00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
#include <nt.h>
00022
#include <ntrtl.h>
00023
#include <nturtl.h>
00024
00025
NTSTATUS
00026 main(
00027 IN ULONG argc,
00028 IN PCH argv[],
00029 IN PCH envp[],
00030 IN ULONG DebugParameter OPTIONAL
00031 )
00032 {
00033
NTSTATUS st;
00034 STRING ImagePathName;
00035 UNICODE_STRING ConfigFilePathname;
00036 RTL_USER_PROCESS_INFORMATION ProcessInformation;
00037 PEB_SM_DATA PebSessionInformation;
00038 HANDLE FileHandle;
00039 ULONG FileIndexNumber;
00040 IO_STATUS_BLOCK IoStatus;
00041 OBJECT_ATTRIBUTES
ObjectAttributes;
00042 FILE_INTERNAL_INFORMATION FileInformation;
00043 PPEB Peb;
00044
00045 Peb = NtCurrentPeb();
00046 RtlZeroMemory(&PebSessionInformation,
sizeof(PebSessionInformation));
00047
00048
00049
00050
00051
00052
00053
if ( !Peb->Sm.StandardInput.FileHandle ) {
00054
00055
RtlInitUnicodeString(&ConfigFilePathname,
L"\\SystemRoot\\nt.cfg");
00056
00057
00058
00059
00060
00061 InitializeObjectAttributes(
00062 &
ObjectAttributes,
00063 &ConfigFilePathname,
00064 OBJ_CASE_INSENSITIVE,
00065
NULL,
00066
NULL
00067 );
00068
00069 st =
NtOpenFile(
00070 &FileHandle,
00071 SYNCHRONIZE | FILE_READ_DATA,
00072 &
ObjectAttributes,
00073 &IoStatus,
00074 FILE_SHARE_READ,
00075 0
00076 );
00077
00078
if (!
NT_SUCCESS( st )) {
00079
DbgPrint(
"NtOpenFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00080
ASSERT(
NT_SUCCESS(st));
00081 }
00082
00083
00084
00085
00086
00087 st =
NtQueryInformationFile(
00088 FileHandle,
00089 &IoStatus,
00090 (PVOID) &FileInformation,
00091
sizeof(FileInformation),
00092 FileInternalInformation
00093 );
00094
00095
if (!
NT_SUCCESS( st )) {
00096
DbgPrint(
"NtQueryInformationFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00097
ASSERT(
NT_SUCCESS(st));
00098 }
00099
00100 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00101 PebSessionInformation.StandardInput.FileHandle = FileHandle;
00102 PebSessionInformation.StandardInput.Context = (PVOID) FileInformation.IndexNumber;
00103
00104
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00105
00106 st =
RtlCreateUserProcess(
00107 &ImagePathName,
00108
NULL,
00109
NULL,
00110
NULL,
00111
FALSE,
00112
NULL,
00113
NULL,
00114
NULL,
00115 &ProcessInformation,
00116 &PebSessionInformation
00117 );
00118
00119
ASSERT(
NT_SUCCESS(st));
00120
00121
NtResumeThread(ProcessInformation.Thread,
NULL);
00122
NtWaitForSingleObject(ProcessInformation.Process,
FALSE,
NULL);
00123
NtClose(ProcessInformation.Process);
00124
NtClose(ProcessInformation.Thread);
00125
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00126
00127 }
else {
00128
00129
if ( !Peb->Sm.StandardOutput.FileHandle ) {
00130
00131
00132
00133
00134
00135 st =
NtQueryInformationFile(
00136 Peb->Sm.StandardInput.FileHandle,
00137 &IoStatus,
00138 (PVOID) &FileInformation,
00139
sizeof(FileInformation),
00140 FileInternalInformation
00141 );
00142
00143
if (!
NT_SUCCESS( st )) {
00144
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00145
ASSERT(
NT_SUCCESS(st));
00146 }
00147
00148
ASSERT(Peb->Sm.StandardInput.Context == (PVOID) FileInformation.IndexNumber);
00149
00150 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00151 PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00152 PebSessionInformation.StandardOutput.FileHandle = Peb->Sm.StandardInput.FileHandle;
00153 PebSessionInformation.StandardOutput.Context = (PVOID) FileInformation.IndexNumber;
00154
00155
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00156
00157 st =
RtlCreateUserProcess(
00158 &ImagePathName,
00159
NULL,
00160
NULL,
00161
NULL,
00162
FALSE,
00163
NULL,
00164
NULL,
00165
NULL,
00166 &ProcessInformation,
00167 &PebSessionInformation
00168 );
00169
00170
ASSERT(
NT_SUCCESS(st));
00171
00172
NtResumeThread(ProcessInformation.Thread,
NULL);
00173
NtWaitForSingleObject(ProcessInformation.Process,
FALSE,
NULL);
00174
NtClose(ProcessInformation.Process);
00175
NtClose(ProcessInformation.Thread);
00176
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00177
00178 }
else {
00179
00180
ASSERT(Peb->Sm.StandardInput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_SUBSYS);
00181
00182
if ( !Peb->Sm.StandardError.FileHandle ) {
00183
00184
00185
00186
00187
00188 st =
NtQueryInformationFile(
00189 Peb->Sm.StandardOutput.FileHandle,
00190 &IoStatus,
00191 (PVOID) &FileInformation,
00192
sizeof(FileInformation),
00193 FileInternalInformation
00194 );
00195
00196
if (!
NT_SUCCESS( st )) {
00197
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00198
ASSERT(
NT_SUCCESS(st));
00199 }
00200
00201
ASSERT(Peb->Sm.StandardOutput.Context == (PVOID) FileInformation.IndexNumber);
00202
00203 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00204 PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00205 PebSessionInformation.StandardOutput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_PM;
00206 PebSessionInformation.StandardError.FileHandle = Peb->Sm.StandardOutput.FileHandle;
00207 PebSessionInformation.StandardError.Context = (PVOID) FileInformation.IndexNumber;
00208
00209
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00210
00211 st =
RtlCreateUserProcess(
00212 &ImagePathName,
00213
NULL,
00214
NULL,
00215
NULL,
00216
FALSE,
00217
NULL,
00218
NULL,
00219
NULL,
00220 &ProcessInformation,
00221 &PebSessionInformation
00222 );
00223
00224
ASSERT(
NT_SUCCESS(st));
00225
00226
NtResumeThread(ProcessInformation.Thread,
NULL);
00227
NtWaitForSingleObject(ProcessInformation.Process,
FALSE,
NULL);
00228
NtClose(ProcessInformation.Process);
00229
NtClose(ProcessInformation.Thread);
00230
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00231
00232 }
else {
00233
00234
ASSERT(Peb->Sm.StandardOutput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_PM);
00235
00236
00237
00238
00239
00240 st =
NtQueryInformationFile(
00241 Peb->Sm.StandardError.FileHandle,
00242 &IoStatus,
00243 (PVOID) &FileInformation,
00244
sizeof(FileInformation),
00245 FileInternalInformation
00246 );
00247
00248
if (!
NT_SUCCESS( st )) {
00249
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00250
ASSERT(
NT_SUCCESS(st));
00251 }
00252
00253
ASSERT(Peb->Sm.StandardError.Context == (PVOID) FileInformation.IndexNumber);
00254
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00255 }
00256 }
00257 }
00258 }