{"id":505,"date":"2012-06-08T17:20:14","date_gmt":"2012-06-08T09:20:14","guid":{"rendered":"http:\/\/newbiecoder.0ginr.com\/blog\/?p=505"},"modified":"2012-06-08T17:21:30","modified_gmt":"2012-06-08T09:21:30","slug":"%e4%bd%bf%e7%94%a8-native-api-%e5%88%9b%e5%bb%ba%e8%bf%9b%e7%a8%8b-vista","status":"publish","type":"post","link":"https:\/\/newbiecoder.0ginr.com\/blog\/?p=505","title":{"rendered":"\u4f7f\u7528 Native API \u521b\u5efa\u8fdb\u7a0b (Vista+)"},"content":{"rendered":"

Vista+ \u628a\u5f88\u591a\u4e8b\u60c5\u90fd\u632a\u5230\u5185\u6838\u91cc\u9762\u53bb\u4e86\uff0c\u597d\u50cf\u662f\u56e0\u4e3a\u201c\u53d7\u4fdd\u62a4\u7684\u8fdb\u7a0b\u201d\u7684\u539f\u56e0\u3002<\/p>\n

#include <\/p>\n

\/\/
\n\/\/ \u7528\u5230\u7684\u5404\u79cd\u5b8f\u3001\u7c7b\u578b\u3001\u51fd\u6570\u7684\u58f0\u660e\u3002
\n\/\/<\/p>\n

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
\n#define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009AL)<\/p>\n

typedef __success(return >= 0) LONG NTSTATUS;
\ntypedef NTSTATUS *PNTSTATUS;<\/p>\n

#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)<\/p>\n

typedef struct _STRING
\n{
\n USHORT Length;
\n USHORT MaximumLength;
\n __field_bcount_part_opt(MaximumLength, Length) PCHAR Buffer;
\n} STRING, *PSTRING, ANSI_STRING, *PANSI_STRING, OEM_STRING, *POEM_STRING;<\/p>\n

typedef struct _UNICODE_STRING
\n{
\n USHORT Length;
\n USHORT MaximumLength;
\n __field_bcount_part(MaximumLength, Length) PWCH Buffer;
\n} UNICODE_STRING, *PUNICODE_STRING;<\/p>\n

#define RTL_CONSTANT_STRING(s) { sizeof(s) - sizeof((s)[0]), sizeof(s), s }<\/p>\n

typedef struct _OBJECT_ATTRIBUTES
\n{
\n ULONG Length;
\n HANDLE RootDirectory;
\n PUNICODE_STRING ObjectName;
\n ULONG Attributes;
\n PVOID SecurityDescriptor;
\n PVOID SecurityQualityOfService;
\n} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;<\/p>\n

#define DOS_MAX_COMPONENT_LENGTH 255
\n#define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5)<\/p>\n

typedef struct _CURDIR
\n{
\n UNICODE_STRING DosPath;
\n HANDLE Handle;
\n} CURDIR, *PCURDIR;<\/p>\n

#define RTL_USER_PROC_CURDIR_CLOSE 0x00000002
\n#define RTL_USER_PROC_CURDIR_INHERIT 0x00000003<\/p>\n

typedef struct _RTL_DRIVE_LETTER_CURDIR
\n{
\n USHORT Flags;
\n USHORT Length;
\n ULONG TimeStamp;
\n STRING DosPath;
\n} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;<\/p>\n

#define RTL_MAX_DRIVE_LETTERS 32
\n#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001<\/p>\n

typedef struct _RTL_USER_PROCESS_PARAMETERS
\n{
\n ULONG MaximumLength;
\n ULONG Length;<\/p>\n

ULONG Flags;
\n ULONG DebugFlags;<\/p>\n

HANDLE ConsoleHandle;
\n ULONG ConsoleFlags;
\n HANDLE StandardInput;
\n HANDLE StandardOutput;
\n HANDLE StandardError;<\/p>\n

CURDIR CurrentDirectory;
\n UNICODE_STRING DllPath;
\n UNICODE_STRING ImagePathName;
\n UNICODE_STRING CommandLine;
\n PVOID Environment;<\/p>\n

ULONG StartingX;
\n ULONG StartingY;
\n ULONG CountX;
\n ULONG CountY;
\n ULONG CountCharsX;
\n ULONG CountCharsY;
\n ULONG FillAttribute;<\/p>\n

ULONG WindowFlags;
\n ULONG ShowWindowFlags;
\n UNICODE_STRING WindowTitle;
\n UNICODE_STRING DesktopInfo;
\n UNICODE_STRING ShellInfo;
\n UNICODE_STRING RuntimeData;
\n RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS];<\/p>\n

ULONG EnvironmentSize;
\n ULONG EnvironmentVersion;
\n} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;<\/p>\n

#define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001<\/p>\n

\/\/ begin_rev
\n#define PS_ATTRIBUTE_NUMBER_MASK 0x0000ffff
\n#define PS_ATTRIBUTE_THREAD 0x00010000 \/\/ can be used with threads
\n#define PS_ATTRIBUTE_INPUT 0x00020000 \/\/ input only
\n#define PS_ATTRIBUTE_UNKNOWN 0x00040000
\n\/\/ end_rev<\/p>\n

\/\/ private
\ntypedef enum _PS_ATTRIBUTE_NUM
\n{
\n PsAttributeParentProcess, \/\/ in HANDLE
\n PsAttributeDebugPort, \/\/ in HANDLE
\n PsAttributeToken, \/\/ in HANDLE
\n PsAttributeClientId, \/\/ out PCLIENT_ID
\n PsAttributeTebAddress, \/\/ out PTEB *
\n PsAttributeImageName, \/\/ in PWSTR
\n PsAttributeImageInfo, \/\/ out PSECTION_IMAGE_INFORMATION
\n PsAttributeMemoryReserve, \/\/ in PPS_MEMORY_RESERVE
\n PsAttributePriorityClass, \/\/ in UCHAR
\n PsAttributeErrorMode, \/\/ in ULONG
\n PsAttributeStdHandleInfo, \/\/ 10, in PPS_STD_HANDLE_INFO
\n PsAttributeHandleList, \/\/ in PHANDLE
\n PsAttributeGroupAffinity, \/\/ in PGROUP_AFFINITY
\n PsAttributePreferredNode, \/\/ in PUSHORT
\n PsAttributeIdealProcessor, \/\/ in PPROCESSOR_NUMBER
\n PsAttributeUmsThread, \/\/ ? in PUMS_CREATE_THREAD_ATTRIBUTES
\n PsAttributeMitigationOptions, \/\/ in UCHAR
\n PsAttributeMax
\n} PS_ATTRIBUTE_NUM;<\/p>\n

\/\/ begin_rev<\/p>\n

#define PsAttributeValue(Number, Thread, Input, Unknown) \\
\n (((Number) & PS_ATTRIBUTE_NUMBER_MASK) | \\
\n ((Thread) ? PS_ATTRIBUTE_THREAD : 0) | \\
\n ((Input) ? PS_ATTRIBUTE_INPUT : 0) | \\
\n ((Unknown) ? PS_ATTRIBUTE_UNKNOWN : 0))<\/p>\n

#define PS_ATTRIBUTE_PARENT_PROCESS \\
\n PsAttributeValue(PsAttributeParentProcess, FALSE, TRUE, TRUE)
\n#define PS_ATTRIBUTE_DEBUG_PORT \\
\n PsAttributeValue(PsAttributeDebugPort, FALSE, TRUE, TRUE)
\n#define PS_ATTRIBUTE_TOKEN \\
\n PsAttributeValue(PsAttributeToken, FALSE, TRUE, TRUE)
\n#define PS_ATTRIBUTE_CLIENT_ID \\
\n PsAttributeValue(PsAttributeClientId, TRUE, FALSE, FALSE)
\n#define PS_ATTRIBUTE_TEB_ADDRESS \\
\n PsAttributeValue(PsAttributeTebAddress, TRUE, FALSE, FALSE)
\n#define PS_ATTRIBUTE_IMAGE_NAME \\
\n PsAttributeValue(PsAttributeImageName, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_IMAGE_INFO \\
\n PsAttributeValue(PsAttributeImageInfo, FALSE, FALSE, FALSE)
\n#define PS_ATTRIBUTE_MEMORY_RESERVE \\
\n PsAttributeValue(PsAttributeMemoryReserve, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_PRIORITY_CLASS \\
\n PsAttributeValue(PsAttributePriorityClass, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_ERROR_MODE \\
\n PsAttributeValue(PsAttributeErrorMode, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_STD_HANDLE_INFO \\
\n PsAttributeValue(PsAttributeStdHandleInfo, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_HANDLE_LIST \\
\n PsAttributeValue(PsAttributeHandleList, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_GROUP_AFFINITY \\
\n PsAttributeValue(PsAttributeGroupAffinity, TRUE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_PREFERRED_NODE \\
\n PsAttributeValue(PsAttributePreferredNode, FALSE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_IDEAL_PROCESSOR \\
\n PsAttributeValue(PsAttributeIdealProcessor, TRUE, TRUE, FALSE)
\n#define PS_ATTRIBUTE_MITIGATION_OPTIONS \\
\n PsAttributeValue(PsAttributeMitigationOptions, FALSE, TRUE, TRUE)<\/p>\n

\/\/ end_rev<\/p>\n

\/\/ begin_private<\/p>\n

typedef struct _PS_ATTRIBUTE
\n{
\n ULONG Attribute;
\n SIZE_T Size;
\n union
\n {
\n ULONG Value;
\n PVOID ValuePtr;
\n };
\n PSIZE_T ReturnLength;
\n} PS_ATTRIBUTE, *PPS_ATTRIBUTE;<\/p>\n

typedef struct _PS_ATTRIBUTE_LIST
\n{
\n SIZE_T TotalLength;
\n PS_ATTRIBUTE Attributes[1];
\n} PS_ATTRIBUTE_LIST, *PPS_ATTRIBUTE_LIST;<\/p>\n

typedef struct _PS_MEMORY_RESERVE
\n{
\n PVOID ReserveAddress;
\n SIZE_T ReserveSize;
\n} PS_MEMORY_RESERVE, *PPS_MEMORY_RESERVE;<\/p>\n

typedef enum _PS_STD_HANDLE_STATE
\n{
\n PsNeverDuplicate,
\n PsRequestDuplicate, \/\/ duplicate standard handles specified by PseudoHandleMask, and only if StdHandleSubsystemType matches the image subsystem
\n PsAlwaysDuplicate, \/\/ always duplicate standard handles
\n PsMaxStdHandleStates
\n} PS_STD_HANDLE_STATE;<\/p>\n

\/\/ begin_rev
\n#define PS_STD_INPUT_HANDLE 0x1
\n#define PS_STD_OUTPUT_HANDLE 0x2
\n#define PS_STD_ERROR_HANDLE 0x4
\n\/\/ end_rev<\/p>\n

typedef struct _PS_STD_HANDLE_INFO
\n{
\n union
\n {
\n ULONG Flags;
\n struct
\n {
\n ULONG StdHandleState : 2; \/\/ PS_STD_HANDLE_STATE
\n ULONG PseudoHandleMask : 3; \/\/ PS_STD_*
\n };
\n };
\n ULONG StdHandleSubsystemType;
\n} PS_STD_HANDLE_INFO, *PPS_STD_HANDLE_INFO;<\/p>\n

\/\/ windows-internals-book:\"Chapter 5\"
\ntypedef enum _PS_CREATE_STATE
\n{
\n PsCreateInitialState,
\n PsCreateFailOnFileOpen,
\n PsCreateFailOnSectionCreate,
\n PsCreateFailExeFormat,
\n PsCreateFailMachineMismatch,
\n PsCreateFailExeName, \/\/ Debugger specified
\n PsCreateSuccess,
\n PsCreateMaximumStates
\n} PS_CREATE_STATE;<\/p>\n

typedef enum _PS_IFEO_KEY_STATE
\n{
\n PsReadIFEOAllValues,
\n PsSkipIFEODebugger,
\n PsSkipAllIFEO,
\n PsMaxIFEOKeyStates
\n} PS_IFEO_KEY_STATE, *PPS_IFEO_KEY_STATE;<\/p>\n

typedef struct _PS_CREATE_INFO
\n{
\n SIZE_T Size;
\n PS_CREATE_STATE State;
\n union
\n {
\n \/\/ PsCreateInitialState
\n struct
\n {
\n union
\n {
\n ULONG InitFlags;
\n struct
\n {
\n UCHAR WriteOutputOnExit : 1;
\n UCHAR DetectManifest : 1;
\n UCHAR SpareBits1 : 6;
\n UCHAR IFEOKeyState : 2; \/\/ PS_IFEO_KEY_STATE
\n UCHAR SpareBits2 : 6;
\n USHORT ProhibitedImageCharacteristics : 16;
\n };
\n };
\n ACCESS_MASK AdditionalFileAccess;
\n } InitState;<\/p>\n

\/\/ PsCreateFailOnSectionCreate
\n struct
\n {
\n HANDLE FileHandle;
\n } FailSection;<\/p>\n

\/\/ PsCreateFailExeName
\n struct
\n {
\n HANDLE IFEOKey;
\n } ExeName;<\/p>\n

\/\/ PsCreateSuccess
\n struct
\n {
\n union
\n {
\n ULONG OutputFlags;
\n struct
\n {
\n UCHAR ProtectedProcess : 1;
\n UCHAR AddressSpaceOverride : 1;
\n UCHAR DevOverrideEnabled : 1; \/\/ from Image File Execution Options
\n UCHAR ManifestDetected : 1;
\n UCHAR SpareBits1 : 4;
\n UCHAR SpareBits2 : 8;
\n USHORT SpareBits3 : 16;
\n };
\n };
\n HANDLE FileHandle;
\n HANDLE SectionHandle;
\n ULONGLONG UserProcessParametersNative;
\n ULONG UserProcessParametersWow64;
\n ULONG CurrentParameterFlags;
\n ULONGLONG PebAddressNative;
\n ULONG PebAddressWow64;
\n ULONGLONG ManifestAddress;
\n ULONG ManifestSize;
\n } SuccessState;
\n };
\n} PS_CREATE_INFO, *PPS_CREATE_INFO;<\/p>\n

extern \"C\"
\nNTSYSCALLAPI
\nNTSTATUS
\nNTAPI
\nZwCreateUserProcess(
\n __out PHANDLE ProcessHandle,
\n __out PHANDLE ThreadHandle,
\n __in ACCESS_MASK ProcessDesiredAccess,
\n __in ACCESS_MASK ThreadDesiredAccess,
\n __in_opt POBJECT_ATTRIBUTES ProcessObjectAttributes,
\n __in_opt POBJECT_ATTRIBUTES ThreadObjectAttributes,
\n __in ULONG ProcessFlags,
\n __in ULONG ThreadFlags,
\n __in_opt PRTL_USER_PROCESS_PARAMETERS ProcessParameters,
\n __inout PPS_CREATE_INFO CreateInfo,
\n __in_opt PPS_ATTRIBUTE_LIST AttributeList
\n );;<\/p>\n

#define IMAGE_PATH L\"\\\\??\\\\C:\\\\Windows\\\\System32\\\\cmd.exe\"<\/p>\n

#define PointerAdd(Pointer, Increment, ResultType) ((ResultType)((ULONG_PTR)(Pointer) \\
\n\t+ (ULONG_PTR)(Increment)))<\/p>\n

#define RoundUp(Value, Alignment) (((Value) + (Alignment) - 1) \/ (Alignment) * (Alignment))<\/p>\n

\/\/
\n\/\/ \u521b\u5efa\u7528\u6237\u8fdb\u7a0b\u53c2\u6570\u3002
\n\/\/<\/p>\n

static NTSTATUS PsCreateProcessParameters(
\n\tOUT PRTL_USER_PROCESS_PARAMETERS *ProcessParameters,
\n\tIN PUNICODE_STRING ImagePath,
\n\tIN PUNICODE_STRING CurrentDirectory,
\n\tIN PWSTR Environment,
\n\tIN ULONG EnvironmentSize
\n\t)
\n{
\n\tstatic UNICODE_STRING EmptyUnicodeString = RTL_CONSTANT_STRING(L\"\");
\n\tstatic UNICODE_STRING DefaultDesktop = RTL_CONSTANT_STRING(L\"Winsta0\\\\Default\");<\/p>\n

\tPRTL_USER_PROCESS_PARAMETERS LocalProcessParameters;
\n\tPUNICODE_STRING CommandLine, WindowTitle, DesktopInfo, ShellInfo, RuntimeData, DllPath;
\n\tULONG ProcessParametersSize;
\n\tPWSTR CurrentString;<\/p>\n

\tCommandLine = ImagePath;
\n\tDllPath = &EmptyUnicodeString;
\n\tWindowTitle = &EmptyUnicodeString;
\n\tDesktopInfo = &DefaultDesktop;
\n\tShellInfo = &EmptyUnicodeString;
\n\tRuntimeData = &EmptyUnicodeString;<\/p>\n

\t\/\/
\n\t\/\/ \u8ba1\u7b97\u7528\u6237\u8fdb\u7a0b\u53c2\u6570\u7684\u5927\u5c0f\u3002
\n\t\/\/<\/p>\n

\tProcessParametersSize = sizeof(RTL_USER_PROCESS_PARAMETERS) +
\n\t\tRoundUp(ImagePath->Length + sizeof(UNICODE_NULL), sizeof(ULONG)) +
\n\t\tRoundUp(CommandLine->Length + sizeof(UNICODE_NULL), sizeof(ULONG)) +
\n\t\tRoundUp(DllPath->MaximumLength, sizeof(ULONG)) +
\n\t\tRoundUp(WindowTitle->MaximumLength, sizeof(ULONG)) +
\n\t\tRoundUp(DesktopInfo->MaximumLength, sizeof(ULONG)) +
\n\t\tRoundUp(ShellInfo->MaximumLength, sizeof(ULONG)) +
\n\t\tRoundUp(RuntimeData->MaximumLength, sizeof(ULONG)) +
\n\t\tRoundUp(DOS_MAX_PATH_LENGTH \/ sizeof(CHAR) * sizeof(WCHAR), sizeof(ULONG));<\/p>\n

\t\/\/
\n\t\/\/ \u4e3a\u7528\u6237\u8fdb\u7a0b\u53c2\u6570\u5206\u914d\u5185\u5b58\u3002
\n\t\/\/<\/p>\n

\tLocalProcessParameters = (PRTL_USER_PROCESS_PARAMETERS)malloc(ProcessParametersSize);<\/p>\n

\tif (!LocalProcessParameters) {
\n\t\treturn STATUS_INSUFFICIENT_RESOURCES;
\n\t}<\/p>\n

\t\/\/
\n\t\/\/ \u521d\u59cb\u5316\u7528\u6237\u8fdb\u7a0b\u53c2\u6570\u3002
\n\t\/\/<\/p>\n

\tRtlZeroMemory(LocalProcessParameters, ProcessParametersSize);<\/p>\n

\tLocalProcessParameters->Length = LocalProcessParameters->MaximumLength =
\n\t\tProcessParametersSize;
\n\tLocalProcessParameters->Flags = RTL_USER_PROC_PARAMS_NORMALIZED;
\n\tLocalProcessParameters->DebugFlags = 0;
\n\tLocalProcessParameters->Environment = (PVOID)Environment;
\n\tLocalProcessParameters->EnvironmentSize = EnvironmentSize;
\n\tLocalProcessParameters->CurrentDirectory.Handle = 0;
\n\tLocalProcessParameters->ConsoleFlags = 0;<\/p>\n

\t\/\/
\n\t\/\/ \u590d\u5236\u5b57\u7b26\u4e32\u3002
\n\t\/\/<\/p>\n

#define PspCopyUnicodeString(BufferPointer, Destination, Source, AllocationSize) \\
\n\t(Destination)->Buffer = BufferPointer; \\
\n\t(Destination)->Length = (Source)->Length; \\
\n\t(Destination)->MaximumLength = AllocationSize; \\
\n\tRtlCopyMemory(BufferPointer, (PVOID)(Source)->Buffer, Source->Length); \\
\n\tBufferPointer = PointerAdd(BufferPointer, RoundUp( \\
\n\t\tAllocationSize, sizeof(ULONG)), PWSTR);<\/p>\n

\tCurrentString = (PWCHAR)(LocalProcessParameters + 1);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->ImagePathName,
\n\t\tImagePath, ImagePath->Length + sizeof(UNICODE_NULL));<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->CommandLine,
\n\t\tCommandLine, CommandLine->Length + sizeof(UNICODE_NULL));<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->DllPath,
\n\t\tDllPath, DllPath->MaximumLength);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->WindowTitle,
\n\t\tWindowTitle, WindowTitle->MaximumLength);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->DesktopInfo,
\n\t\tDesktopInfo, DesktopInfo->MaximumLength);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->ShellInfo,
\n\t\tShellInfo, ShellInfo->MaximumLength);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->RuntimeData,
\n\t\tRuntimeData, RuntimeData->MaximumLength);<\/p>\n

\tPspCopyUnicodeString(CurrentString, &LocalProcessParameters->CurrentDirectory.DosPath,
\n\t\tCurrentDirectory, DOS_MAX_PATH_LENGTH \/ sizeof(CHAR) * sizeof(WCHAR));<\/p>\n

#undef PspCopyUnicodeString<\/p>\n

\t\/\/
\n\t\/\/ \u8fd4\u56de\u7ed3\u679c\u7ed9\u8c03\u7528\u65b9\u3002
\n\t\/\/<\/p>\n

\t*ProcessParameters = LocalProcessParameters;<\/p>\n

\treturn STATUS_SUCCESS;
\n}<\/p>\n

\/\/
\n\/\/ \u91ca\u653e\u7528\u6237\u8fdb\u7a0b\u53c2\u6570\u3002
\n\/\/<\/p>\n

static VOID PsFreeProcessParameters(
\n\tIN PRTL_USER_PROCESS_PARAMETERS ProcessParameters
\n\t)
\n{
\n\tfree((PVOID)ProcessParameters);<\/p>\n

\treturn;
\n}<\/p>\n

\/\/
\n\/\/ \u521b\u5efa\u73af\u5883\u53d8\u91cf\u4fe1\u606f\u3002
\n\/\/<\/p>\n

static NTSTATUS PsCreateEnvironment(
\n\tOUT PWSTR *Environment,
\n\tOUT ULONG *EnvironmentSize
\n\t)
\n{
\n\tstatic PWSTR LocalEnvironment = L\"\\0\";<\/p>\n

\t\/\/
\n\t\/\/ FIX: \u76ee\u524d\u53ea\u662f\u8fd4\u56de\u4e00\u4e2a\u7a7a\u7684\u73af\u5883\u53d8\u91cf\u4fe1\u606f\u3002\u5e94\u6539\u4e3a\u4ece\u6ce8\u518c\u8868\uff08
\n\t\/\/ Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\uff09
\n\t\/\/ \u67e5\u8be2\u3002
\n\t\/\/
\n\t\/\/ \u73af\u5883\u53d8\u91cf\u4fe1\u606f\u4e5f\u53ef\u4ee5\u4ece PEB \u4e2d\u83b7\u53d6\u3002
\n\t\/\/<\/p>\n

\t*Environment = LocalEnvironment;
\n\t*EnvironmentSize = sizeof(LocalEnvironment);<\/p>\n

\treturn STATUS_SUCCESS;
\n}<\/p>\n

\/\/
\n\/\/ \u91ca\u653e\u73af\u5883\u53d8\u91cf\u4fe1\u606f\u3002
\n\/\/<\/p>\n

static VOID PsFreeEnvironment(
\n\tIN PWSTR Environment
\n\t)
\n{
\n\t\/\/
\n\t\/\/ \u56e0\u4e3a\u76ee\u524d\u73af\u5883\u53d8\u91cf\u4fe1\u606f\u662f\u4e00\u4e2a\u9759\u6001\u53d8\u91cf\uff0c\u56e0\u6b64\u4e0d\u9700\u91ca\u653e\u3002
\n\t\/\/<\/p>\n

\tUNREFERENCED_PARAMETER(Environment);<\/p>\n

\treturn;
\n}<\/p>\n

\/\/
\n\/\/ \u521b\u5efa\u8fdb\u7a0b\u3002
\n\/\/<\/p>\n

NTSTATUS PsCreateProcess(
\n\tOUT HANDLE *ProcessHandle,
\n\tOUT HANDLE *ThreadHandle,
\n\tIN PUNICODE_STRING ImagePath
\n\t)
\n{
\n\tstatic UNICODE_STRING CurrentDirectory = RTL_CONSTANT_STRING(L\"C:\\\\\");<\/p>\n

\tPRTL_USER_PROCESS_PARAMETERS ProcessParameters;
\n\tPWSTR Environment;
\n\tULONG EnvironmentSize;
\n\tPS_CREATE_INFO CreateInfo = {0};
\n\tPS_ATTRIBUTE_LIST AttributeList = {0};
\n\tNTSTATUS Status;<\/p>\n

\t\/\/
\n\t\/\/ \u521b\u5efa\u73af\u5883\u53d8\u91cf\u3002
\n\t\/\/<\/p>\n

\tStatus = PsCreateEnvironment(&Environment, &EnvironmentSize);<\/p>\n

\tif (!NT_SUCCESS(Status)) {
\n\t\treturn Status;
\n\t}<\/p>\n

\t\/\/
\n\t\/\/ \u521b\u5efa\u8fdb\u7a0b\u53c2\u6570\u3002
\n\t\/\/<\/p>\n

\tStatus = PsCreateProcessParameters(&ProcessParameters, ImagePath, &CurrentDirectory,
\n\t\tEnvironment, EnvironmentSize);<\/p>\n

\tif (!NT_SUCCESS(Status)) {
\n\t\tPsFreeEnvironment(Environment);<\/p>\n

\t\treturn Status;
\n\t}<\/p>\n

\t\/\/
\n\t\/\/ \u521d\u59cb\u5316 PS_CREATE_INFO \u7ed3\u6784\u4f53\u3002
\n\t\/\/<\/p>\n

\tCreateInfo.Size = sizeof(PS_CREATE_INFO);
\n\tCreateInfo.State = PsCreateInitialState;<\/p>\n

\t\/\/
\n\t\/\/ \u5c06\u6587\u4ef6\u540d\u901a\u8fc7 PS_ATTRIBUTE_LIST \u4f20\u7ed9 ZwCreateUserProcess\u3002
\n\t\/\/<\/p>\n

\tAttributeList.TotalLength = sizeof(PS_ATTRIBUTE_LIST);
\n\tAttributeList.Attributes[0].Attribute = PS_ATTRIBUTE_IMAGE_NAME;
\n\tAttributeList.Attributes[0].Size = ImagePath->Length;
\n\tAttributeList.Attributes[0].ValuePtr = (PVOID)ImagePath->Buffer;<\/p>\n

\t\/\/
\n\t\/\/ \u521b\u5efa\u8fdb\u7a0b\u3002
\n\t\/\/<\/p>\n

\tStatus = ZwCreateUserProcess(ProcessHandle, ThreadHandle, MAXIMUM_ALLOWED, MAXIMUM_ALLOWED,
\n\t\tNULL, NULL, 0, 0, ProcessParameters, &CreateInfo, &AttributeList);<\/p>\n

\tPsFreeProcessParameters(ProcessParameters);
\n\tPsFreeEnvironment(Environment);<\/p>\n

\tif (!NT_SUCCESS(Status)) {
\n\t\treturn Status;
\n\t}<\/p>\n

\treturn Status;
\n}<\/p>\n

int main() {
\n\tstatic UNICODE_STRING strImagePath = RTL_CONSTANT_STRING(IMAGE_PATH);<\/p>\n

\tHANDLE hProcess, hThread;
\n\tNTSTATUS Status;<\/p>\n

\tStatus = PsCreateProcess(&hThread, &hProcess, &strImagePath);<\/p>\n

\tif (NT_SUCCESS(Status)) {
\n\t\tCloseHandle(hThread);
\n\t\tCloseHandle(hProcess);
\n\t}<\/p>\n

\treturn 0;
\n}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Vista+ \u628a\u5f88\u591a\u4e8b\u60c5\u90fd\u632a\u5230\u5185\u6838\u91cc\u9762\u53bb\u4e86\uff0c\u597d\u50cf\u662f\u56e0\u4e3a\u201c\u53d7\u4fdd\u62a4\u7684\u8fdb\u7a0b\u201d\u7684\u539f\u56e0\u3002 #include \/\/ \/\/ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-505","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=505"}],"version-history":[{"count":2,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/505\/revisions"}],"predecessor-version":[{"id":510,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/505\/revisions\/510"}],"wp:attachment":[{"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newbiecoder.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}