00032 {
00033     
NTSTATUS st;
00034     STRING ImagePathName;
00035     UNICODE_STRING ConfigFilePathname;
00036     RTL_USER_PROCESS_INFORMATION ProcessInformation;
00037     PEB_SM_DATA PebSessionInformation;
00038     HANDLE FileHandle;
00039     ULONG FileIndexNumber;
00040     IO_STATUS_BLOCK IoStatus;
00041     OBJECT_ATTRIBUTES 
ObjectAttributes;
00042     FILE_INTERNAL_INFORMATION FileInformation;
00043     PPEB Peb;
00044 
00045     Peb = NtCurrentPeb();
00046     RtlZeroMemory(&PebSessionInformation,
sizeof(PebSessionInformation));
00047 
00048     
00049     
00050     
00051     
00052 
00053     
if ( !Peb->Sm.StandardInput.FileHandle ) {
00054 
00055         
RtlInitUnicodeString(&ConfigFilePathname,L
"\\SystemRoot\\nt.cfg");
00056 
00057         
00058         
00059         
00060 
00061         InitializeObjectAttributes(
00062             &ObjectAttributes,
00063             &ConfigFilePathname,
00064             OBJ_CASE_INSENSITIVE,
00065             NULL,
00066             NULL
00067             );
00068 
00069         st = 
NtOpenFile(
00070                 &FileHandle,
00071                 SYNCHRONIZE | FILE_READ_DATA,
00072                 &ObjectAttributes,
00073                 &IoStatus,
00074                 FILE_SHARE_READ,
00075                 0
00076                 );
00077 
00078         
if (!
NT_SUCCESS( st )) {
00079             
DbgPrint(
"NtOpenFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00080             
ASSERT(
NT_SUCCESS(st));
00081         }
00082 
00083         
00084         
00085         
00086 
00087         st = 
NtQueryInformationFile(
00088                 FileHandle,
00089                 &IoStatus,
00090                 (PVOID) &FileInformation,
00091                 
sizeof(FileInformation),
00092                 FileInternalInformation
00093                 );
00094 
00095         
if (!
NT_SUCCESS( st )) {
00096             
DbgPrint(
"NtQueryInformationFile: %wZ failed 0x%lx\n",&ConfigFilePathname,st);
00097             
ASSERT(
NT_SUCCESS(st));
00098         }
00099 
00100         PebSessionInformation.Length = 
sizeof(PebSessionInformation);
00101         PebSessionInformation.StandardInput.FileHandle = FileHandle;
00102         PebSessionInformation.StandardInput.Context = (PVOID) FileInformation.IndexNumber;
00103 
00104         
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00105 
00106         st = 
RtlCreateUserProcess(
00107                 &ImagePathName,
00108                 NULL,
00109                 NULL,
00110                 NULL,
00111                 FALSE,
00112                 NULL,
00113                 NULL,
00114                 NULL,
00115                 &ProcessInformation,
00116                 &PebSessionInformation
00117                 );
00118 
00119         
ASSERT(
NT_SUCCESS(st));
00120 
00121         
NtResumeThread(ProcessInformation.Thread,NULL);
00122         
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00123         
NtClose(ProcessInformation.Process);
00124         
NtClose(ProcessInformation.Thread);
00125         
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00126 
00127     } 
else {
00128 
00129         
if ( !Peb->Sm.StandardOutput.FileHandle ) {
00130 
00131             
00132             
00133             
00134 
00135             st = 
NtQueryInformationFile(
00136                     Peb->Sm.StandardInput.FileHandle,
00137                     &IoStatus,
00138                     (PVOID) &FileInformation,
00139                     
sizeof(FileInformation),
00140                     FileInternalInformation
00141                     );
00142 
00143             
if (!
NT_SUCCESS( st )) {
00144                 
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00145                 
ASSERT(
NT_SUCCESS(st));
00146             }
00147 
00148             
ASSERT(Peb->Sm.StandardInput.Context == (PVOID) FileInformation.IndexNumber);
00149 
00150             PebSessionInformation.Length = 
sizeof(PebSessionInformation);
00151             PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00152             PebSessionInformation.StandardOutput.FileHandle = Peb->Sm.StandardInput.FileHandle;
00153             PebSessionInformation.StandardOutput.Context = (PVOID) FileInformation.IndexNumber;
00154 
00155             
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00156 
00157             st = 
RtlCreateUserProcess(
00158                     &ImagePathName,
00159                     NULL,
00160                     NULL,
00161                     NULL,
00162                     FALSE,
00163                     NULL,
00164                     NULL,
00165                     NULL,
00166                     &ProcessInformation,
00167                     &PebSessionInformation
00168                     );
00169 
00170             
ASSERT(
NT_SUCCESS(st));
00171 
00172             
NtResumeThread(ProcessInformation.Thread,NULL);
00173             
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00174             
NtClose(ProcessInformation.Process);
00175             
NtClose(ProcessInformation.Thread);
00176             
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00177 
00178         } 
else {
00179 
00180             
ASSERT(Peb->Sm.StandardInput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_SUBSYS);
00181 
00182             
if ( !Peb->Sm.StandardError.FileHandle ) {
00183 
00184                 
00185                 
00186                 
00187 
00188                 st = 
NtQueryInformationFile(
00189                         Peb->Sm.StandardOutput.FileHandle,
00190                         &IoStatus,
00191                         (PVOID) &FileInformation,
00192                         
sizeof(FileInformation),
00193                         FileInternalInformation
00194                         );
00195 
00196                 
if (!
NT_SUCCESS( st )) {
00197                     
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00198                     
ASSERT(
NT_SUCCESS(st));
00199                 }
00200 
00201                 
ASSERT(Peb->Sm.StandardOutput.Context == (PVOID) FileInformation.IndexNumber);
00202 
00203                 PebSessionInformation.Length = 
sizeof(PebSessionInformation);
00204                 PebSessionInformation.StandardInput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_SUBSYS;
00205                 PebSessionInformation.StandardOutput.FileHandle = (HANDLE)PEB_STDIO_HANDLE_PM;
00206                 PebSessionInformation.StandardError.FileHandle = Peb->Sm.StandardOutput.FileHandle;
00207                 PebSessionInformation.StandardError.Context = (PVOID) FileInformation.IndexNumber;
00208 
00209                 
RtlInitString(&ImagePathName,
"\\A:\\uexec2.exe");
00210 
00211                 st = 
RtlCreateUserProcess(
00212                         &ImagePathName,
00213                         NULL,
00214                         NULL,
00215                         NULL,
00216                         FALSE,
00217                         NULL,
00218                         NULL,
00219                         NULL,
00220                         &ProcessInformation,
00221                         &PebSessionInformation
00222                         );
00223 
00224                 
ASSERT(
NT_SUCCESS(st));
00225 
00226                 
NtResumeThread(ProcessInformation.Thread,NULL);
00227                 
NtWaitForSingleObject(ProcessInformation.Process,FALSE,NULL);
00228                 
NtClose(ProcessInformation.Process);
00229                 
NtClose(ProcessInformation.Thread);
00230                 
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00231 
00232             } 
else {
00233 
00234                 
ASSERT(Peb->Sm.StandardOutput.FileHandle == (HANDLE)PEB_STDIO_HANDLE_PM);
00235 
00236                 
00237                 
00238                 
00239 
00240                 st = 
NtQueryInformationFile(
00241                         Peb->Sm.StandardError.FileHandle,
00242                         &IoStatus,
00243                         (PVOID) &FileInformation,
00244                         
sizeof(FileInformation),
00245                         FileInternalInformation
00246                         );
00247 
00248                 
if (!
NT_SUCCESS( st )) {
00249                     
DbgPrint(
"NtQueryInformationFile: failed 0x%lx\n",st);
00250                     
ASSERT(
NT_SUCCESS(st));
00251                 }
00252 
00253                 
ASSERT(Peb->Sm.StandardError.Context == (PVOID) FileInformation.IndexNumber);
00254                 
NtTerminateProcess(NtCurrentProcess(),STATUS_SUCCESS);
00255             }
00256         }
00257     }
00258 }