16 replies to this topic

[Tony]

Great day HH

 

I got a problem. I want to open its own executable using ZwOpenFile. I almost got it working, but the return status is STATUS_ACCES_DENIED

 

Is there anyone who could help me with this?

 

password = project

Edited by BullDog, 11 November 2013 - 11:16 PM.
attachment removed by request from author

[LeFF]

file is being locked by windows loader when the process is created and until the process exits, you can open it for reading only...

[Hess]

If I am not wrong , and I think that I am not , path and executable is in DOS 8.3 file format , so , at least one string is replaced with ~ , so , this is probably key for error , it wont work this way. :S Based upon LeFF post just before mine , You must exit Your process before launch , so , You'll probably have to add one more routine for opening successfully.

[Tony]

@LeFF

 

Thanks for the info. Actually my goal is to create a new process. Ofcourse I can use CreateProcessA, but this calls at some point ZwCreateProcessEx. To use ZwCreateProcessEx, the current file needs to be openend using ZwOpenFile. So in fact the current file open itself to create a new process using ZwCreateProcessEx.

 

Any idea how to use ZwCreateProcessEx in asm without using the winapi CreateProcess?

 

@Hess

you're wrong buddy. As i said above

[Hess]

It looks that You misunderstood me , I was thinking also for creating new process , and , what about using directly ZwCreateProcessEx ? As it will be called by any meanings. Or , simply study how to make Your own API ?

[Tony]

Using ZwCreateProcessEx needs a section handle to work. To obtain such handle, a section must be created. To create a section, the process must be openend. Thats why i need ZwOpenProcess

[Hess]

I can't recall to who I suggested to use several API's which will a bit harden work , but output will be useful.

[Tony]

Doesn't matter Hess, problems looks to be solved

[Hess]

Tony, on 12 Nov 2013 - 07:07 AM, said:

Doesn't matter Hess, problems looks to be solved

Then , great , I see You have asked that Your attachment gets deleted , btw , I've tested it with my method and also got running , just it gets more than 3072 bytes.

[Tony]

So the new process is succesfully created. However, this new process should be the child-process of the main process. Right now the created process is not the child of the parent. Any one who knows a fix for that?

[Hess]

You mean Arma style or different ?

[Tony]

Yes arma style

 

Arma is creating a child process. This is what i want to do in user/kernel mode programming

[Hess]

"Father process" actually debugs child process and keeps eye on it , so it can't be tampered. Oh , I should keep my moth shut in past , no more Arma , please !!!!

[Tony]

Yes, Hess, I know how arma works

 

The only problem I got is to create a process with the mentioned winapi's and set this new process as child.

[Hess]

Then , You know it's API and how can You recreate them just from opposite side , just like You reverse them. :S Huh , who hit me to talk about arma ! :S

[Jochen]

@tony Could you send me the SRC by PM ? i might be able to help you

[Hess]

I have to quote myself here since , most people misundersood me:

 

Hess, on 12 Nov 2013 - 12:35 AM, said:

I can't recall to who I suggested to use several API's which will a bit harden work , but output will be useful.

This is new approach in Arma since v9 of it , it is not so good recognized anymore.