C++ CreateProcessA函数代码示例

static int parent_main(HANDLE rev)
{
	HANDLE dev;
	HANDLE ht[2];
	char * cmdline;
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	DWORD rc, exitcode;

	// Ignore ^C, ^BREAK in parent
	SetConsoleCtrlHandler(parent_console_handler, TRUE/*add*/);

	// Create event used by child to signal daemon_detach()
	if (!(dev = create_event(EVT_DETACHED, FALSE/*not signaled*/, TRUE, NULL/*must not exist*/))) {
		CloseHandle(rev);
		return 101;
	}

	// Restart process with same args
	cmdline = GetCommandLineA();
	memset(&si, 0, sizeof(si)); si.cb = sizeof(si);
	
	if (!CreateProcessA(
		NULL, cmdline,
		NULL, NULL, TRUE/*inherit*/,
		0, NULL, NULL, &si, &pi)) {
		fprintf(stderr, "CreateProcess(.,\"%s\",.) failed, Error=%ld\n", cmdline, GetLastError());
		CloseHandle(rev); CloseHandle(dev);
		return 101;
	}
	CloseHandle(pi.hThread);

	// Wait for daemon_detach() or exit()
	ht[0] = dev; ht[1] = pi.hProcess;
	rc = WaitForMultipleObjects(2, ht, FALSE/*or*/, INFINITE);
	if (!(/*WAIT_OBJECT_0(0) <= rc && */ rc < WAIT_OBJECT_0+2)) {
		fprintf(stderr, "WaitForMultipleObjects returns %lX\n", rc);
		TerminateProcess(pi.hProcess, 200);
	}
	CloseHandle(rev); CloseHandle(dev);

	// Get exit code
	if (!GetExitCodeProcess(pi.hProcess, &exitcode))
		exitcode = 201;
	else if (exitcode == STILL_ACTIVE) // detach()ed, assume OK
		exitcode = 0;

	CloseHandle(pi.hProcess);
	return exitcode;
}

/**
 * @brief 运行进程函数
 * 创建经编译的代码的可执行文件进程
 *
 * @param exe 可执行文件文件名
 * @param input 进程输入文件名
 * @param output 进程输出文件名
 * @param cs 用于接收代码状态的引用
 * @param hInput 用于接收输入文件句柄
 * @param hOutput 用于接收输出文件句柄
 * @return 若进程创建成功则返回进程句柄，否则返回NULL
 */
HANDLE CNBUTOJCore::RunCode(const char *exe, const char *input, const char *output, CodeState &cs, HANDLE &hInput, HANDLE &hOutput, PROCESS_INFORMATION &inProcInfo)
{
    SECURITY_ATTRIBUTES sa;
    sa.bInheritHandle = true;
    sa.nLength = sizeof(sa);
    sa.lpSecurityDescriptor = NULL;

    /** 打开得到输入输出文件句柄 */
    hInput = hOutput = NULL;
    hInput = CreateFile(input, GENERIC_READ, NULL, &sa, OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL, NULL);
    hOutput = CreateFile(output, GENERIC_WRITE | GENERIC_READ, NULL,
        &sa, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    //HANDLE hError = CreateFile(".err", GENERIC_WRITE | GENERIC_READ, NULL,
    //    &sa, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if(NULL == hInput || NULL == hOutput)
    {
        cs.state = SYSTEM_ERROR;
        strcpy(cs.err_code, "File error.");

        return NULL;
    }

    PROCESS_INFORMATION ProcInfo;
    STARTUPINFO StartInfo = { sizeof(StartInfo) };
    StartInfo.cb = sizeof(StartInfo);
    StartInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    StartInfo.hStdInput = hInput;
    StartInfo.hStdOutput = hOutput;
    StartInfo.wShowWindow = SW_HIDE;
    //StartInfo.hStdError = hError;

    /** 运行程序 */
    bool flag = CreateProcessA(exe, NULL, NULL,
        NULL, true, DEBUG_ONLY_THIS_PROCESS, NULL, NULL, &StartInfo, &ProcInfo);

    /** 若运行不成功 */
    if(!flag)
    {
        cs.state = SYSTEM_ERROR;
        strcpy(cs.err_code, "Can't create process.");

        return NULL;
    }

    cs.state = RUNNING;
    inProcInfo = ProcInfo;

    return ProcInfo.hProcess;
}

void injectProcess(HANDLE proc) {
	HANDLE tid;
	BOOL is32;
	FARPROC addr;
	LPVOID arg;
	char dll[PATH_MAX];
	char *ext = 0;
	DWORD rc;
	extern IMAGE_DOS_HEADER __ImageBase;
	ASSERT(proc);
	memset(dll, 0, sizeof(dll));
	CHK(GetModuleFileNameA((HMODULE)&__ImageBase, dll, sizeof(dll)));
	if (!ext)
		ext = strstr(dll, ".exe");
	if (!ext)
		ext = strstr(dll, ".dll");
	if (!ext)
		ext = dll + strlen(dll);
	CHK(IsWow64Process(proc, &is32));
	CHK(0 != (arg = VirtualAllocEx(proc, 0, strlen(dll) + 1,
				       MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)));
	if (strcmp(ext, ".dll"))
		memcpy(ext, is32 ? "32.dll" : "64.dll", 6);
	if (is32) {
		STARTUPINFO si;
		PROCESS_INFORMATION pi;
		const char * helpername = "fsatracehelper.exe";
		char helper[PATH_MAX];
		char * p;
		memset(&si, 0, sizeof(si));
		memset(&pi, 0, sizeof(pi));
		si.cb = sizeof(si);
		memcpy(helper, dll, strlen(dll)+1);
		p = strrchr(helper, '\\');
		memcpy(p+1, helpername, strlen(helpername)+1);
		CHK(CreateProcessA(0, helper, 0, 0, 0, 0, 0, 0, &si, &pi));
		CHK(WAIT_OBJECT_0 == WaitForSingleObject(pi.hProcess, INFINITE));
		CHK(GetExitCodeProcess(pi.hProcess, &rc));
		addr = (FARPROC)(uintptr_t)rc;
	}
	else
		addr = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
	CHK(addr);
	CHK(WriteProcessMemory(proc, arg, dll, strlen(dll) + 1, NULL));
	CHK(0 != (tid = CreateRemoteThread(proc, 0, 0,
					   (LPTHREAD_START_ROUTINE)addr, arg, 0, 0)));
	CHK(-1 != ResumeThread(tid));
	CHK(WAIT_OBJECT_0 == WaitForSingleObject(tid, INFINITE));
	CHK(CloseHandle(tid));
}

static int LLDebugExecuteFile(const std::string &filename,
							  unsigned short port) {
	PROCESS_INFORMATION pi;
	STARTUPINFOA si;

	// Initialize the infomation.
	memset(&pi, 0, sizeof(pi));
	memset(&si, 0, sizeof(si));
	si.cb = sizeof(si);
	si.wShowWindow = SW_SHOW;

	// Execution string. This must be mutable.
	char commandline[_MAX_PATH * 2];
	snprintf(commandline, sizeof(commandline), "\"%s\" %d",
		filename.c_str(), port);
	
	// Execute file.
	BOOL result = CreateProcessA(
		NULL, // filename
		commandline, // arguments
		NULL, // process attributes
		NULL, // thread attributes
		FALSE, // is inherit handle
		NORMAL_PRIORITY_CLASS, // attributes
		NULL, // pointer of environmental path
		NULL, // curret directory
		&si, // startup info
		&pi // process and thread info
		);

	if (!result) {
		LPTSTR lpBuffer;
		FormatMessage(
			FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
			NULL,
			GetLastError(),
			LANG_USER_DEFAULT,
			(LPTSTR)&lpBuffer,
			0,
			NULL);
		MessageBox(NULL, lpBuffer, TEXT("error message"), MB_ICONHAND|MB_OK);
		LocalFree(lpBuffer);
		return -1;
	}

	CloseHandle(pi.hThread);
	CloseHandle(pi.hProcess);
	return 0;
}

static int cmd_available(void)
{
    STARTUPINFOA si;
    PROCESS_INFORMATION pi;
    char cmd[] = "cmd /c exit 0";

    memset(&si, 0, sizeof(si));
    si.cb = sizeof(si);
    if (CreateProcessA(NULL, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)) {
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return TRUE;
    }
    return FALSE;
}

    SDHANDLE SDAPI SDCreateProcess(const char * progName, const char * pCmdLine ,const char * pWorkDir, SProcessAttr * pAttr )
    {
#if (defined(WIN32) || defined(WIN64))
        STARTUPINFOA m_sinfo;
        PROCESS_INFORMATION m_pinfo;
        void * pEnv = NULL;
        bool inherithandle = false;
        uint32 createFlags =0;
        if (pAttr != NULL)
        {
            pEnv = (LPVOID)pAttr->environment.c_str();
            inherithandle = pAttr->inherithandle;
            createFlags = pAttr->createFlags;
        }

        memset((void*)&m_pinfo, 0, sizeof(PROCESS_INFORMATION));
        memset((void*)&m_sinfo, 0, sizeof(STARTUPINFO));
        m_sinfo.cb = sizeof(STARTUPINFO);
        if( !CreateProcessA( progName,
                             (LPSTR)pCmdLine,
                             NULL,
                             NULL,
                             inherithandle,
                             createFlags,
                             (LPVOID)pEnv,
                             pWorkDir,
                             &m_sinfo,
                             &m_pinfo)
          )
        {
            return SDINVALID_HANDLE;
        }
		return (SDHANDLE)s_processIndexer.Alloc(m_pinfo); 
#else
        pid_t m_pid;
        if ( (m_pid = fork()) < 0 )
        {
			return s_processIndexer.Alloc(m_pid); 
        }
        else if(m_pid == 0)
        {
            execv(pWorkDir, NULL);
            _exit(-1);
        }
		return s_processIndexer.Alloc(m_pid); 
#endif

    }

static BOOL
create_process (const char *program, char *args,
		DWORD flags, PROCESS_INFORMATION *pi)
{
  BOOL ret;

#ifdef _WIN32_WCE
  wchar_t *p, *wprogram, *wargs;
  size_t argslen;

  wprogram = alloca ((strlen (program) + 1) * sizeof (wchar_t));
  mbstowcs (wprogram, program, strlen (program) + 1);

  for (p = wprogram; *p; ++p)
    if (L'/' == *p)
      *p = L'\\';

  argslen = strlen (args);
  wargs = alloca ((argslen + 1) * sizeof (wchar_t));
  mbstowcs (wargs, args, argslen + 1);

  ret = CreateProcessW (wprogram, /* image name */
			wargs,    /* command line */
			NULL,     /* security, not supported */
			NULL,     /* thread, not supported */
			FALSE,    /* inherit handles, not supported */
			flags,    /* start flags */
			NULL,     /* environment, not supported */
			NULL,     /* current directory, not supported */
			NULL,     /* start info, not supported */
			pi);      /* proc info */
#else
  STARTUPINFOA si = { sizeof (STARTUPINFOA) };

  ret = CreateProcessA (program,  /* image name */
			args,     /* command line */
			NULL,     /* security */
			NULL,     /* thread */
			TRUE,     /* inherit handles */
			flags,    /* start flags */
			NULL,     /* environment */
			NULL,     /* current directory */
			&si,      /* start info */
			pi);      /* proc info */
#endif

  return ret;
}

static void test_debug_heap( const char *argv0, DWORD flags )
{
    char keyname[MAX_PATH];
    char buffer[MAX_PATH];
    PROCESS_INFORMATION	info;
    STARTUPINFOA startup;
    BOOL ret;
    DWORD err;
    HKEY hkey;
    const char *basename;

    if ((basename = strrchr( argv0, '\\' ))) basename++;
    else basename = argv0;

    sprintf( keyname, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\%s",
             basename );
    if (!strcmp( keyname + strlen(keyname) - 3, ".so" )) keyname[strlen(keyname) - 3] = 0;

    err = RegCreateKeyA( HKEY_LOCAL_MACHINE, keyname, &hkey );
    if (err == ERROR_ACCESS_DENIED)
    {
        skip("Not authorized to change the image file execution options\n");
        return;
    }
    ok( !err, "failed to create '%s' error %u\n", keyname, err );
    if (err) return;

    if (flags == 0xdeadbeef)  /* magic value for unsetting it */
        RegDeleteValueA( hkey, "GlobalFlag" );
    else
        RegSetValueExA( hkey, "GlobalFlag", 0, REG_DWORD, (BYTE *)&flags, sizeof(flags) );

    memset( &startup, 0, sizeof(startup) );
    startup.cb = sizeof(startup);

    sprintf( buffer, "%s heap.c 0x%x", argv0, flags );
    ret = CreateProcessA( NULL, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &startup, &info );
    ok( ret, "failed to create child process error %u\n", GetLastError() );
    if (ret)
    {
        winetest_wait_child_process( info.hProcess );
        CloseHandle( info.hThread );
        CloseHandle( info.hProcess );
    }
    RegDeleteValueA( hkey, "GlobalFlag" );
    RegCloseKey( hkey );
    RegDeleteKeyA( HKEY_LOCAL_MACHINE, keyname );
}

int spawn_shell(PROCESS_INFORMATION *pi, HANDLE *out_read, HANDLE *in_write)
{
	SECURITY_ATTRIBUTES sattr;
	STARTUPINFOA si;
	HANDLE in_read, out_write;

	memset(&si, 0x00, sizeof(SECURITY_ATTRIBUTES));
	memset(pi, 0x00, sizeof(PROCESS_INFORMATION));
    
	// create communication pipes  
	memset(&sattr, 0x00, sizeof(SECURITY_ATTRIBUTES));
	sattr.nLength = sizeof(SECURITY_ATTRIBUTES); 
	sattr.bInheritHandle = TRUE; 
	sattr.lpSecurityDescriptor = NULL; 

	if (!CreatePipe(out_read, &out_write, &sattr, 0)) {
		return STATUS_PROCESS_NOT_CREATED;
	}
	if (!SetHandleInformation(*out_read, HANDLE_FLAG_INHERIT, 0)) {
		return STATUS_PROCESS_NOT_CREATED;
	}

	if (!CreatePipe(&in_read, in_write, &sattr, 0)) {
		return STATUS_PROCESS_NOT_CREATED;
	}
	if (!SetHandleInformation(*in_write, HANDLE_FLAG_INHERIT, 0)) {
		return STATUS_PROCESS_NOT_CREATED;
	}

	// spawn process
	memset(&si, 0x00, sizeof(STARTUPINFO));
	si.cb = sizeof(STARTUPINFO); 
	si.hStdError = out_write;
	si.hStdOutput = out_write;
	si.hStdInput = in_read;
	si.dwFlags |= STARTF_USESTDHANDLES;

	if (!CreateProcessA(NULL, "cmd", NULL, NULL, TRUE, 0, NULL, NULL, (LPSTARTUPINFOA) &si, pi)) {
		return STATUS_PROCESS_NOT_CREATED;
	}

	CloseHandle(out_write);
	CloseHandle(in_read);

	return STATUS_OK;
}

static int mysystem(const char *command)
{
  int ret;
  STARTUPINFOA        si; //  = { sizeof(si)};
  si.cb = sizeof(si);
  PROCESS_INFORMATION pi;
  char cmd[4096];

  //strcpy(cmd,command);
  ExpandEnvironmentStringsA(command,cmd,sizeof(cmd)-1);
  ret = (int) CreateProcessA( NULL, cmd
                           , NULL, NULL
                           , FALSE, CREATE_NO_WINDOW
                           , NULL, NULL
                           , &si, &pi);
  return ret;
}

// --------------------------------------------------------------------------------
//	Executes the given executable with the given arguments.
//
//   path      : Path to executable to run.
//   arguments : Arguments to pass to executable.
//   directory : Working directory.
//
//   Returns : True if successful, otherwise false.
// --------------------------------------------------------------------------------
bool FileHelper::Execute(std::string path, std::string arguments, std::string directory)
{
    STARTUPINFOA       siStartupInfo;
    PROCESS_INFORMATION piProcessInfo;

    memset(&siStartupInfo, 0, sizeof(siStartupInfo));
    memset(&piProcessInfo, 0, sizeof(piProcessInfo));

    siStartupInfo.cb = sizeof(siStartupInfo);

	std::string finalArg = std::string("Shell " + arguments);
	char argArray[256];
	char* argArrayPtr = (char*)(&argArray);

	if (finalArg.size() < 256)
	{
		finalArg.copy(argArrayPtr, finalArg.size());
		argArray[finalArg.size()] = '\0';
	}
    int res = CreateProcessA(path.c_str(),  
                    (char*)(&argArray),                 
                     0,
                     0,
                     FALSE,
                     CREATE_DEFAULT_ERROR_MODE,
                     0,
                     directory == "" ? 0 : directory.c_str(),                            
                     &siStartupInfo,
                     &piProcessInfo);
	
	if (res == 0)
		return false;

	WaitForSingleObject(piProcessInfo.hProcess, INFINITE);

	return true;
	
	/*
	HINSTANCE res = ShellExecuteA(NULL, "open", path.c_str(), arguments.c_str(), NULL, SW_SHOWNORMAL);

	if (reinterpret_cast<int>(res) > 32)
		return true;
	
	return false;
	*/
}

int LLProcessLauncher::launch(void)
{
	// If there was already a process associated with this object, kill it.
	kill();
	orphan();

	int result = 0;
	
	PROCESS_INFORMATION pinfo;
	STARTUPINFOA sinfo;
	memset(&sinfo, 0, sizeof(sinfo));
	
	std::string args = mExecutable;
	for(int i = 0; i < (int)mLaunchArguments.size(); i++)
	{
		args += " ";
		args += mLaunchArguments[i];
	}
	
	// So retarded.  Windows requires that the second parameter to CreateProcessA be a writable (non-const) string...
	char *args2 = new char[args.size() + 1];
	strcpy(args2, args.c_str());

	if( ! CreateProcessA( NULL, args2, NULL, NULL, FALSE, 0, NULL, NULL, &sinfo, &pinfo ) )
	{
		// TODO: do better than returning the OS-specific error code on failure...
		result = GetLastError();
		if(result == 0)
		{
			// Make absolutely certain we return a non-zero value on failure.
			result = -1;
		}
	}
	else
	{
		// foo = pinfo.dwProcessId; // get your pid here if you want to use it later on
		// CloseHandle(pinfo.hProcess); // stops leaks - nothing else
		mProcessHandle = pinfo.hProcess;
		CloseHandle(pinfo.hThread); // stops leaks - nothing else
	}		
	
	delete[] args2;
	
	return result;
}

char* rdp_rds_module_start(RDS_MODULE_COMMON* module)
{
	BOOL status;
	rdsModuleRdp* rdp;
	char lpCommandLine[256];
	const char* endpoint = "RDP";
	long xres, yres,colordepth;
	char* pipeName = (char*) malloc(256);

	rdp = (rdsModuleRdp*) module;

	rdp->SessionId = rdp->commonModule.sessionId;

	WLog_Print(rdp->log, WLOG_DEBUG, "RdsModuleStart: SessionId: %d Endpoint: %s",
			(int) rdp->commonModule.sessionId, endpoint);

	freerds_named_pipe_get_endpoint_name((int) rdp->commonModule.sessionId, endpoint, pipeName, 256);
	freerds_named_pipe_clean(pipeName);

	ZeroMemory(&(rdp->si), sizeof(STARTUPINFO));
	rdp->si.cb = sizeof(STARTUPINFO);
	ZeroMemory(&(rdp->pi), sizeof(PROCESS_INFORMATION));

	initResolutions(rdp->commonModule.baseConfigPath, &g_Config,
			&rdp->commonModule.envBlock, &xres, &yres, &colordepth);

	sprintf_s(lpCommandLine, sizeof(lpCommandLine), "%s /tmp/rds.rdp /size:%dx%d",
			"freerds-rdp", (int) xres, (int) yres);

	WLog_Print(rdp->log, WLOG_DEBUG, "Starting process with command line: %s", lpCommandLine);

	status = CreateProcessA(NULL, lpCommandLine,
			NULL, NULL, FALSE, 0, rdp->commonModule.envBlock, NULL,
			&(rdp->si), &(rdp->pi));

	WLog_Print(rdp->log, WLOG_DEBUG, "Process created with status: %d", status);

	if (!WaitNamedPipeA(pipeName, 5 * 1000))
	{
		fprintf(stderr, "WaitNamedPipe failure: %s\n", pipeName);
		return NULL;
	}

	return pipeName;
}

int cef_rds_module_start(rdsModule* module)
{
	BOOL status;
	rdsModuleCef* cef;
	rdpSettings* settings;
	rdsConnector* connector;
	char lpCommandLine[256];
	const char* endpoint = "CEF";

	cef = (rdsModuleCef*) module;
	connector = (rdsConnector*) module;

	WLog_Print(cef->log, WLOG_DEBUG, "RdsModuleStart: SessionId: %d Endpoint: %s",
			(int) module->SessionId, endpoint);

	settings = connector->settings;

	freerds_named_pipe_clean(module->SessionId, endpoint);

	ZeroMemory(&(cef->si), sizeof(STARTUPINFO));
	cef->si.cb = sizeof(STARTUPINFO);
	ZeroMemory(&(cef->pi), sizeof(PROCESS_INFORMATION));

	sprintf_s(lpCommandLine, sizeof(lpCommandLine), "%s /session-id:%d /width:%d /height:%d",
			"freerds-cef", (int) module->SessionId, settings->DesktopWidth, settings->DesktopHeight);

	WLog_Print(cef->log, WLOG_DEBUG, "Starting process with command line: %s", lpCommandLine);

	status = CreateProcessA(NULL, lpCommandLine,
			NULL, NULL, FALSE, 0, NULL, NULL,
			&(cef->si), &(cef->pi));

	WLog_Print(cef->log, WLOG_DEBUG, "Process created with status: %d", status);

	module->hClientPipe = freerds_named_pipe_connect(module->SessionId, "CEF", 5 * 1000);

	if (!module->hClientPipe)
	{
		WLog_Print(cef->log, WLOG_ERROR, "Failed to connect to service");
		return -1;
	}

	return 0;
}

void CWE272_Least_Privilege_Violation__w32_char_CreateProcess_15_bad()
{
    switch(6)
    {
    case 6:
    {
        STARTUPINFOA si;
        PROCESS_INFORMATION pi;
        /* FLAW: The commandLine parameter to CreateProcess() contains a space in it and does not
           surround the executable path with quotes.  A malicious executable could be run because
           of the way the function parses spaces. The process will attempt to run "Program.exe,"
           if it exists, instead of the intended "GoodApp.exe" */
        if( !CreateProcessA(NULL,
                            "C:\\Program Files\\GoodApp arg1 arg2",
                            NULL,
                            NULL,
                            FALSE,
                            0,
                            NULL,
                            NULL,
                            &si,
                            &pi))
        {
            printLine("CreateProcess failed");
            return;
        }
        else
        {
            printLine("CreateProcess successful");
        }
        /* Wait until child process exits. */
        WaitForSingleObject(pi.hProcess, INFINITE);
        /* Close process and thread handles.*/
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    break;
    default:
        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
        printLine("Benign, fixed string");
        break;
    }
}