2025. 1. 10. 18:14

How to change the parent process when calling CreateProcess API

Usually, the parent process is the process that creats the new process. But you can change this behavior by setting STARTUPINFOEX.lpAttributeList.

HANDLE hParentProcess{ nullptr };
LPPROC_THREAD_ATTRIBUTE_LIST attrList{ nullptr };


// Initialize LPPROC_THREAD_ATTRIBUTE_LIST
hParentProcess = OpenProcess(PROCESS_CREATE_PROCESS, FALSE, parentProcessId);

SIZE_T attrListSize = 0;
InitializeProcThreadAttributeList(nullptr, 1, 0, &attrListSize);
attrList = (LPPROC_THREAD_ATTRIBUTE_LIST)malloc(attrListSize);

InitializeProcThreadAttributeList(attrList, 1, 0, &attrListSize);

UpdateProcThreadAttribute(attrList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hParentProcess,
	sizeof(hParentProcess), nullptr, nullptr);


// Set LPPROC_THREAD_ATTRIBUTE_LIST to the STARTUPINFOEX
STARTUPINFOEX  si = { sizeof(si) };
si.StartupInfo.cb = sizeof(si);
si.lpAttributeList = attrList;

PROCESS_INFORMATION pi = { 0 };


CreateProcess(nullptr, argv[1], nullptr, nullptr, FALSE, EXTENDED_STARTUPINFO_PRESENT, nullptr, nullptr, &si.StartupInfo, &pi);

 

 

 

2024. 4. 9. 11:15

How to open Control Panel Items in the separate explorer.exe

If you want to open 'This PC\All Control Panel Items\Programs and Features'
First you need to convert each items to GUID

  • This PC -> 20d04fe0-3aea-1069-a2d8-08002b30309d
  • All Control Panel Items -> 21ec2020-3aea-1069-a2dd-08002b30309d
  • Programs and Features -> 7b81be6a-ce2b-4676-a29e-eb907a5126c5

Then launch exporer.exe with /separate paramter

For example:

C:\Windows\explorer.exe /separate, ::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{21ec2020-3aea-1069-a2dd-08002b30309d}\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}

Then the above process will be terminated and the below process shows up with ' Programs and Features'

C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

If you want to launch explorer.exe as your descendant process, there is a way

  1. Run: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    • This process is your descendant process and it is invisible.
  2. Run: C:\Windows\explorer.exe /separate, ::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{21ec2020-3aea-1069-a2dd-08002b30309d}\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}
    • This process will be terminated and 'Programs and Features' will be showed in the previous explorer.exe.
    • But if there is one more explorer.exe /factory, there is no gurantee which one shows 'Programs and Features'.

 

2022. 1. 20. 15:27

How to list installed programs using IShellAppManager

// appwiz.cpl is COM server related to (UnInstall or Change a program)
#include <shappmgr.h>
#include <iostream>
#import <appwiz.cpl>

// If this import gets into trobule, you could solve the problem by using #import directives
/*
#import <appwiz.cpl> rename("tag_inner_PROPVARIANT", "_tag_inner_PROPVARIANT") \
inject_statement("typedef struct _LARGE_INTEGER2 { LONGLONG QuadPart; } LARGE_INTEGER2;") \
inject_statement("typedef struct _ULARGE_INTEGER2 { ULONGLONG QuadPart;} ULARGE_INTEGER2;") \
rename("_LARGE_INTEGER", " _LARGE_INTEGER2") \
rename("_ULARGE_INTEGER", "_ULARGE_INTEGER2")
*/

int main()
{

	::CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);

	class __declspec(uuid("{352EC2B7-8B9A-11D1-B8AE-006008059382}")) AppWiz;
	static const CLSID CLSID_AppWiz = __uuidof(AppWiz);

	SHAPPMGRPLib::IShellAppManagerPtr spShellAppManaager;
	HRESULT hr = spShellAppManaager.CreateInstance(CLSID_AppWiz, NULL, CLSCTX_INPROC_SERVER);

	SHAPPMGRPLib::IEnumInstalledAppsPtr spEnumInstalledApps;
	hr = spShellAppManaager->EnumInstalledApps(&spEnumInstalledApps);

	SHAPPMGRPLib::IInstalledAppPtr spInstalledApp;
	SHAPPMGRPLib::IInstalledApp* pInstalledApp;
	
	while (S_OK == (hr = spEnumInstalledApps->Next(&pInstalledApp))) {

		spInstalledApp = pInstalledApp;


		SHAPPMGRPLib::_AppInfoData data = { 0 };
		data.cbSize = sizeof(SHAPPMGRPLib::_AppInfoData);
		data.dwMask = AIM_DISPLAYNAME | AIM_VERSION | AIM_PUBLISHER | AIM_INSTALLDATE;

		hr = spInstalledApp->GetAppInfo(&data);

		// You have to check the validation of the data before using it.

		std::wcout << "Name: " << data.pszDisplayName << " ver: " << data.pszVersion
			<< " publisher: " << data.pszPublisher << " installedOn: " << data.pszInstallDate << std::endl;

	}

	::CoUninitialize();

	return 0;
}

 

2019. 3. 15. 13:11

URLDownloadToFile with IBindStatusCallback and IHTTPSecurity

The last parameter of URLDownloadToFile and URLDownloadToCacheFile API is the pointer of IBindStatusCallback.
This paramter is optional, so you can just set NULL; however, in my experience, you have to implement IBindStatusCallback in many cases.


 class CBindStatusCallback : public IBindStatusCallback , public IHttpSecurity
{
public:
 CBindStatusCallback()
 ~CBindStatusCallback(){}

 ///// IUnknown methods
 STDMETHOD_(ULONG,AddRef)()
        { return 1; } //non-heap-based objects:

    STDMETHOD_(ULONG,Release)()
        { return 1; } //non-heap-based objects:

    STDMETHOD(QueryInterface)(
    /* [in] */ REFIID riid,
    /* [iid_is][out] */ void __RPC_FAR *__RPC_FAR *ppvObject);


 ///// IBindStatusCallback methods.
 STDMETHOD(OnStartBinding)(
        /* [in] */ DWORD dwReserved,
        /* [in] */ IBinding __RPC_FAR *pib)
        { return E_NOTIMPL; }

  1. Implement IUnknown interface
    • AddRef, Relase Method
      • You can implement this function according to official rule, but there is trick.
      • You can make this object local variable, then you don't need to worry about it's lifetime.
      • return non-zero value: it means this object will not be destroyed.
    • QueryInterface Method
      •  HRESULT CBindStatusCallback::QueryInterface(
            /* [in] */ REFIID riid,
            /* [iid_is][out] */ void __RPC_FAR *__RPC_FAR *ppvObject)
        {
         if( !ppvObject)
          return E_INVALIDARG;

         if( IID_IUnknown == riid )
          *ppvObject =static_cast<IBindStatusCallback*>(this);
         else if( IID_IBindStatusCallback == riid)
          *ppvObject =static_cast<IBindStatusCallback*>(this);
         else if( IID_IWindowForBindingUI == riid)
          *ppvObject =static_cast<IWindowForBindingUI*>(this);
         else if( IID_IHttpSecurity == riid )
          *ppvObject =static_cast<IHttpSecurity*>(this);
         else
         {
          *ppvObject = NULL;
          return E_NOINTERFACE;
         }

         reinterpret_cast<IUnknown*>(*ppvObject)->AddRef();
         return S_OK;

        }


  2. Implement IBindStatusCallback interface
    • You don't need to implement every method; you can actually write 'return E_NOTIMPL' in almost cases.
    • GetBindInfo method has crucial role.
      • You can set a code page.
        • If there is non English character in URL, it can be an issue depending on the OS language setting.
      • Also, You can set several options.

       HRESULT CBindStatusCallback::GetBindInfo(
              /* [out] */ DWORD __RPC_FAR *grfBINDF,
              /* [unique][out][in] */ BINDINFO __RPC_FAR *pbindinfo)
      {

       *grfBINDF = BINDF_ASYNCHRONOUS;

       DWORD cbSize = pbindinfo->cbSize;
       memset(pbindinfo, 0, cbSize);
       pbindinfo->cbSize = cbSize;
       pbindinfo->dwCodePage = CP_UTF8;

       return S_OK;

      }


  3. Implement IHttpSecurity interface
    • You can download files even though the sever has some security problems such as a self-signed certificate.
    •   ///// IWindowForBindingUI
      HRESULT CBindStatusCallback::GetWindow(
                  /* [in] */ REFGUID rguidReason,
                  /* [out] */ HWND *phwnd)
      {
       return S_FALSE; // This indicate that no window is available.
      }


      ///// IHttpSecurity
      HRESULT CBindStatusCallback::OnSecurityProblem(
              /* [in] */ DWORD dwProblem)
      {
       return S_OK;  // Ignore securiy errors.
      }



2019. 2. 16. 09:54

How to make a volatile registry using NSIS script

There is no native way to make a volatile registry key in NSIS, so we have to call WINAPI directly.

 !define REG_OPTION_VOLATILE             1

Function MakeVolatileKey

    System::Call 'advapi32::RegCreateKeyEx(i ${HKEY_LOCAL_MACHINE}, t "Software\volatile", i0, i0, i ${REG_OPTION_VOLATILE}, i ${GENERIC_WRITE}, i0, *i.r1, *i)i.r0'
    ${If} $0 = 0
            System::Call 'advapi32::RegCloseKey(ir1)'
            WriteRegDWORD HKLM "Software\volatile" test 1
    ${EndIf}
 
FunctionEnd

But, there is one thing we have to consider on 64bit Windows.
If we add a code 'SetRegView 64' in order to avoid registry redirection, two registry keys are made:
    1. HKEY_LOCAL_MACHINE\SOFTWARE\Volatile (by WriteRegDWORD)
    2, HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\volatile (by RegCreateKeyEx)
 
SetRegView can not affect native registry APIs; then we should apply a KEY_WOW64_64KEY option to RegCreateKeyEx API.


!include WinCore.nsh
!include LogicLib.nsh
!include x64.nsh

!define REG_OPTION_VOLATILE             1
!define KEY_WOW64_64KEY                 0x0100


Function MakeVolatileKey

    ${If} ${RunningX64}
        IntOp $R0 ${GENERIC_WRITE} + ${KEY_WOW64_64KEY}
        SetRegView 64
    ${Else}
        Strcpy $R0 ${GENERIC_WRITE}       
        SetRegView 32
    ${EndIf}
 
    System::Call 'advapi32::RegCreateKeyEx(i ${HKEY_LOCAL_MACHINE}, t "Software\volatile", i0, i0, i ${REG_OPTION_VOLATILE}, i $R0, i0, *i.r1, *i)i.r0'
    ${If} $0 = 0
            System::Call 'advapi32::RegCloseKey(ir1)'
            WriteRegDWORD HKLM "Software\Volatile" test 1
    ${EndIf}
 
FunctionEnd


2016. 11. 10. 16:36

How to remove project dependency in Visual Studio

Issue : When removing a dependency of a project, I got a message "The dependency was added by the project system and cannot be removed


Solution

  1. Right click project, select Properties.
  2. Select Framework and References under Common Properties
  3. Select the references thats not needed.
  4. Click on Remove Reference.


2015. 3. 12. 10:12

Show a list of include files in visual studio

Configuration Properties -> C/C++ -> Advanced -> Show  includes (YES)

Confirm what header file is included

ex) error C2039: 'int8_t' : is not a member of '`global namespace''


2015. 1. 12. 11:38

Debugging windows services

using psexec

psexec –sd –i 0 "c:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /noauth /anyuser /silent


download psexec 


How to debug Windows services with Windbg




2014. 7. 14. 09:10

C++ Cocurrency tutorial

c++ Concurrency tutorial

http://baptiste-wicht.com/categories/c11-concurrency-tutorial.html

2014. 3. 4. 16:02

Run program with Restricted Privilege

1. Using PsExec

http://technet.microsoft.com/ko-kr/sysinternals/bb897553.aspx

PsExec -d


2. using CreateRestrictedToken, CreateProcessAsUser



HANDLE hProcessToken = NULL;

::OpenProcessToken( GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_DUPLICATE  

| TOKEN_DUPLICATE  | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_SESSIONID | TOKEN_READ | TOKEN_WRITE, &hProcessToken );


HANDLE hRestrictedToken = NULL;

::CreateRestrictedToken(hProcessToken, DISABLE_MAX_PRIVILEGE, 0, 0, 0, 0, 0, 0, &hRestrictedToken );


//Create startup info

    STARTUPINFO si = {0};

    PROCESS_INFORMATION pi = {0};

    si.lpDesktop = L"winsta0\\default";

    si.cb = sizeof( si );


    // Get the current executables name

    TCHAR exePath[MAX_PATH+1] = {0};

    GetModuleFileName(NULL, exePath, MAX_PATH);


    // Start the new (non-elevated) restricted process

if( !CreateProcessAsUser(hRestrictedToken, L"c:\\windows\\notepad.exe", NULL, NULL, NULL, TRUE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi))

    {

        CloseHandle(hRestrictedToken);

        return;

    }


3 using SaferCreateLevel CreateProcessAsUser


 

 SAFER_LEVEL_HANDLE hLevel = NULL;

    if (!SaferCreateLevel(SAFER_SCOPEID_MACHINE, SAFER_LEVELID_NORMALUSER, SAFER_LEVEL_OPEN, &hLevel, NULL))

    {

        return false;

    }


    HANDLE hRestrictedToken = NULL;

    if (!SaferComputeTokenFromLevel(hLevel, NULL, &hRestrictedToken, 0, NULL))

    {

        SaferCloseLevel(hLevel);

        return false;

    }


    SaferCloseLevel(hLevel);


    //Create startup info

    STARTUPINFO si = {0};

    PROCESS_INFORMATION pi = {0};

    si.lpDesktop = L"winsta0\\default";

    si.cb = sizeof( si );


    // Get the current executables name

    TCHAR exePath[MAX_PATH+1] = {0};

    GetModuleFileName(NULL, exePath, MAX_PATH);


    // Start the new (non-elevated) restricted process

    if( !CreateProcessAsUser(hRestrictedToken, exePath, NULL, NULL, NULL, TRUE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi))

    {

        CloseHandle(hRestrictedToken);

        return false;

    }


    CloseHandle(hRestrictedToken);

    CloseHandle(pi.hThread);

    CloseHandle(pi.hProcess);


    return true;