Windows8でCreateProcess系の関数
1: 779b3848 @!"ntdll!RtlCreateProcessParametersEx" 2: 77985c74 @!"ntdll!NtCreateProcessEx" 3: 77985c88 @!"ntdll!NtCreateProcess" 4: 779a151c @!"ntdll!RtlpCreateProcessRegistryInfo" 3: 77985c88 @!"ntdll!ZwCreateProcess" 2: 77985c74 @!"ntdll!ZwCreateProcessEx" 5: 77a4d5e4 @!"ntdll!RtlCreateProcessReflection" 6: 77a4df27 @!"ntdll!RtlCreateProcessParameters" 40: 7509a1a3 @!"KERNELBASE!CreateProcessAsUserW" 49: 750765e3 @!"KERNELBASE!CreateProcessInternalW" 50: 75077ae8 @!"KERNELBASE!CreateProcessA" 51: 75074ba4 @!"KERNELBASE!CreateProcessW" 52: 7507791b @!"KERNELBASE!CreateProcessInternalA" 54: 75495855 @!"advapi32!SeclCreateProcessWithLogonW" 55: 754aa285 @!"advapi32!CreateProcessAsUserA" 56: 754953df @!"advapi32!CreateProcessWithTokenW" 57: 75495c2b @!"advapi32!CreateProcessWithLogonCommonW" 59: 754ab6b2 @!"advapi32!CreateProcessAsUserWStub" 60: 754b7869 @!"advapi32!CreateProcessWithLogonW" 62: 7549559a @!"advapi32!c_SeclCreateProcessWithLogonW" 63: 758558b2 @!"KERNEL32!CreateProcessWStub" 65: 758e67f4 @!"KERNEL32!CreateProcessInternalAStub" 67: 758e67e3 @!"KERNEL32!CreateProcessInternalWStub" 69: 75853165 @!"KERNEL32!CreateProcessAStub" 71: 758530f5 @!"KERNEL32!BasepReleaseSxsCreateProcessUtilityStruct" 72: 75900230 @!"KERNEL32!NtVdm64CreateProcessInternalW" 85: 758535cd @!"KERNEL32!CreateProcessAsUserWStub" 147: 7679b416 @!"SHELL32!CreateProcessWithImpersonation" 216: 764c9929 @!"SHELL32!SHCreateProcessAsUserW"
WinDbgでシンボル(*1)を当てて、「bm /a *!*CreateProcess*」でブレークポイントを張って、その中から必要そうなものだけ取り出した。bmはWINDBG AtoZ(*2)を参照。
他にももっとあるかな?
*1:http://msdn.microsoft.com/ja-jp/windows/hardware/gg463028.aspx
*2:https://docs.google.com/viewer?a=v&q=cache:kGY3m1Pk_ZMJ:www.windbg.info/download/doc/pdf/WinDbg_A_to_Z_mono_JP.pdf+&hl=ja&pid=bl&srcid=ADGEESiPk-90lrRRLyoJI-jQovTQvl_272QRbOvNNeZLTtMzRhYGXxbFh1GzhEzTcWhfCAB1wciwTiDnvzt3ZMiNYk6cwvO-6GN-NXqbYg21zLhjh-SOswshEzxip9fcvbgPk2QN1EGs&sig=AHIEtbRArxu1cpqCiS6kOn6UHDTOuITnvg