PDA

View Full Version : strange results in Win10 from CreateProcess due to MajorVersion etc PE headers


Dex[_4_]
December 14th 14, 06:41 AM
My host system is Win7-x64 ... I have two small .exe's, a 32bit and a 64bit,
each only ~2kb in size, that do nothing other than call kernel32!ExitProcess
with a specific return code returned to signify successful execution.

I've been testing with various values of Major/MinorOperatingSystemVersion
and Major/MinorSubsystemVersion.

WINDOWS 7-x64 (everything behaving as expected)
-------------

When I run the 64bit version on my Win7-x64 host it successfully executes
(and gives correct return code) for _everything_ -- it seems Win7 ignores
these version settings in the PE header of 64bit executables ???

Anyway when I run the 32bit version on my Win7-x64 host I get "correct"
expected behavior from CreateProcess. That is, if it fails CreateProcess
will return 0, and if it succeeds CreateProcess will return non-zero, and I
will then receive the correct return code every time.


WINDOWS 10-x64 Tech Preview (running inside VMWare 11)
--------------

In regards to the 64bit version it behaves the same as described above on my
Win7-x64 system.

HOWEVER, the 32bit version behaves ... a little odd.

I'll list these as "A.B C.D" where A=MajorOperatingSystemVersion .
B=MinorOperatingSystemVersion C=MajorSubsystemVersion .
D=MinorSubsystemVersion

Note however that it doesn't really seem to matter what the
OperatingSystemVersion values are,
but look what happens when it comes upon "6.3" and "6.4" as SubsystemVersion
values ...

Trying 0.0 6.0 ...OK, CreateProcess=1, GetLastError=0, ReturnCode=Valid
Trying 0.0 6.1 ...OK, CreateProcess=1, GetLastError=0, ReturnCode=Valid
Trying 0.0 6.2 ...OK, CreateProcess=1, GetLastError=0, ReturnCode=Valid
Trying 0.0 6.3 ...FAIL, CreateProcess=1, GetLastError=0, ReturnCode=INVALID
(0xC000007B)
Trying 0.0 6.4 ...FAIL, CreateProcess=1, GetLastError=0, ReturnCode=INVALID
(0xC000007B)
Trying 0.0 6.5 ...FAIL, CreateProcess=0, GetLastError=0, ReturnCode=<none>
Trying 0.0 6.6 ...FAIL, CreateProcess=0, GetLastError=0, ReturnCode=<none>

.... !?!?!?!?!???????



--- news://freenews.netfront.net/ - complaints: ---

Dex[_5_]
December 14th 14, 09:22 AM
Sorry, I was wrong in regards to x64 possibly ignoring the version values.
Just to clarify, im actually getting the same results from the 64bit exe as
well as the 32bit exe...

ie. it doesnt matter what the Major/MinorOperatingSystemVersion is, but if
the Subsystem is 6.3 or 6.4, regardless of whether its 32 or 64bit, it
returns weirdly... (CreateProcess claims success, yet the return code is the
invalid return code you'd normally get when CreateProcess fails)



--- news://freenews.netfront.net/ - complaints: ---

Dex[_5_]
December 14th 14, 10:16 AM
Ive uploaded some sample 32 and 64bit exes with the appropriate PE header
values...

10kbs .zip:
https://www.sendspace.com/file/yhbuzp

All the executable does is return 69696969 as an ExitProcess return code.

Under Windows 10 i get the following results:

---


C:\>runproc c:\xtest\64\0.0.6.2.exe
CreateProcess = 1. GetExitCodeProcess=1, ReturnCode= 69696969/0x4277DC9

C:\>runproc c:\xtest\64\0.0.6.3.exe
CreateProcess = 1. GetExitCodeProcess=1, ReturnCode=-1073741701/0xC000007B

C:\>runproc c:\xtest\64\0.0.6.4.exe
CreateProcess = 1. GetExitCodeProcess=1, ReturnCode=-1073741701/0xC000007B

C:\>runproc c:\xtest\64\0.0.6.5.exe
CreateProcess = 0 (FAIL)
GetExitCodeProcess=0, ReturnCode= 0/0x0

C:\>runproc c:\xtest\64\0.0.6.6.exe
CreateProcess = 0 (FAIL)
GetExitCodeProcess=0, ReturnCode= 0/0x0



--- news://freenews.netfront.net/ - complaints: ---

Paul
December 14th 14, 08:38 PM
Dex wrote:
> Ive uploaded some sample 32 and 64bit exes with the appropriate PE header
> values...
>
> 10kbs .zip:
> https://www.sendspace.com/file/yhbuzp
>
> All the executable does is return 69696969 as an ExitProcess return code.
>
> Under Windows 10 i get the following results:
>
> ---
>
>
> C:\>runproc c:\xtest\64\0.0.6.2.exe
> CreateProcess = 1. GetExitCodeProcess=1, ReturnCode= 69696969/0x4277DC9
>
> C:\>runproc c:\xtest\64\0.0.6.3.exe
> CreateProcess = 1. GetExitCodeProcess=1, ReturnCode=-1073741701/0xC000007B
>
> C:\>runproc c:\xtest\64\0.0.6.4.exe
> CreateProcess = 1. GetExitCodeProcess=1, ReturnCode=-1073741701/0xC000007B
>
> C:\>runproc c:\xtest\64\0.0.6.5.exe
> CreateProcess = 0 (FAIL)
> GetExitCodeProcess=0, ReturnCode= 0/0x0
>
> C:\>runproc c:\xtest\64\0.0.6.6.exe
> CreateProcess = 0 (FAIL)
> GetExitCodeProcess=0, ReturnCode= 0/0x0

How about this site ? I've never used it, but someone
else mentioned it.

http://connect.microsoft.com/

Paul

Dex[_5_]
December 14th 14, 09:40 PM
Thanks for your..... oh, wait.



--- news://freenews.netfront.net/ - complaints: ---

Dex[_5_]
December 14th 14, 09:48 PM
btw, one of the reasons MS releases pre-production releases is to help find
such gremlins... but ok, I'll zip my lips and wait for the production
release, it'll be better to let customers face the issue first right ;)

Anyway Mr Morgan no need to get your pantyhose in a twist, this
issue/bug/whatever found me, I didn't go looking for it, so you can relax.



--- news://freenews.netfront.net/ - complaints: ---

Google