviousMode,
                             PsThreadType,
                             ObjectAttributes,
                             PreviousMode,
                             NULL,
                             sizeof(ETHREAD),
                             0,
                             0,
                             &Thread);

    if (!NT_SUCCESS (Status)) {
        ObDereferenceObject (Process);
        return Status;
    }

    RtlZeroMemory (Thread, sizeof (ETHREAD));

  (2)ExCreateHandle函数创建线程ID

Thread->ThreadsProcess = Process;

    Thread->Cid.UniqueProcess = Process->UniqueProcessId;

    CidEntry.Object = Thread;
    CidEntry.GrantedAccess = 0;
    Thread->Cid.UniqueThread = ExCreateHandle (PspCidTable, &CidEntry);

    if (Thread->Cid.UniqueThread == NULL) {
        ObDereferenceObject (Thread);
        return (STATUS_INSUFFICIENT_RESOURCES);
    }

  (3)MmCreateTeb函数创建TEB

Status = MmCreateTeb (Process, InitialTeb, &Thread->Cid, &Teb);
        if (!NT_SUCCESS (Status)) {
            ExReleaseRundownProtection (&Process->RundownProtect);
            ObDereferenceObject (Thread);
            return Status;
        }

  (4)利用ThreadContext中的程序指针(Eip寄存器)来设置线程的启动地址

       Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine;

  (5)InsertTailList 函数将线程插入线程LIST_ENTRY链表

 

OldActiveThreads = Process->ActiveThreads++;
    InsertTailList (&Process->ThreadListHead, &Thread->ThreadListEntry);

 

  (6)判断如果这个线程是进程中的第一个进程,回调函数则触发进程的创建通知

if (OldActiveThreads == 0) {
        PERFINFO_PROCESS_CREATE (Process);

        if (PspCreateProcessNotifyRoutineCount != 0) {
            ULONG i;
            PEX_CALLBACK_ROUTINE_BLOCK CallBack;
            PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;

            for (i=0; i<PSP_MAX_CREATE_PROCESS_NOTIFY; i++) {
                CallBack = ExReferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i]);
                if (CallBack != NULL) {
                    Rtn = (PCREATE_PROCESS_NOTIFY_ROUTINE) ExGetCallBackBlockRoutine (CallBack);
                    Rtn (Process->InheritedFromUniqueProcessId,
                         Process->UniqueProcessId,
                         TRUE);
                    ExDereferenceCallBackBlock (&PspCreateProcessNotifyRoutine[i],
                                                CallBack);
                }
            }
        }
    }

  (7)ObInsertObject函数将线程对象插入到当前进程的句柄表中

  

    Status = ObInsertObject (Thread,
                             AccessState,
                             DesiredAccess,
                             0,
                             NULL,
                             &LocalThreadHandle);

  (8)KeReadyThread函数使线程进入“就绪”状态,准备马上执行

  

    KeReadyThread (&Thread->Tcb);
    ObDereferenceObject (Thread);

  到目前为止进程对象和线程对象的创建工作就完成了。

 

 

 

 

 

 

 

0x03  创建进程详细步骤2: 通知windows子系统有新进程创建,启动初始线程,用户空间的初始化和Dll连接

 

  四:通知windows子系统

 
  每个进程在创建/退出的时候都要向windows子系统进程csrss.exe进程发出通知,因为它担负着对windows所有进程的管理的责任,
注意,这里发出通知的是CreateProcess的调用者,不是新建出来的进程,因为它还没有开始运行
 
  至此,CreateProcess的操作已经完成,但子进程中的线程却尚未开始运行,它的运行还要经历下面的第五和第六阶段。
 
  五:启动初始线程
 

  在内核中,新线程的启动例程是KiThreadStartup函数,这是当PspCreateThread 调用KeInitThread 函数时,KeInitThread 函数调用KiInitializeContextThread(参见base\ntos\ke\i386\thredini.c 文件)来设置的。

KiThreadStartup 函数首先将IRQL 降低到APC_LEVEL,然后调用系统初始的线程函数PspUserThreadStartup。这里的PspUserThreadStartup 函数是PspCreateThread 函数在调用KeInitThread 时指定的,。注意,PspCreateThread函数在创建系统线程时指定的初始线程函数为PspSystemThreadStartup  。线程启动函数被作为一个参数传递给PspUserThreadStartup,在这里,它应该是kernel32.dll 中的BaseProcessStart。

PspUserThreadStartup 函数被调用。逻辑并不复杂,但是涉及异步函数调用(APC)机制。

 

  新创建的线程未必是可以被立即调度运行的,因为用户可能在创建时把标志位CREATE_ SUSPENDED设成了1;
如果那样的话,就需要等待别的进程通过系统调用恢复其运行资格以后才可以被调度运行。否则现在已经可以被调度运行了。至于什么时候才会被调度运行,则就要看优先级等等条件了。
 
 
  六:用户空间的初始化和Dll连接
 

  PspUserThreadStartup 函数返回以后,KiThreadStartup 函数返回到用户模式,此时,PspUserThreadStartup 插入的APC 被交付,于是LdrInitializeThunk 函数被调用,这是映像加载器(image loader)的初始化函数。LdrInitializeThunk 函数完成加载器、堆管理器等初始化工作,然后加载任何必要的DLL,并且调用这些DLL 的入口函数。最后,当LdrInitializeThunk 返回到用户模式APC 分发器时,该线程开始在用户模式下执行,调用应用程序指定的线程启动函数,此启动函数的地址已经在APC 交付时被压到用户栈中。


  DLL连接由ntdll.dll中的LdrInitializeThunk()在用户空间完成。在此之前ntdll.dll与应用软件尚未连接,但是已经被映射到了用户空间
函数LdrInitializeThunk()在映像中的位置是系统初始化时就预先确定并记录在案的,所以在进入这个函数之前也不需要连接。

 

 

 

0x04  最后总结一下整个流程

    1.打开目标映像文件(NtOpenFile()获取句柄, NtCreateSectiont通过文件句柄创建一个Section文件映射区,将文件内容映射进来

    2.创建进程对象

       NtCreateProcess——>NtCreateProcessEx——>PspCreateProcess——>

                           ObCreateObject函数创建EPROCESS

                           MmCreateProcessAddressSpace创建新的地址空间,MmInitializeProcessAddressSpace 初始化新进程的地址空间

                           ExCreateHandle函数在CID句柄表中创建一个进程ID项。

                              MmCreatePeb 创建一个PEB,如果进程通过映像内存区来创建,创建一个PEB,如果是进程拷贝,则使用继承的PEB。

                           InsertTailList 函数把新进程加入全局的LIST_ENTRY进程链表中(位置:PsActiveProcessHead)

                           ObInsertObject 将新进程对象记录到当前进程的句柄表中。

        3.创建线程对象

      NtCreateThread——>PspCreateThread——>

                           ObCreateObject创建一个线程对象ETHREAD,并初始化为零。

                           ExCreateHandle函数创建线程ID

                           MmCreateTeb函数创建TEB

                           利用ThreadContext中的程序指针(Eip寄存器)来设置线程的启动地址Thread->StartAddress = (PKSTART_ROUTINE) StartRoutine;

                              InsertTailList 函数将线程插入线程LIST_ENTRY链表

                           判断如果这个线程是进程中的第一个进程,回调函数则触发进程的创建通知PCREATE_PROCESS_NOTIFY_ROUTINE Rtn;

                              ObInsertObject函数将线程对象插入到当前进程的句柄表中

                              KeReadyThread函数使线程进入“就绪”状态,准备马上执行

    4.通知windows子系统

     CreateProcess的调用者向windows子系统进程csrss.exe进程发出进程创建通知

    5.启动初始线程

       在内核中,新线程的启动例程是KiThreadStartup函数,这是当PspCreateThread 调用KeInitThread 函数时,KeInitThread 函数调用KiInitializeContextThread(参见base\ntos\ke\i386\thredini.c 文件)来设置的。

    6.用户空间的初始化和Dll连接

     DLL连接由ntdll.dll中的LdrInitializeThunk()在用户空间完成

展开阅读全文

没有更多推荐了,返回首页