00032 {
00033
NTSTATUS st;
00034 STRING ImagePathName;
00035 UNICODE_STRING ConfigFilePathname;
00036 RTL_USER_PROCESS_INFORMATION ProcessInformation;
00037 PEB_SM_DATA PebSessionInformation;
00038 HANDLE FileHandle;
00039 ULONG FileIndexNumber;
00040 IO_STATUS_BLOCK IoStatus;
00041 OBJECT_ATTRIBUTES
ObjectAttributes;
00042 FILE_INTERNAL_INFORMATION FileInformation;
00043 PPEB Peb;
00044
00045 Peb = NtCurrentPeb();
00046 RtlZeroMemory(&PebSessionInformation,
sizeof(PebSessionInformation));
00047
00048
00049
00050
00051
00052
00053
if ( !Peb->Sm.StandardInput.FileHandle ) {
00054
00055
RtlInitUnicodeString(&ConfigFilePathname,L
"\\SystemRoot\\nt.cfg");
00056
00057
00058
00059
00060
00061 InitializeObjectAttributes(
00062 &ObjectAttributes,
00063 &ConfigFilePathname,
00064 OBJ_CASE_INSENSITIVE,
00065 NULL,
00066 NULL
00067 );
00068
00069 st =
NtOpenFile(
00070 &FileHandle,
00071 SYNCHRONIZE | FILE_READ_DATA,
00072 &ObjectAttributes,
00073 &IoStatus,
00074 FILE_SHARE_READ,
00075 0
00076 );
00077
00078
if (!
NT_SUCCESS( st )) {
00079
DbgPrint(
"NtOpenFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00080
ASSERT(
NT_SUCCESS(st));
00081 }
00082
00083
00084
00085
00086
00087 st =
NtQueryInformationFile(
00088 FileHandle,
00089 &IoStatus,
00090 (PVOID) &FileInformation,
00091
sizeof(FileInformation),
00092 FileInternalInformation
00093 );
00094
00095
if (!
NT_SUCCESS( st )) {
00096
DbgPrint(
"NtQueryInformationFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00097
ASSERT(
NT_SUCCESS(st));
00098 }
00099
00100 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00101 PebSessionInformation.StandardInput.FileHandle = FileHandle;
00102 PebSessionInformation.StandardInput.Context = (PVOID) FileInformation.IndexNumber;
00103
00104
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00105
00106 st =
RtlCreateUserProcess(
00107 &ImagePathName,
00108 NULL,
00109 NULL,
00110 NULL,
00111 FALSE,
00112 NULL,
00113 NULL,
00114 NULL,
00115 &ProcessInformation,
00116 &PebSessionInformation
00117 );
00118
00119
ASSERT(
NT_SUCCESS(st));
00120
00121
NtResumeThread(ProcessInformation.Thread,NULL);
00122
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00123
NtClose(ProcessInformation.Process);
00124
NtClose(ProcessInformation.Thread);
00125
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00126
00127 }
else {
00128
00129
if ( !Peb->Sm.StandardOutput.FileHandle ) {
00130
00131
00132
00133
00134
00135 st =
NtQueryInformationFile(
00136 Peb->Sm.StandardInput.FileHandle,
00137 &IoStatus,
00138 (PVOID) &FileInformation,
00139
sizeof(FileInformation),
00140 FileInternalInformation
00141 );
00142
00143
if (!
NT_SUCCESS( st )) {
00144
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00145
ASSERT(
NT_SUCCESS(st));
00146 }
00147
00148
ASSERT(Peb->Sm.StandardInput.Context == (PVOID) FileInformation.IndexNumber);
00149
00150 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00151 PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00152 PebSessionInformation.StandardOutput.FileHandle = Peb->Sm.StandardInput.FileHandle;
00153 PebSessionInformation.StandardOutput.Context = (PVOID) FileInformation.IndexNumber;
00154
00155
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00156
00157 st =
RtlCreateUserProcess(
00158 &ImagePathName,
00159 NULL,
00160 NULL,
00161 NULL,
00162 FALSE,
00163 NULL,
00164 NULL,
00165 NULL,
00166 &ProcessInformation,
00167 &PebSessionInformation
00168 );
00169
00170
ASSERT(
NT_SUCCESS(st));
00171
00172
NtResumeThread(ProcessInformation.Thread,NULL);
00173
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00174
NtClose(ProcessInformation.Process);
00175
NtClose(ProcessInformation.Thread);
00176
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00177
00178 }
else {
00179
00180
ASSERT(Peb->Sm.StandardInput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_SUBSYS);
00181
00182
if ( !Peb->Sm.StandardError.FileHandle ) {
00183
00184
00185
00186
00187
00188 st =
NtQueryInformationFile(
00189 Peb->Sm.StandardOutput.FileHandle,
00190 &IoStatus,
00191 (PVOID) &FileInformation,
00192
sizeof(FileInformation),
00193 FileInternalInformation
00194 );
00195
00196
if (!
NT_SUCCESS( st )) {
00197
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00198
ASSERT(
NT_SUCCESS(st));
00199 }
00200
00201
ASSERT(Peb->Sm.StandardOutput.Context == (PVOID) FileInformation.IndexNumber);
00202
00203 PebSessionInformation.Length =
sizeof(PebSessionInformation);
00204 PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00205 PebSessionInformation.StandardOutput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_PM;
00206 PebSessionInformation.StandardError.FileHandle = Peb->Sm.StandardOutput.FileHandle;
00207 PebSessionInformation.StandardError.Context = (PVOID) FileInformation.IndexNumber;
00208
00209
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00210
00211 st =
RtlCreateUserProcess(
00212 &ImagePathName,
00213 NULL,
00214 NULL,
00215 NULL,
00216 FALSE,
00217 NULL,
00218 NULL,
00219 NULL,
00220 &ProcessInformation,
00221 &PebSessionInformation
00222 );
00223
00224
ASSERT(
NT_SUCCESS(st));
00225
00226
NtResumeThread(ProcessInformation.Thread,NULL);
00227
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00228
NtClose(ProcessInformation.Process);
00229
NtClose(ProcessInformation.Thread);
00230
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00231
00232 }
else {
00233
00234
ASSERT(Peb->Sm.StandardOutput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_PM);
00235
00236
00237
00238
00239
00240 st =
NtQueryInformationFile(
00241 Peb->Sm.StandardError.FileHandle,
00242 &IoStatus,
00243 (PVOID) &FileInformation,
00244
sizeof(FileInformation),
00245 FileInternalInformation
00246 );
00247
00248
if (!
NT_SUCCESS( st )) {
00249
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00250
ASSERT(
NT_SUCCESS(st));
00251 }
00252
00253
ASSERT(Peb->Sm.StandardError.Context == (PVOID) FileInformation.IndexNumber);
00254
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00255 }
00256 }
00257 }
00258 }