fork( )

NTDEV
1

Hello people,

THough this has nothing to do with the kernel, still…is there way to do a
fork( ) in windows…exactly the unix way, where all code of a currently
executing process after the fork( ) command is replicated…

2

The capability is still there, in ZwCreateProcess, etc. I suggest you get
Gary Nebbett’s “Windows NT/2000 Native API Reference” for the mechanics of
doing it.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“A P” wrote in message news:xxxxx@ntdev…
Hello people,

THough this has nothing to do with the kernel, still…is there way to do a
fork( ) in windows…exactly the unix way, where all code of a currently
executing process after the fork( ) command is replicated…

3

ZwCreateProcess can do it, however it needs teh help of other functions ,
you have to write some of your own code to achieve it.

4

NT does not impose a tree structure or whatever sort of structure on
processes that it creates. That is job of the subsystem that is implemented
using the NTAPI’s, so i dont think there will be a fork() in NT with the
exact semantics. I suggest you look in the upper layers and not in the Zw
or the Nt layers. This is becasue the usecase of the 2 kernels is quite
different, NT is made for subsystems which provide you with OS personalities
and on UNIX the syscall interface is directly provided to the enduser.

THough this has nothing to do with the kernel, still…is there way to do
a
fork( ) in windows…exactly the unix way, where all code of a currently
executing process after the fork( ) command is replicated…
Code After the fork is replicated ???. Entire Address is replicated
(sort of an exception VFORK)

NTSYSAPI
NTSTATUS
NTAPI
ZwCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN HANDLE InheritFromProcessHandle,
IN BOOLEAN InheritHandles,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL
);

ZwCreateProcess more than a fork because of the “IN HANDLE
SectionHandle OPTIONAL” parameter, i.e sort of a fork and exec merge. But i
think the parameter with a null will copy the address space of the process
that calls ZwCreateProcess.

Thanks & Regards
Faraz.

On 4/11/06, Don Burn wrote:
>
> The capability is still there, in ZwCreateProcess, etc. I suggest you get
> Gary Nebbett’s “Windows NT/2000 Native API Reference” for the mechanics of
> doing it.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
>
>
>
> “A P” wrote in message news:xxxxx@ntdev…
> Hello people,
>
> THough this has nothing to do with the kernel, still…is there way to do
> a
> fork( ) in windows…exactly the unix way, where all code of a currently
> executing process after the fork( ) command is replicated…
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

5

If you don’t want to interact with Win32 too, you can just use the POSIX
compliant subsystem (in the NT family on NTFS partitions). See the topic
“POSIX compatibility” in MSDN.

I don’t know specifically that “fork” is implemented exactly the same
way, but it claims to be a standards-compliant implementation, so I
would imagine it would be.

A P wrote:

Hello people,

THough this has nothing to do with the kernel, still…is there way to
do a fork( ) in windows…exactly the unix way, where all code of a
currently executing process after the fork( ) command is replicated…

–
Ray

6

NtCreateProcess with SectionHandle == NULL, and the kernel will do fork().
execve() is much harder though.
Use Microsoft Interix for this.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “A P”
To: “Windows System Software Devs Interest List”
Sent: Tuesday, April 11, 2006 7:35 PM
Subject: [ntdev] fork( )

Hello people,

THough this has nothing to do with the kernel, still…is there way to do a
fork( ) in windows…exactly the unix way, where all code of a currently
executing process after the fork( ) command is replicated…

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

> If you don’t want to interact with Win32 too, you can just use the POSIX

compliant subsystem (in the NT family on NTFS partitions). See the topic
“POSIX compatibility” in MSDN.

It is now Microsoft Interix.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com