Creating Process
https://t.me/learningnets
Creating Process
Process
( notepad.exe )
CreateProcess( )
notepad.exe
RAM
https://t.me/learningnets
Function Prototype
BOOL CreateProcess(
lpApplicationName, // Path to the executable
lpCommandLine, // Command-line arguments
lpProcessAttributes, // Security attributes for the process
lpThreadAttributes, // Security attributes for the primary thread
bInheritHandles, // Inherit handles from parent process
dwCreationFlags, // Process creation flags
lpEnvironment, // Pointer to environment block
lpCurrentDirectory, // Working directory of the new process
lpStartupInfo, // Pointer to STARTUPINFO structure
lpProcessInformation // Pointer to PROCESS_INFORMATION structure
);
https://t.me/learningnets
Function Prototype
Flag Description
BOOL CreateProcess(
CREATE_NEW_CONSOLE Creates a new console window for the child
lpApplicationName, // Path to the executable process.
lpCommandLine, // Command-line arguments CREATE_SUSPENDED Creates the process in a suspended state.
(Used in process injection.)
lpProcessAttributes, // Security attributes for the process
CREATE_NO_WINDOW Runs the process without showing any
lpThreadAttributes, // Security attributes for the primary thread window (used for stealth malware).
bInheritHandles, // Inherit handles from parent process CREATE_DEFAULT_ERROR_ Uses the parent's error mode.
MODE
dwCreationFlags, // Process creation flags
CREATE_BREAKAWAY_FRO Allows the process to run outside of a job
lpEnvironment, // Pointer to environment block M_JOB object.
lpCurrentDirectory, // Working directory of the new process CREATE_SEPARATE_WOW_ Runs the process in a separate virtual DOS
VDM machine (for 16-bit apps).
lpStartupInfo, // Pointer to STARTUPINFO structure
CREATE_SHARED_WOW_VD Runs in a shared DOS environment (legacy
lpProcessInformation // Pointer to PROCESS_INFORMATION structure M stuff).
DEBUG_PROCESS Allows the parent process to debug the child
); process.
DEBUG_ONLY_THIS_PROCE Only allows the parent to debug this
SS process.
DETACHED_PROCESS Runs the process without associating with
the parent console.
EXTENDED_STARTUPINFO_ Allows passing extended startup information.
PRESENT
INHERIT_PARENT_AFFIINITY Inherits the CPU affinity of the parent
process.
CREATE_PROTECTED_PRO Creates a protected process (used in anti-
CESS debugging).
https://t.me/learningnets
Function Prototype
BOOL CreateProcess(
lpApplicationName, // Path to the executable
lpCommandLine, // Command-line arguments
lpProcessAttributes, // Security attributes for the process
lpThreadAttributes, // Security attributes for the primary thread
bInheritHandles, // Inherit handles from parent process
dwCreationFlags, // Process creation flags
lpEnvironment, // Pointer to environment block
lpCurrentDirectory, // Working directory of the new process
lpStartupInfo, // Pointer to STARTUPINFO structure
lpProcessInformation // Pointer to PROCESS_INFORMATION structure
);
https://t.me/learningnets
Function Prototype
BOOL CreateProcess(
lpApplicationName, // Path to the executable
lpCommandLine, // Command-line arguments
lpProcessAttributes, // Security attributes for the process
lpThreadAttributes, // Security attributes for the primary thread
bInheritHandles, // Inherit handles from parent process
dwCreationFlags, // Process creation flags
lpEnvironment, // Pointer to environment block
lpCurrentDirectory, // Working directory of the new process
It controls how the new process starts (window size, position, appearance, etc.).
lpStartupInfo, // Pointer to STARTUPINFO structure
lpProcessInformation // Pointer to PROCESS_INFORMATION structure
);
typedef struct _STARTUPINFO {
DWORD cb; // Size of the structure
LPSTR lpReserved; // Reserved (always NULL)
LPSTR lpDesktop; // Desktop name (NULL = default)
LPSTR lpTitle; // Console title (NULL = default)
DWORD dwX, dwY; // Window position (ignored if not set)
DWORD dwXSize, dwYSize; // Window size
DWORD dwFlags; // specify which flag is used (e.g., SW_HIDE)
WORD wShowWindow; // Controls the window state (SW_SHOW, SW_HIDE, etc.)
... (Other fields not commonly used)
} STARTUPINFO;
https://t.me/learningnets
Function Prototype
BOOL CreateProcess(
lpApplicationName, // Path to the executable
lpCommandLine, // Command-line arguments
lpProcessAttributes, // Security attributes for the process
lpThreadAttributes, // Security attributes for the primary thread
bInheritHandles, // Inherit handles from parent process
dwCreationFlags, // Process creation flags
lpEnvironment, // Pointer to environment block
lpCurrentDirectory, // Working directory of the new process
It controls how the new process starts (window size, position, appearance, etc.).
lpStartupInfo, // Pointer to STARTUPINFO structure
lpProcessInformation // Pointer to PROCESS_INFORMATION structure
);
typedef struct _STARTUPINFO {
DWORD cb; // Size of the structure
FLAGS LPSTR lpReserved; // Reserved (always NULL)
LPSTR lpDesktop; // Desktop name (NULL = default)
1. STARTF_USESHOWWINDOW ( 0X00000001) LPSTR lpTitle; // Console title (NULL = default)
2. STARTF_USESIZE ( 0X00000002)
DWORD dwX, dwY; // Window position (ignored if not set)
3. STARTF_USEPOSITION ( 0X00000004)
4. STARTF_USECOUNTCHARS ( 0X00000008) DWORD dwXSize, dwYSize; // Window size
5. STARTF_USEFILLATTRIBUTE ( 0X00000010) DWORD dwFlags; // specify which flag is used (e.g., SW_HIDE)
6. STARTF_RUNFULLSCREEN ( 0X00000020) WORD wShowWindow; // Controls the window state (SW_SHOW, SW_HIDE, etc.)
7. STARTF_FORCEONFEEDBACK ( 0X00000040) ... (Other fields not commonly used)
8. STARTF_FORCEOFFFEEDBACK ( 0X00000080) } STARTUPINFO;
9. STARTF_USESTDHANDLES ( 0X00000100)
10. STARTF_USEHOTKEY ( 0X00000200)
https://t.me/learningnets
Function Prototype
BOOL CreateProcess(
lpApplicationName, // Path to the executable
lpCommandLine, // Command-line arguments
lpProcessAttributes, // Security attributes for the process
lpThreadAttributes, // Security attributes for the primary thread
bInheritHandles, // Inherit handles from parent process
dwCreationFlags, // Process creation flags
lpEnvironment, // Pointer to environment block
lpCurrentDirectory, // Working directory of the new process
lpStartupInfo, // Pointer to STARTUPINFO structure
Holds important information about the newly created process.
lpProcessInformation // Pointer to PROCESS_INFORMATION structure
);
typedef struct _PROCESS_INFORMATION {
HANDLE hProcess; // Handle to the process
HANDLE hThread; // Handle to the main thread
DWORD dwProcessId; // Process ID
DWORD dwThreadId; // Thread ID
} PROCESS_INFORMATION;
https://t.me/learningnets
