CreateProcessAsUserW cannot be hooked under windows 10 or windows 11, but windows server 2019 work well

[elvis-sun]

My code as follows:

BOOL WINAPI HookedCreateProcessAsUserW(
HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation
) {
LOG_INFO(L"===sunlei22===CreateProcessAsUserW is called with application: %ls, commandline: %s, currentdirectory: %s, desktop: 
%s\n", lpApplicationName, lpCommandLine, lpCurrentDirectory, lpStartupInfo->lpDesktop);

return OriginalCreateProcessAsUserW(
    hToken, lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes,
    bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation
);}

bool ProcessAttach()
{
OriginalCreateProcessAsUserW = CreateProcessAsUserW;
OriginalCreateProcessW = CreateProcessW;

DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourSetIgnoreTooSmall(TRUE);

LONG ret = 1;
do
{
    ret = DetourAttach(&(PVOID&)OriginalCreateProcessAsUserW, HookedCreateProcessAsUserW);
    if (ret != 0)
    {
        LOG_ERROR(L"DetourAttach for CreateProcessAsUserW failed\n");
        break;
    }
    ret = DetourAttach(&(PVOID&)OriginalCreateProcessW, HookedCreateProcessW);
    if (ret != 0)
    {
        LOG_ERROR(L"DetourAttach for CreateProcessW failed\n");
        break;
    }
} while (false);

if (ret == 0)
{
    LOG_ERROR(L"DetourAttach Successfully\n");
}
else
{
    LOG_ERROR(L"DetourAttach failed\n");
}
PVOID* ppbFailedPointer = NULL;
LONG error = DetourTransactionCommitEx(&ppbFailedPointer);
if (error != 0)
{
    LOG_ERROR(L"DetourTransactionCommitEx failed, error %ld (%p/%p)\n", error, ppbFailedPointer, *ppbFailedPointer);
}
return ret;
}

CreateProcessW can be hooked, but CreateProcessAsUserW not work.

Has anyone encountered the same problem？
Look forward to your reply.

[RatinCN]

Check call stack, I guess you hook kernel32.dll!CreateProcessAsUserWStub (addressing by something like LoadLibrary("kernel32.dll")+GetProcAddress(..., "CreateProcessAsUserW")) but program ran into another stub like advapi32.dll!CreateProcessAsUserWStub, for example:

Program ran into advapi32.dll!CreateProcessAsUserWStub:

And detours hooked kernel32.dll!CreateProcessAsUserWStub:

If you are in this scenario, this is not bug. Addressing CreateProcessAsUserW from KernelBase.dll instead of kernel32.dll should be fine, because those stubs will be forwarded to KernelBase.dll!CreateProcessAsUserW:

I'm not MS offical member, I just maintain a fork KNSoft.SlimDetours and keep an eye on the upstream, so my answer is not offical too, but hope it helps.

Ratin Gao