RTL_USER_PROCESS_PARAMETERS

The RTL_USER_PROCESS_PARAMETERS structure (formally _RTL_USER_PROCESS_PARAMETERS) is the low-level packaging of the numerous arguments and parameters that can be specified to such Win32 API functions as CreateProcess.

By the phrase “low-level packaging” I mean very deliberately that the structure is not specifically a packaging for the transition to and from kernel mode. Ask almost anyone in the last decade or more for a potted description of the RTL_USER_PROCESS_PARAMETERS, and you can expect to hear that these are parameters that are passed from user mode to kernel mode for handling the NtCreateUserProcess and ZwCreateUserProcess functions, and that the kernel creates a copy in the created process’s address space where it is then available in user mode through the created process’s PEB. This, however, is not the history. Even now, it is not the full story. The clue is in the name, specifically in the RTL prefix.

For the first decade and more of Windows history, the RTL_USER_PROCESS_PARAMETERS structure does not cross between user and kernel modes as anything other than an uninterpreted blob that the creating process copies into the created process’s address space. The structure exists only as input to the RtlCreateUserProcess function. This Run Time Library (RTL) function is exported by name from NTDLL in all Windows versions, right from the beginning with version 3.10. It also exists in all versions of the kernel, but only as an internal routine which the kernel uses for starting the first user-mode process (and which is in a section that the kernel discards soon afterwards).

Variability

Presumably because of its role as input to an API function, albeit an undocumented one, the RTL_USER_PROCESS_PARAMETERS structure is strikingly stable. Indeed, while the RtlCreateUserProcess function was the only means of creating a user-mode process, its input structure did not change at all. Since then, the structure’s only variability is that new members are appended:

Layout

These sizes, and the offsets, names and types of members in the table below, are from Microsoft’s public symbol files for the kernel starting with Windows 2000 SP3.

For versions that predate the availability of type information in symbol files, continuity with the known definition for later versions is confirmed by inspection of the implementations and uses of RtlCreateUserProcess. For a handful of these early versions, the continuity can be established more readily. For instance, the import libraries GDISRVL.LIB and SHELL32.LIB that Microsoft supplied with the Device Driver Kit (DDK) for Windows NT 3.51 and 4.0, respectively, have an early form of type information, including for RTL_USER_PROCESS_PARAMETERS.

ULONG MaximumLength;

ULONG Length;

ULONG Flags;

ULONG DebugFlags;

HANDLE ConsoleHandle;

ULONG ConsoleFlags;

HANDLE StandardInput;

HANDLE StandardOutput;

HANDLE StandardError;

CURDIR CurrentDirectory;

UNICODE_STRING DllPath;

UNICODE_STRING ImagePathName;

UNICODE_STRING CommandLine;

PVOID Environment;

ULONG StartingX;

ULONG StartingY;

ULONG CountX;

ULONG CountY;

ULONG CountCharsX;

ULONG CountCharsY;

ULONG FillAttribute;

ULONG WindowFlags;

ULONG ShowWindowFlags;

UNICODE_STRING WindowTitle;

UNICODE_STRING DesktopInfo;

UNICODE_STRING ShellInfo;

UNICODE_STRING RuntimeData;

RTL_DRIVE_LETTER_CURDIR CurrentDirectores [0x20];

ULONG_PTR volatile EnvironmentSize;

ULONG_PTR EnvironmentSize;

ULONG_PTR volatile EnvironmentVersion;

ULONG_PTR EnvironmentVersion;

PVOID PackageDependencyData;

ULONG ProcessGroupId;

ULONG LoaderThreads;

UNICODE_STRING RedirectionDllName;

UNICODE_STRING HeapPartitionName;

ULONGLONG *DefaultThreadpoolCpuSetMasks;

ULONG DefaultThreadpoolCpuSetMaskCount;

ULONG DefaultThreadpoolThreadMaximum;

The spelling of CurrentDirectores is Microsoft’s.