microsoft / microsoft/Detours

DetourCreateProcessWithDll(),DetourCreateProcessWithDlls(),DetourCreateProcessWithDllEx() bug or something else.

Open
#333 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
C++
Stars
6.4k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Test Environment: Windows 10 Enterprise LTSC 2015,Windows 10 Enterprise LTSC 20121 and Windows Server 2019
detour Vertion : Latest
UAC: Enable
Logon : Administrators group user(Not RID 500 account)
Test : Using DetourCreateProcessWithDll() ,DetourCreateProcessWithDlls() or DetourCreateProcessWithDllEx() to create a console loader program(just like the sample of withdll.exe) to run notepad.exe and inject my test dll into notepad.exe.

  1. Right click on cmd.exe and select 'Run As Administrator",Click "Yes" on consent windows.
    Result(Success): loader's output suggests DetourCreateProcessWithDll success and test dll is loaded into notepad.exe(check by process hacker and tasklist)

  2. Run task manager either by select 'Run As Administrator" or by right click on taskbar and run task manager)
    Run cmd.exe under task manager by "Run New Task" and check "Create this task with administrative privileges"
    Result(Failure): loader's output suggest DetourCreateProcessWithDll success but test dll won't load into notepad.exe(check by process hacker and tasklist)

3.Run task manager either by select 'Run As Administrator" or by right click on taskbar and run task manager)
Run cmd.exe under task manager And un-check "Create this task with administrative privileges"
Result(Success): loader's output suggest DetourCreateProcessWithDll success and test dll is loaded into notepad.exe(check by process hacker and tasklist)

I have no idea why Test 2 fails. cmd.exe privileges in Test 2 is idential as Test 1(compares with whoami.exe and process hacker),even Test 3 in non elevated privilege,it succeed

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported DetourCreateProcessWithDll(), DetourCreateProcessWithDlls(), and DetourCreateProcessWithDllEx() paths and reproduce the three cmd.exe/Task Manager launch scenarios on the listed Windows versions. Compare the resulting process and token contexts, then determine whether Test 2 is an implementation bug or expected behavior and document a reproducible diagnosis or scoped fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.