{"id":104,"date":"2011-08-29T03:24:21","date_gmt":"2011-08-29T03:24:21","guid":{"rendered":"http:\/\/sxkdz.0ginr.com\/blog\/?p=104"},"modified":"2011-09-01T13:19:36","modified_gmt":"2011-09-01T13:19:36","slug":"createprocess-createprocesswithlogonw-createprocessasuser-%e4%b8%80%e4%ba%9b%e6%b3%a8%e6%84%8f%e4%ba%8b%e9%a1%b9","status":"publish","type":"post","link":"https:\/\/sxkdz.0ginr.com\/blog\/?p=104","title":{"rendered":"CreateProcess, CreateProcessWithLogonW & CreateProcessAsUser \u4e00\u4e9b\u6ce8\u610f\u4e8b\u9879"},"content":{"rendered":"

\u524d\u4e00\u9635\u5b50\u5199Small Sandbox\u548cSXKDZ Compare\u7684\u65f6\u5019\u9047\u5230\u4e86\u4e00\u4e9b\u95ee\u9898\u3002\u95ee\u9898\u90fd\u662f\u51fa\u5728CreateProcess\uff0c CreateProcessWithLogonW\u548cCreateProcessAsUser\u8fd9\u4e09\u4e2a\u51fd\u6570\u4e0a\u3002
\n\u4e8e\u662f\u5199\u4e00\u4e2a\u5907\u6ce8\uff0c\u4ee5\u9632\u5fd8\u8bb0\uff0c\u5982\u6709\u9519\u8bef\uff0c\u8bf7\u7559\u8a00\u6307\u6b63\u3002<\/p>\n

\u7b2c\u4e00\u4e2a\u95ee\u9898\uff1a<\/p>\n

[cpp]
\nCreateProcessW(NULL, _TEXT(“C:\\\\init.exe”), ……);
\n[\/cpp]<\/p><\/blockquote>\n

\u8fd9\u662f SXKDZ Compare\u91cc\u9762\u7684\u4e00\u6bb5\u4ee3\u7801\uff0c\u53ef\u80fd\u660e\u773c\u4eba\u9a6c\u4e0a\u5c31\u770b\u5f97\u51fa\u6765\u3002\u6211\u6ca1\u5199\u8fc7Unicode\u7684\u7a0b\u5e8f\uff08\u641eOI\u7684\u90fd\u662f\u5199Ansi\u7684\u7a0b\u5e8f\uff09\uff0c\u4e8e\u662f\u4ee5\u4e3a\u4ee5\u4e0b\u7684\u4ee3\u7801\u53ef\u4ee5\u76f4\u63a5\u6539\u6210Unicode\u7248\u672c\u7684<\/span><\/p>\n

[cpp]
\nCreateProcessA(NULL, “C:\\\\init.exe”, ……);
\n[\/cpp]<\/p><\/blockquote>\n

\u540e\u6765\u6211\u53d1\u73b0\u6539\u4e3aUnicode\u7248\u672c\u4ee5\u540e\u4f1a\u62a5\u95191812\u6216\u8005\u76f4\u63a5\u5d29\u6e83\uff0c\u4e8e\u662f\u68c0\u67e5StartupInfo\u548cProcessInformation\u7ed3\u6784\u4f53\u7684\u521d\u59cb\u5316\u2026\u2026\u4f46\u662f\u6ca1\u6709\u53d1\u73b0\u9519\u8bef\u3002\uff08\u54a8\u8be2FlowerCode\u4e5f\u65e0\u679c\uff09
\n\u540e\u6765\u54a8\u8be2iceboy\u624d\u77e5\u9053MSDN\u4e2d\u6709\u8fd9\u4e48\u4e00\u53e5\uff08Link<\/a>\uff09\uff1a<\/p>\n

The Unicode version of this function,\u00a0CreateProcessW<\/strong>, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as aconst<\/strong>\u00a0variable or a literal string). If this parameter is a constant string, the function may cause an access violation.<\/p><\/blockquote>\n

\u4e5f\u5c31\u662f\u8bf4\u6211\u5f97\u7ed9\u7b2c\u4e8c\u4e2a\u53c2\u6570\u4e00\u4e2a\u7f13\u51b2\u533a\u3002
\n\u8fd9\u662f\u6211\u72af\u7684\u7b2c\u4e00\u4e2a\u9519\u8bef \ud83d\ude25<\/p>\n

\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff1a\u6211\u5199Small Sandbox\u7684\u65f6\u5019\u60f3\u628a\u88ab\u9650\u5236\u7a0b\u5e8f\u4ee5\u4e00\u4e2a0\u6743\u7528\u6237\u8fd0\u884c\u518d\u52a0\u4e0a\u82e5\u5e72JobObject\u7684\u9650\u5236\u6765\u9632\u6b62\u88ab\u9650\u5236\u7a0b\u5e8f\u4e71\u641e\uff0c\u5c06\u7a0b\u5e8f\u4ee5\u4e00\u4e2a\u7528\u6237\u7684\u6743\u9650\u8fd0\u884c\u67092\u8fd8\u662f\u53ef\u4ee5\u7528\uff1aCreateProcessWithLogonW\u3001CreateProcessAsUser\uff0c\u54a8\u8be2\u718a\u718a\u5f97\u77e5CreateProcessWithLogonW\u65b9\u4fbf\u4e9b\uff08\u5f53\u65f6\u6ca1\u6709\u544a\u8bc9\u4ed6\u6211\u8fd8\u8981\u52a0JobObject\uff09\uff0c\u4e8e\u662f\u6709\u4e86\u5982\u4e0b\u4ee3\u7801\uff1a<\/p>\n

[cpp]
\nCreateProcessWithLogonW(_TEXT(“Username”),\u00a0_TEXT(“.”), _TEXT(“Password”), LOGON_WITH_PROFILE, NULL, _TEXT(“C:\\\\init.exe”), ……);
\n[\/cpp]<\/p><\/blockquote>\n

\u7136\u540e\u6210\u529f\u4ee5\u540e\u52a0\u5165JobObject\uff0c\u63d0\u793a\u62d2\u7edd\u8bbf\u95ee-5\u7684\u9519\u8bef\uff0c\u7136\u540e\u627e\u5230\u4e00\u89e3\u51b3\u65b9\u6848\uff08Link<\/a>\uff09\uff0c\u6309\u7167\u89e3\u51b3\u65b9\u6848\u6dfb\u52a0\u4e86Breakaway form job\u7684\u6807\u8bb0\u8fd8\u662f\u9519\u4e86\u3002\u6700\u540e\u5728StackOverFlow\u91cc\u627e\u5230\u4e00\u63d0\u95ee\uff08Link<\/a>\uff09\uff0c\u91cc\u9762\u6709\u8fd9\u6837\u4e00\u53e5\uff1a<\/p>\n

Edit: It seems that svchost.exe, which actually creates the process when CreateProcessWithLogonW is used, already assigns the process to an anonymous job<\/strong>. The CREATE_CREAKAWAY_FROM_JOB flag is ignored by this function.<\/strong> So the real question is: is there a way to prevent svnhost from assigning the process to a job ?<\/p><\/blockquote>\n

\u4e8e\u662f\u54a8\u8be2ib\uff0c\u5f97\u51fa\u4e0d\u80fd\u540c\u65f6\u4f7f\u7528JobObject\u548cCreateProcessWithLogonW\u8fd9\u4fe9\u73a9\u610f\u513f\uff0c\u4e8e\u662f\u5c1d\u8bd5\u5199CreateProcessAsUser\u3002
\n\u5f00\u59cb\u7684\u65f6\u5019\u83ab\u540d\u5176\u5999\u4ec0\u4e48\u9519\u8bef\u5427\uff08\u6e90\u4ee3\u7801\u5df2\u7ecf\u4e22\u4e86 \ud83d\ude21 \uff09 \uff0c\u7136\u540e\u6539\u4e86\u6539\u5f39\u51fa\u4e86\u5e94\u7528\u7a0b\u5e8f\u521d\u59cb\u5316\u5931\u8d25\uff0c\u7136\u540eib\u544a\u8bc9\u6211\u662f\u6ca1\u6709\u67d0\u6743\u9650\uff08\u6211\u7684\u804a\u5929\u8bb0\u5f55\u4e22\u4e86\uff09\uff0c\u4e8e\u662f\u53c2\u7167VijosNT Mini\u7684\u4ee3\u7801\u6dfb\u52a0\u4e86\u7ed9\u7a97\u53e3\u7ad9\u548c\u4e00\u4e2a\u6211\u53c8\u5fd8\u8bb0\u540d\u5b57\u7684\u4e1c\u897f\u52a0\u4e0a\u4e86\u6743\u9650\uff0c\u6700\u540e\u6210\u529f\u3002
\n\u4ee3\u7801\u5b58\u6863\uff1a

\n\n\tCreateProcessAsUser + JobObject \u4ee3\u7801\u5b58\u6863\t(0 downloads<\/span>\n\t)\n<\/a>\n<\/div>\n<\/p>\n

ib\u53cb\u60c5\u63d0\u793a\uff1a\u8fd9\u4e2a\u51fd\u6570\u5f88\u96be\u7528\u2026\u2026<\/p>\n","protected":false},"excerpt":{"rendered":"

\u524d\u4e00\u9635\u5b50\u5199Small Sandbox\u548cSXKDZ Compare\u7684\u65f6\u5019\u9047\u5230\u4e86\u4e00\u4e9b\u95ee\u9898\u3002\u95ee\u9898\u90fd\u662f\u51fa\u5728CreateProcess\uff0c CreateProcessWithLogonW\u548cCreateProcessAsUser\u8fd9\u4e09\u4e2a\u51fd\u6570\u4e0a\u3002 \u4e8e\u662f\u5199\u4e00\u4e2a\u5907\u6ce8\uff0c\u4ee5\u9632\u5fd8\u8bb0\uff0c\u5982\u6709\u9519\u8bef\uff0c\u8bf7\u7559\u8a00\u6307\u6b63\u3002 \u7b2c\u4e00\u4e2a\u95ee\u9898\uff1a [cpp] CreateProcessW(NULL, _TEXT(“C:\\\\init.exe”), ……); [\/cpp] \u8fd9\u662f SXKDZ Compare\u91cc\u9762\u7684\u4e00\u6bb5\u4ee3\u7801\uff0c\u53ef\u80fd\u660e\u773c\u4eba\u9a6c\u4e0a\u5c31\u770b\u5f97\u51fa\u6765\u3002\u6211\u6ca1\u5199\u8fc7Unicode\u7684\u7a0b\u5e8f\uff08\u641eOI\u7684\u90fd\u662f\u5199Ansi\u7684\u7a0b\u5e8f\uff09\uff0c\u4e8e\u662f\u4ee5\u4e3a\u4ee5\u4e0b\u7684\u4ee3\u7801\u53ef\u4ee5\u76f4\u63a5\u6539\u6210Unicode\u7248\u672c\u7684 [cpp] CreateProcessA(NULL, “C:\\\\init.exe”, ……); [\/cpp] \u540e\u6765\u6211\u53d1\u73b0\u6539\u4e3aUnicode\u7248\u672c\u4ee5\u540e\u4f1a\u62a5\u95191812\u6216\u8005\u76f4\u63a5\u5d29\u6e83\uff0c\u4e8e\u662f\u68c0\u67e5StartupInfo\u548cProcessInformation\u7ed3\u6784\u4f53\u7684\u521d\u59cb\u5316\u2026\u2026\u4f46\u662f\u6ca1\u6709\u53d1\u73b0\u9519\u8bef\u3002\uff08\u54a8\u8be2FlowerCode\u4e5f\u65e0\u679c\uff09 \u540e\u6765\u54a8\u8be2iceboy\u624d\u77e5\u9053MSDN\u4e2d\u6709\u8fd9\u4e48\u4e00\u53e5\uff08Link\uff09\uff1a The Unicode version of this function,\u00a0CreateProcessW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as aconst\u00a0variable or a literal string). If this parameter is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[27,24,25,26,29,23,28],"class_list":["post-104","post","type-post","status-publish","format-standard","hentry","category-22","tag-27","tag-createprocess","tag-createprocessasuser","tag-createprocesswithlogonw","tag-jobobject","tag-win32-api","tag-28"],"_links":{"self":[{"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=104"}],"version-history":[{"count":13,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/104\/revisions"}],"predecessor-version":[{"id":112,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/104\/revisions\/112"}],"wp:attachment":[{"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sxkdz.0ginr.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}