Hi All!
Is there a way to create a user-mode process from kernel-mode on Windows NT platform (XP-W7)?
EDIT: I must install only the driver. This is a specific of the project.
+3
A:
I don't know an easier way to achieve this. But what about having a Windows service running which makes an overlapped DeviceIoControl into your driver? On return the service could examine the data it has received from the driver and start the according application.
ur
2009-07-16 06:31:42
I would say this is the correct solution. Issue a reverse IRP from a service, let the driver complete when it needs the user-mode process to begin.
Blank Xavier
2009-07-16 06:37:12
Thanks for suggestion but I cannot have my service running (If only the service will be installed and started from kernel-mode).
Sergius
2009-07-16 06:39:58
@Sergius: You have to install the driver anyway. You could install the service using the same INF file.
ur
2009-07-16 06:48:00
A:
This can't be directly done - Creating a win32 process requires some set up by the user mode part of CreateProcess, not just creating the process object in kernel mode.
You need some user mode code here - either a service, a desktop app, or so on, to launch the your user mode application.
Michael
2009-07-16 06:55:16
A:
To create a valid win32 process the driver must communicate with CSRSS (what is completely undocumented). So I ended up by queuing a user-mode APC and allocating virtual memory for the APC code in the context of the existing win32 process (that code will call CreateProcess and do the job).
It is a tricky way but it works.
Sergius
2010-04-01 06:13:06