Module 1: Process Creation Internals

How Windows really creates processes — from file on disk to executing code in memory, through the lens of section objects.

1. The User-Mode View: CreateProcessW

When user-mode code calls CreateProcessW, it appears simple — pass an executable path and get a running process. But underneath, kernel32!CreateProcessW calls kernel32!CreateProcessInternalW, which orchestrates a complex sequence involving multiple NT-native system calls. The high-level user-mode API hides the real machinery:

// What most developers write:
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi = {};
CreateProcessW(
    L"C:\\Windows\\System32\\notepad.exe",
    NULL, NULL, NULL, FALSE,
    0, NULL, NULL, &si, &pi
);

// What actually happens inside the kernel involves:
// 1. NtOpenFile        - open the executable
// 2. NtCreateSection   - create an image section from it
// 3. NtCreateProcessEx - create the process from the section
// 4. NtCreateThreadEx  - create the initial thread
// Plus: PEB setup, process parameters, csrss notification...

Understanding this decomposition is the key to understanding every PE tampering technique, because each technique manipulates a different step in this chain.

2. Step 1: Opening the Executable File

The first internal step is opening the target executable. The kernel calls NtOpenFile (or NtCreateFile) to obtain a file handle to the PE image. This handle must have FILE_EXECUTE access rights because the file will be mapped as an executable image.

// Conceptual kernel-side file open:
HANDLE hFile;
IO_STATUS_BLOCK iosb;
OBJECT_ATTRIBUTES objAttr;
UNICODE_STRING filePath;

RtlInitUnicodeString(&filePath,
    L"\\??\\C:\\Windows\\System32\\notepad.exe");
InitializeObjectAttributes(&objAttr,
    &filePath, OBJ_CASE_INSENSITIVE, NULL, NULL);

NtOpenFile(
    &hFile,
    FILE_READ_DATA | FILE_EXECUTE | SYNCHRONIZE,
    &objAttr,
    &iosb,
    FILE_SHARE_READ,
    FILE_SYNCHRONOUS_IO_NONALERT
);

At this point, the kernel has a handle to the file on disk. The file is just data — PE headers, section data, relocations, imports. No code is executing yet.

3. Step 2: Creating the Image Section

The kernel next creates a section object from the file handle. A section object (also known as a memory-mapped file or file mapping) represents a region of memory that can be shared between processes. For executable images, the section type is SEC_IMAGE:

HANDLE hSection = NULL;

// Create an image section from the file handle
NTSTATUS status = NtCreateSection(
    &hSection,
    SECTION_ALL_ACCESS,
    NULL,              // no object attributes
    NULL,              // size determined by PE headers
    PAGE_READONLY,     // initial page protection
    SEC_IMAGE,         // IMAGE section - parsed as PE
    hFile              // backed by this file
);

When the kernel creates a SEC_IMAGE section, it performs PE validation, checks the machine type, parses the section table, and builds the CONTROL_AREA and SUBSECTION structures that describe how the image will be mapped into virtual memory. The resulting section object holds a reference to the underlying file object.

4. Step 3: NtCreateProcessEx

With a section handle in hand, the kernel creates the process object. NtCreateProcessEx is the native API that does this. Unlike NtCreateProcess (the older variant), NtCreateProcessEx takes a section handle directly:

HANDLE hProcess = NULL;

// Create a process from the image section
NTSTATUS status = NtCreateProcessEx(
    &hProcess,
    PROCESS_ALL_ACCESS,
    NULL,           // object attributes
    NtCurrentProcess(), // parent process
    0,              // flags
    hSection,       // THE IMAGE SECTION
    NULL,           // debug port
    NULL,           // exception port
    FALSE           // InJob
);

When NtCreateProcessEx executes, the kernel:

1. Allocates a new EPROCESS structure
2. Creates a new virtual address space
3. Maps the image section into the address space at the PE’s preferred base (or a relocated address)
4. Maps ntdll.dll into the process
5. Creates the PEB (Process Environment Block)
6. Sets the image base address and entry point in the PEB

At this point, the process exists but has no threads — it is not executing. It is an empty vessel with memory mapped from the section.

5. Step 4: Thread Creation and PEB Setup

Before the process can run, it needs process parameters (command line, environment variables, current directory) and an initial thread:

// 1. Create process parameters
PRTL_USER_PROCESS_PARAMETERS processParams = NULL;
RtlCreateProcessParametersEx(
    &processParams,
    &imagePathUS,      // NtImagePath
    NULL,              // DllPath
    NULL,              // CurrentDirectory
    &imagePathUS,      // CommandLine
    NULL,              // Environment
    NULL, NULL, NULL, NULL,
    RTL_USER_PROC_PARAMS_NORMALIZED
);

// 2. Write parameters into the target process's memory
// (VirtualAllocEx + WriteProcessMemory to copy params into target PEB)

// 3. Create the initial thread
HANDLE hThread = NULL;
NtCreateThreadEx(
    &hThread,
    THREAD_ALL_ACCESS,
    NULL,
    hProcess,
    (LPTHREAD_START_ROUTINE)entryPoint,  // PE entry point
    NULL,           // parameter
    FALSE,          // not suspended
    0, 0, 0,        // stack sizes
    NULL            // attribute list
);

Once NtCreateThreadEx is called, the thread starts executing at the PE entry point. The process is now live. The Windows loader (ntdll!LdrInitializeThunk) runs first, processing the import table, loading DLLs, and eventually transferring control to the application entry point.

6. The File-Backed Section Requirement

A fundamental Windows design principle is that every process image is backed by a file on disk via a section object. This creates a chain of trust:

Security tools rely on this chain. They expect to be able to trace from a running process back to its image file on disk and scan that file. NtQueryInformationProcess with ProcessImageFileName returns the path the kernel stored during section creation. If the file on disk matches what is in memory, the process is legitimate.

7. Kernel Structures Overview

8. Why This Matters for Ghosting

Process Ghosting exploits the fact that NtCreateProcessEx only needs a section handle. The technique manipulates the file state between creating the section and creating the process. Specifically: