How to pass argument to NtProcessStartup?

NTDEV
1

Hello,I’m trying to build Mark’s Native application example,Native.c. It works well in Windows 2000,but when I build it with ddk 2003 env,it does not work in windows 2003. I think there must be some problem with the NtProcessStartup’s param.But where could I find some reference about the NtProcessStartup?Here’s the code:
///////////
void NtProcessStartup( PSTARTUP_ARGUMENT Argument )
{
PUNICODE_STRING commandLine;
PWCHAR stringBuffer, argPtr;
UNICODE_STRING helloWorld;
RTL_HEAP_DEFINITION heapParams;

//
// Initialize some heap
//
memset( &heapParams, 0, sizeof( RTL_HEAP_DEFINITION ));
heapParams.Length = sizeof( RTL_HEAP_DEFINITION );
Heap = RtlCreateHeap( 2, 0, 0x100000, 0x1000, 0, &heapParams );

//
// Point at command line
//
commandLine = &Argument->Environment->CommandLine;

//
// Locate the argument
//
argPtr = commandLine->Buffer;
while( *argPtr != L’ ’ ) argPtr++;
argPtr++;

//
// Print out the argument
//
stringBuffer = RtlAllocateHeap( Heap, 0, 256 );
swprintf( stringBuffer, L"\n%s", argPtr );
helloWorld.Buffer = stringBuffer;
helloWorld.Length = wcslen( stringBuffer ) * sizeof(WCHAR);
helloWorld.MaximumLength = helloWorld.Length + sizeof(WCHAR);
NtDisplayString( &helloWorld );

//
// Free heap
//
RtlFreeHeap( Heap, 0, stringBuffer );

//
// Terminate
//
NtTerminateProcess( NtCurrentProcess(), 0 );
}
/////////////////

The application runs to
commandLine = &Argument->Environment->CommandLine;
then it terminated.
So I think it’s the Argument that crash the program.
Any suggestion will be appreciated.Thanks~

2

I would say that it’s the ‘while’ loop that follows. It looks awfully suspect, given that ‘commandLine’ is a UNICODE_STRING.
There’s no check for L’\0,’ or better yet ‘Length,’ and this could certainly cause problems. I don’t know how command lines work
for native applications, and in particular why on 2003 and not on 2000, but I would assume it has to do with the way you are calling
it, but I think that this is the basic issue, or at least one that needs to be fixed.

Given the way the industry works, I would be willing to bet that there are commercial applications that have the same problem. Some
would say that this would be a good reason to document things, if it is in fact the case.

As far as a ‘reference,’ there is none that I know of.

Good luck,

mm

xxxxx@gmail.com wrote:

Hello,I’m trying to build Mark’s Native application example,Native.c. It works well in Windows 2000,but when I build it with ddk 2003 env,it does not work in windows 2003. I think there must be some problem with the NtProcessStartup’s param.But where could I find some reference about the NtProcessStartup?Here’s the code:
///////////
void NtProcessStartup( PSTARTUP_ARGUMENT Argument )
{
PUNICODE_STRING commandLine;
PWCHAR stringBuffer, argPtr;
UNICODE_STRING helloWorld;
RTL_HEAP_DEFINITION heapParams;

//
// Initialize some heap
//
memset( &heapParams, 0, sizeof( RTL_HEAP_DEFINITION ));
heapParams.Length = sizeof( RTL_HEAP_DEFINITION );
Heap = RtlCreateHeap( 2, 0, 0x100000, 0x1000, 0, &heapParams );

//
// Point at command line
//
commandLine = &Argument->Environment->CommandLine;

//
// Locate the argument
//
argPtr = commandLine->Buffer;
while( *argPtr != L’ ’ ) argPtr++;
argPtr++;

//
// Print out the argument
//
stringBuffer = RtlAllocateHeap( Heap, 0, 256 );
swprintf( stringBuffer, L"\n%s", argPtr );
helloWorld.Buffer = stringBuffer;
helloWorld.Length = wcslen( stringBuffer ) * sizeof(WCHAR);
helloWorld.MaximumLength = helloWorld.Length + sizeof(WCHAR);
NtDisplayString( &helloWorld );

//
// Free heap
//
RtlFreeHeap( Heap, 0, stringBuffer );

//
// Terminate
//
NtTerminateProcess( NtCurrentProcess(), 0 );
}
/////////////////

The application runs to
commandLine = &Argument->Environment->CommandLine;
then it terminated.
So I think it’s the Argument that crash the program.
Any suggestion will be appreciated.Thanks~

3

Thank.
But I still confused about why it does not work on windows 2003.
I know it’s the argument problem,because I comment all the other lines just left
commandLine = &Argument->Environment->CommandLine;
it does not work. So I don’t think the while loop is the problem.
Thanks~

4

Well, for the sake of argument, accepting that theory, then that would mean that at least one of ‘Argument’ or
‘Argument->Environment’ are invalid. If there’s been some type casting along the way, then any component could be the problem.

Good luck,

mm

xxxxx@gmail.com wrote:

Thank.
But I still confused about why it does not work on windows 2003.
I know it’s the argument problem,because I comment all the other lines just left
commandLine = &Argument->Environment->CommandLine;
it does not work. So I don’t think the while loop is the problem.
Thanks~

5

I found the correct type.It’s PEB.I can use
dt nt!_PEB to get the structure in WinDbg.
Thanks.~