Create a process from a driver

Question

Is there a way to create a user-mode process from kernel-mode on Windows NT platform (XP-W7)?

EDIT: I must install only the driver. This is a specific of the project.

Answer 1

I don't know an easier way to achieve this. But what about having a Windows service running which makes an overlapped DeviceIoControl into your driver? On return the service could examine the data it has received from the driver and start the according application.

Answer 2

To create a valid win32 process the driver must communicate with CSRSS (what is completely undocumented). So I ended up by queuing a user-mode APC and allocating virtual memory for the APC code in the context of the existing win32 process (that code will call CreateProcess and do the job).

It is a tricky way but it works.

Answer 3

This can't be directly done - Creating a win32 process requires some set up by the user mode part of CreateProcess, not just creating the process object in kernel mode.

You need some user mode code here - either a service, a desktop app, or so on, to launch the your user mode application.