Resume a process created by NtCreateProcessEx

Viewed 505

Here im trying to create and run calc but the process is created in suspended state. This is the main code:

#include <Windows.h>
#include <iostream>

using namespace std;

#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )

typedef struct _LSA_UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES
{
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;

typedef NTSTATUS(NTAPI* fpNtCreateProcessEx)
(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    ULONG Flags,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL,
    BOOLEAN InJob
    );

typedef NTSTATUS(NTAPI* fpNtCreateTransaction)
(
    PHANDLE TransactionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    LPGUID Uow,
    HANDLE TmHandle,
    ULONG CreateOptions,
    ULONG IsolationLevel,
    ULONG IsolationFlags,
    PLARGE_INTEGER Timeout,
    PUNICODE_STRING Description
    );

typedef NTSTATUS(NTAPI* fpNtCreateSection)
(
    PHANDLE SectionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection,
    ULONG AllocationAttributes,
    HANDLE FileHandle
    );
typedef NTSTATUS(NTAPI* fpNtClose)
(
    HANDLE Handle
    );

typedef LONG(NTAPI* fpNtResumeProcess)
(
    HANDLE ProcessHandle
    );

typedef LONG(NTAPI* fpNtResumeThread)
(
    HANDLE ProcessHandle
    );

#define PS_INHERIT_HANDLES 4

int main()
{
    HANDLE hProcess;
    OBJECT_ATTRIBUTES objattr;
    WCHAR wstrObjName[MAX_PATH];
    lstrcpyW(wstrObjName, L"C:\\Windows\\System32\\calc.exe");

    const HINSTANCE hinst = LoadLibrary(L"ntdll.dll");
    const auto _NtCreateTransaction = fpNtCreateTransaction(GetProcAddress(hinst, "NtCreateTransaction"));
    const auto _NtCreateSection = fpNtCreateSection(GetProcAddress(hinst, "NtCreateSection"));
    const auto _NtCreateProcessEx = fpNtCreateProcessEx(GetProcAddress(hinst, "NtCreateProcessEx"));
    const auto _NtResumeProcess = fpNtResumeProcess(GetProcAddress(hinst, "NtResumeProcess"));
    const auto _NtResumeThread = fpNtResumeThread(GetProcAddress(hinst, "NtResumeThread"));
    const auto _NtClose = fpNtClose(GetProcAddress(hinst, "NtClose"));

    wcslen(wstrObjName) * sizeof(WCHAR);

    objattr.Length = sizeof(OBJECT_ATTRIBUTES);
    objattr.Attributes = 0x00000040L;
    objattr.ObjectName = nullptr;
    objattr.RootDirectory = nullptr;
    objattr.SecurityDescriptor = nullptr;
    objattr.SecurityQualityOfService = nullptr;

    HANDLE hTransaction = nullptr;
    _NtCreateTransaction(&hTransaction, TRANSACTION_ALL_ACCESS, &objattr, nullptr, nullptr, 0, 0, 0, nullptr, nullptr);

    const HANDLE h_transacted_file = CreateFileTransacted(wstrObjName, GENERIC_WRITE | GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr, hTransaction, nullptr, nullptr);
    HANDLE hSection = nullptr;
    _NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, h_transacted_file);

    _NtCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, nullptr, NtCurrentProcess(), PS_INHERIT_HANDLES, hSection, nullptr, nullptr, false);
    const DWORD pid = GetProcessId(hProcess);

    ResumeThread(hProcess);

    printf("Pid = %d\n", pid);

    CloseHandle(h_transacted_file);
    _NtClose(hTransaction);
    _NtClose(hSection);
    _NtClose(hProcess);

    return 0;
}

This is my ProcessExplorer: enter image description here

What i have tried:

  1. Changing #define PS_INHERIT_HANDLES 4 to something else like 2, 1 or 8 and no luck.
  2. Tried to resume the process by ResumeThread(hProcess);, ResumeProcess(hProcess); or _NtResumeProcess(hProcess); but doesn't work.
  3. Tried to manually resume the process with ProcessExplorer and Process goes back to suspended state immediately.
  4. Changing my target file to something else.

My question is: Why i cannot resume this created process? How can i fix this?

1 Answers

In case you didn't figure it out, you need to create a thread using NtCreateThreadEx

Related