Jump to content
Tuts 4 You

Not able to create a new child process using ZwCreateProcess!


Recommended Posts

I am trying to create a new process from current running process,am doing this with the zwcreateProcess function.(just for testing purpose).check the code below

 HANDLE fileHandle;
InputString.Buffer = L"C:\\users\\Tommy\\MyEXE.exe";
InputString.Length = wcslen(L"C:\\users\\Tommy\\MyEXE.exe")*2;
InputString.MaximumLength = InputString.Length +2;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
ObjectAttirbutes.ObjectName = &InputString;
NTSTATUS status = ZwCreateProcess(&fileHandle,PROCESS_CREATRE_PROCESS,&ObjectAttributes,GetCurrentProcess(),true ,NULL,NULL,NULL);

status - Invalid Parameter

Any suggestions/help is appreciated.

Link to comment

Your DesiredAccess parameter is wrong. http://msdn.microsoft.com/en-us/library/ms684880%28v=VS.85%29.aspx

And maybe you didnt initializie the ObjectAttributes correctly.

i am using this:

#define InitializeObjectAttributes(p,n,a,r,s) \
{ \
(p)->Length = sizeof(OBJECT_ATTRIBUTES); \
(p)->ObjectName = n; \
(p)->Attributes = a; \
(p)->RootDirectory = r; \
(p)->SecurityDescriptor = s; \
(p)->SecurityQualityOfService = NULL; \
}OBJECT_ATTRIBUTES ObjectAttributes;
InitializeObjectAttributes(&ObjectAttributes, 0, 0, 0, 0);
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...