Great afternoon MASM users :biggrin:
For a certain reason i have to use the winapi ZwCreateProcessEx to create a new process. So i don't want to use CreateFile such winapi's, but only ZwCreateProcessEx.
My question is how to use ZwCreateProcessEx in masm?
I found out that ZwCreateProcessEx need a sectionHandle to create a file. To obtain this sectionHandle, a new section must be created with ZwCreateSection. To create a new section, a file must be openend first with ZwOpenFile.
So let's say we want to open "C:\Users\A\Desktop\calc.exe". This ANSI string should be converted to UNICODE.
For some reason the ZwOpenFile api failed and thus not able to execute ZwCreateSection and thus ZwCreateProcess will fails too.
Quote from: Yoshi on November 10, 2013, 11:55:33 PM
For a certain reason i have to use the winapi ZwCreateProcessEx to create a new process.
So i don't want to use CreateFile such winapi's, but only ZwCreateProcessEx.
could you elaborate on "certain reason" ?
why won't CreateProcess do the job ?
CreateProcess will work, but i need ZwCreateProcess because it is much more faster.
faster ? ;)
when i google NtCreateProcessEx/ZwCreateProcessEx, all i see are hooks and hacks
you have a better reason ?
Yes it is faster and better to use it direcly instead of using CreateProcess. And your wrong :eusa_snooty:
no hacks or hooks.
However, do you have any solution in your mind?
hSection is optional - try passing NULL
still, i have to wonder what process you are launching so many times that the speed is an issue
passing hsection to NULL won't work, already tried.
Im sure when i can execute ZwOpenFile succesfully, then all the problems should be fixed.
so the main struggle right now if to return succesfull from ZwOpenFile. Right now ZwOpenFile returns INVALID_PARAMETER with the example from the first post.
i am not too sure about RtlDosPathNameToNtPathName
just create a UNICODE path, prepended with '\\?\'
;tchr macro by qWord
tchr MACRO lbl,args:VARARG
IFDEF __UNICODE__
UCSTR lbl,args
ELSE
lbl db args
ENDIF
ENDM
.DATA
tchr szFileName,'\\?\C:\Users\A\Desktop\calc.exe',0
EDIT: by the way, that assumes you have defined __UNICODE__ prior to the macro :P
you could just use the UCSTR macro, otherwise
i haven't tried opening a prepended filename with ANSI
thank you very much dedndave!
however im still not able to open a file using ZwOpenFile.
edit; problem solved by huntingspace, thanks dude!
also thanks to you dedndave