Skip to content

Instantly share code, notes, and snippets.

@livz
Last active August 29, 2017 15:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save livz/bfcdef45aae1e4a3e789097333e442d3 to your computer and use it in GitHub Desktop.
Save livz/bfcdef45aae1e4a3e789097333e442d3 to your computer and use it in GitHub Desktop.
CreateProcess from ADS
#include <windows.h>
#include <stdio.h>
#include <tchar.h>
/*
* Compile with:
* cl /nologo /EHsc ExeCreateProc.c
*
* Create ADS:
* > type Hello.exe > Layout.init:hello.exe (ADS for file)
*
* > type Hello.exe > ReadyBoot:hello.exe (ADS for folder)
*
*/
void _tmain( int argc, TCHAR *argv[] )
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );
// Start the child process.
if( !CreateProcess( NULL, // No module name (use command line)
"c:\\work\\Layout.ini:hello.exe", // Start exe from file ADS
//"c:\\work\\ReadyBoot:hello.exe", // Start exe from directory ADS
NULL, // Process handle not inheritable
NULL, // Thread handle not inheritable
FALSE, // Set handle inheritance to FALSE
0, // No creation flags
NULL, // Use parent's environment block
NULL, // Use parent's starting directory
&si, // Pointer to STARTUPINFO structure
&pi ) // Pointer to PROCESS_INFORMATION structure
)
{
printf( "CreateProcess failed (%d).\n", GetLastError() );
return;
}
// Wait until child process exits.
WaitForSingleObject( pi.hProcess, INFINITE );
// Close process and thread handles.
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment