Hello
First of all ZwCreateProcess/NtCreateProcess is not exported by kernel, you
may try to call it only getting address by ordinal from System Service
Descriptor Table. However, I’m about sure that you will see crash or no
working after this call, I have not time for research, but if you take a
look on CreateProcess routine in kernel32.dll you will see that process
creation is not limited to NtCreateProcess call.
Good Luck,
Vadim
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of SUJA JAMES
Sent: Tuesday, December 11, 2001 1:54 PM
To: NT Developers Interest List
Subject: [ntdev] Re: Executing User Mode App From Driver
Hi
I used the following code and I am getting the error
message “Indicates the specified procedure address
cannot found in the DLL” while starting the driver.
Also, its not hitting my driver entry .
Does anyone know why???..
#include <ntddk.h>
#include “ntifs.h”
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
UNICODE_STRING FileName;
ULONG FileNameLength;
PHANDLE ProcessHandle;
OBJECT_ATTRIBUTES ObjectAttributes;
WCHAR PathPrefix =
L"\SystemRoot\system32\drivers\test.exe";
DriverObject->DriverUnload = DriverUnloads;
FileNameLength = sizeof(PathPrefix) ;
FileName.Buffer = ExAllocatePool(NonPagedPool,
FileNameLength);
if (FileName.Buffer == NULL)
{
return STATUS_INSUFFICIENT_RESOURCES;
}
FileName.Length = sizeof(PathPrefix) -
sizeof(WCHAR);
FileName.MaximumLength = (USHORT)FileNameLength;
RtlMoveMemory (FileName.Buffer, PathPrefix,
sizeof(PathPrefix));
InitializeObjectAttributes ( &ObjectAttributes,
&FileName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL );
ZwCreateProcess (
&ProcessHandle,
PROCESS_ALL_ACCESS,//DesiredAccess,
&ObjectAttributes ,
NtCurrentProcess(), //ParentProcessHandle,
TRUE,//InheritObjectTable,
0,//SectionHandle,
0,//DebugPort,
0//ExceptionPort
);
return STATUS_SUCCESS;
}// End of DriverEntry
>
>
> Hi
>
> Thanks for the reply…
> can anyone give more info about ZwCreateProcess.
> I have the following prototype. Is this correct?
>
> ZwCreateProcess (
> OUT PHANDLE ProcessHandle,
> IN ACCESS_MASK DesiredAccess,
> IN POBJECT_ATTRIBUTES ObjectAttributes
> OPTIONAL,
> IN HANDLE ParentProcessHandle,
> IN BOOLEAN InheritObjectTable,
> IN HANDLE SectionHandle,
> IN HANDLE DebugPort,
> IN HANDLE ExceptionPort
> );
> What all the parameters I have to fill for executing
> C:\Test.exe.
>
> Regards
> Suja.
>
> — sajeev sas wrote:
> > try using the undocumented call ZwCreateProcess.
> >
> > — SUJA JAMES wrote: >
> Hi
> > all,
> > >
> > > Is there any method to call a user mode app from
> > my
> > > driver. That is , I have an application say
> > > “C:\Test.exe”. I just want to execute this
> program
> > > in
> > > user mode from my driver.
> > >
> > > Is this possible under win NT/2000???
> > >
> > > Regards
> > > Suja.
> > >
> > >
>
> > > Do You Yahoo!?
> > > Check out Yahoo! Shopping and Yahoo! Auctions
> for
> > > all of
> > > your unique holiday gifts! Buy at
> > > http://shopping.yahoo.com
> > > or bid at http://auctions.yahoo.com
> > >
> > > —
> > > You are currently subscribed to ntdev as:
> > > xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
>
______________________
> > For Stock Quotes, Finance News, Insurance, Tax
> > Planners, Mutual Funds…
> > Visit http://in.finance.yahoo.com/
> >
> > —
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
> Do You Yahoo!?
> Check out Yahoo! Shopping and Yahoo! Auctions for
> all of
> your unique holiday gifts! Buy at
> http://shopping.yahoo.com
> or bid at http://auctions.yahoo.com
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@scmmicro.co.in
> To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http://shopping.yahoo.com
or bid at http://auctions.yahoo.com
—
You are currently subscribed to ntdev as: xxxxx@pcausa.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com</ntddk.h>