//---------------------------------------创建进程流程---------------------------------------------

call kernel32!CreateProcessA

 BOOL WINAPI CreateProcess(

 LPCTSTR lpApplicationName,

 LPTSTR lpCommandLine,

 LPSECURITY_ATTRIBUTES lpProcessAttributes,

 LPSECURITY_ATTRIBUTES lpThreadAttributes,

 BOOL bInheritHandles,

 DWORD dwCreationFlags,

 LPVOID lpEnvironment,

 LPCTSTR lpCurrentDirectory,

 LPSTARTUPINFO lpStartupInfo,

 LPPROCESS_INFORMATION lpProcessInformation)

{

/* 参数说明:第一个与最后一个为零，中间10个延接了上面传入的10个参数

   主要目的:是将ANSI字符转换成Unicode字符*/

 call kernel32!CreateProcessInternalA(...)

 {

  {

   call kernel32!CreateProcessInternalW(...)

   {

    call ntdll!ZwQueryInformationJobObject(HANDLE JobHandle

     JOBOBJECTINFOCLASS JobInformationClass

     PVOID JobInformation

     ULONG JobInformationLength

     PULONG ReturnLengthOPTIONAL);

    判断返回值是否为C0000022h (拒绝访问）

    call kernel32!SearchPathW(...); //进行路径搜索

    call kernel32!GetFileAttributesW(...);//获取文件属性

    call kernel32!BasepIsSetupInvokedByWinLogon(...);//判断是否WinLogon进程

    call ntdll!RtlDosPathNameToNtPathName_U(....);

    call ntdll!RtlIInitUnicodeString();

    call ntdll!RtlDetermineDosPathNameType_U(.); //路径转换

    call ntdll!NtOpenFile(); //打开文件

    //创建Section CreateFileMapping是对NtCreateSection的封装

    call ntdll!NtCreateSection(

     PHANDLE SectionHandle,

     ACCESS_MASK DesiredAccess,

     POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,

     PLARGE_INTEGER MaximumSize OPTIONAL,

     ULONG Protect,

     ULONG Attributes,

     HANDLE FileHandle OPTIONAL);  //程序被映射进了内存

    {

     call kernel32!BasepCheckWinSaferRestrictions

     {

      RtlEnterCriticalSection(...);

      NtOpenThreadToken();//判断返值是否等于0C000007Ch（试图引用不存在的令牌）否跳走

      NtOpenProcessToken();//判断返回值是否为0C0000022h（拒绝访问）

     }

    }

    call ntdll.NtQuerySection(...);

    call kernel32!LdrQueryImageFileExecutionOptions //获取调试信息，映像劫持

     LdrQueryImageFileExecutionOptions ( IN PUNICODE_STRING SubKey, == "\??\E:\AAAAA.exe"进程名

     PCWSTR ValueName, == "Debugger"

     ULONG Type,

     PVOID Buffer,

     ULONG BufferSize,

     PULONG ReturnedLength OPTIONAL)

    call kernel32!BasepIsImageVersionOk

    LoadLibraryA(advapi32.dll);

    GetProcAddress("CreateProcessAsUserSecure");

    call kernel32!BasepCheckBadapp();//对进程行行兼容性检查

    call kernel32!BasepIsImageVersionOk

    call kernel32!FreeLibrary "advapi32.dll"

    call kernel32!BaseFormatObjectAttributes

    call ntdll!ZwCreateProcessEx

    mov eax,30h

    call ntdll!KiFastSystemCall

    call ntdll!ZwSetInformationProcess

    NtSetInformationProcess ( ProcessHandle, == ZwCreateProcessEx时得到的进程句柄

     PROCESSINFOCLASS ProcessInformationClass, == 12h == ProcessDefaultHardErrorMode

     PVOID ProcessInformation, == 2 == SEM_NOGPFAULTERRORBOX

     ULONG ProcessInformationLength == 2)

    

    NtSetInformationProcess(...)

    call kernel32!BasepSxsCreateProcessCsrMessage

    {

     BasepSxsGetProcessImageBaseAddress KERNEL32

     RtlMultiAppendUnicodeStringBuffer NTDLL

     BasepSxsCreateStreams KERNEL32

     BasepSxsIsStatusFileNotFoundEtc

     BasepSxsIsStatusResourceNotFound

    }

    call ntdll!NtQueryInformationProcess(

     HANDLE ProcessHandle, == 进程句柄

     PROCESSINFOCLASS ProcessInformationClass, == 0 == ProcessBasicInformation

     PVOID ProcessInformation,

     ULONG ProcessInformationLength,

     PULONG ReturnLength OPTIONAL);

    call kernel32!BasePushProcessParameters

    {

     __SEH_prolog

     GetFullPathNameW KERNEL32

     BaseComputeProcessDllPath KERNEL32

     RtlInitUnicodeString

     RtlCreateProcessParameters NTDLL

     NtAllocateVirtualMemory

     NtWriteVirtualMemory

     __security_check_cookie

     __SEH_epilog

    }

    call kernel32!BaseCreateStack

    {

     NTDLL.RtlImageNtHeader

     NtAllocateVirtualMemory

     NtProtectVirtualMemory

    }

    call kernel32!BaseInitializeContext

    {

     BaseInitializeContext

      (PCONTEXT Context, // 0x200 bytes

       PPEB Peb,

       PVOID EntryPoint,

       DWORD StackTop,

       int Type );

    }

    call kernel32!BaseFormatObjectAttributes

    call ntdll!ZwCreateThread

    mov eax,35h

    call ntdll!KiFastSystemCall

    call kernel32!GetModuleHandleA "NULL"

    eax == 0400000h ;程序装入地址

    call ntdll!RtlImageNtHeader eax //验证NTHeader

    //下面是通知Cress.exe的几个函数

    call ntdll!CsrCaptureMessageMultiUnicodeStringsInPlace

    call ntdll!CsrClientCallServer

    call ntdll!CsrFreeCaptureBuffer

    call ntdll!ZwResumeThread ;启动线程移交控制权并返回

    ret //进程创建过程结束

   }

  } 

 }

}