Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Upcoming OSR Seminars:

Writing WDF Drivers I: Core Concepts, Nashua, NH 15-19 May, 2017
Writing WDF Drivers II: Advanced Implementation Tech., Nashua, NH 23-26 May, 2017
Kernel Debugging and Crash Analysis, Dulles, VA 26-30 June, 2017
Windows Internals & Software Driver Development, Nashua, NH 24-28 July, 2017


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 27  
05 Apr 17 23:04
Albert
xxxxxx@gmail.com
Join Date: 08 Aug 2005
Posts To This List: 320
Does Process have a GUI?

Hello veterans, Is there a way for a kernel driver to find out whether a process/thread has a Windows/GUI? I know it is possible in user mode, but just wanted to see if the same is possible in the kernel a well? thanks Pinto --
  Message 2 of 27  
05 Apr 17 23:13
Doron Holan
xxxxxx@microsoft.com
Join Date: 08 Sep 2005
Posts To This List: 10031
Does Process have a GUI?

What bigger problem are you trying to solve? Bent from my phone ________________________________ From: xxxxx@lists.osr.com <xxxxx@lists.osr.com> on behalf of A P <xxxxx@gmail.com> Sent: Wednesday, April 5, 2017 8:04:17 PM To: Windows System Software Devs Interest List Subject: [ntdev] Does Process have a GUI? Hello veterans, Is there a way for a kernel driver to find out whether a process/thread has a Windows/GUI? I know it is possible in user mode, but just wanted to see if the same is possible in the kernel a well? thanks Pinto --- NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at --
  Message 3 of 27  
06 Apr 17 01:02
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11487
Does Process have a GUI?

On Apr 5, 2017, at 8:04 PM, A P <xxxxx@gmail.com> wrote: > > Hello veterans, > > Is there a way for a kernel driver to find out whether a process/thread has a Windows/GUI? I know it is possible in user mode, but just wanted to see if the same is possible in the kernel a well? As a general rule, "user interface" is a user-mode concept. Almost anything to do with user interfaces is very difficult to access from kernel mode. — Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 4 of 27  
06 Apr 17 01:44
prabhakar vinayagam
xxxxxx@gmail.com
Join Date: 29 Jan 2016
Posts To This List: 75
Does Process have a GUI?

*GUI*: if you want to show the thread running you can create a event and share to the driver , create a thread running in the user mode , kernel will get an handle through ioctl , create a thread in kernel mode will run upon the user level. Event notification from driver to user. User runnning for kernel level. On Thu, Apr 6, 2017 at 10:31 AM, Tim Roberts <xxxxx@probo.com> wrote: > On Apr 5, 2017, at 8:04 PM, A P <xxxxx@gmail.com> wrote: > > > > Hello veterans, > > > > Is there a way for a kernel driver to find out whether a process/thread > has a Windows/GUI? I know it is possible in user mode, but just wanted to > see if the same is possible in the kernel a well? > > As a general rule, "user interface" is a user-mode concept. Almost > anything to do with user interfaces is very difficult to access from kernel <...excess quoted lines suppressed...> --
  Message 5 of 27  
06 Apr 17 03:58
Albert
xxxxxx@gmail.com
Join Date: 08 Aug 2005
Posts To This List: 320
Does Process have a GUI?

well tim, i would think there is some conenction to the kernel, since it is possible to send messaes from one process's window to the other, which means the kernel has some knowledge, else that would never work...swouldnt it? On Wed, Apr 5, 2017 at 10:01 PM, Tim Roberts <xxxxx@probo.com> wrote: > On Apr 5, 2017, at 8:04 PM, A P <xxxxx@gmail.com> wrote: > > > > Hello veterans, > > > > Is there a way for a kernel driver to find out whether a process/thread > has a Windows/GUI? I know it is possible in user mode, but just wanted to > see if the same is possible in the kernel a well? > > As a general rule, "user interface" is a user-mode concept. Almost > anything to do with user interfaces is very difficult to access from kernel <...excess quoted lines suppressed...> --
  Message 6 of 27  
06 Apr 17 10:09
Doron Holan
xxxxxx@microsoft.com
Join Date: 08 Sep 2005
Posts To This List: 10031
Does Process have a GUI?

The kernel has no idea about hwnds or windows messages. That is handled by gdi with the help of win32k.sys Bent from my phone ________________________________ From: xxxxx@lists.osr.com <xxxxx@lists.osr.com> on behalf of A P <xxxxx@gmail.com> Sent: Thursday, April 6, 2017 12:57:49 AM To: Windows System Software Devs Interest List Subject: Re: [ntdev] Does Process have a GUI? well tim, i would think there is some conenction to the kernel, since it is possible to send messaes from one process's window to the other, which means the kernel has some knowledge, else that would never work...swouldnt it? On Wed, Apr 5, 2017 at 10:01 PM, Tim Roberts <xxxxx@probo.com<mailto:xxxxx@probo.com>> wrote: On Apr 5, 2017, at 8:04 PM, A P <xxxxx@gmail.com<mailto:xxxxx@gmail.com>> wrote: > > Hello veterans, > > Is there a way for a kernel driver to find out whether a process/thread has a Windows/GUI? I know it is possible in user mode, but just wanted to see if the same is possible in the kernel a well? As a general rule, "user interface" is a user-mode concept. Almost anything to do with user interfaces is very difficult to access from kernel mode. ? Tim Roberts, xxxxx@probo.com<mailto:xxxxx@probo.com> Providenza & Boekelheide, Inc. --- NTDEV is sponsored by OSR Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev<https://na01.safelinks.protect ion.outlook.com/?url=http%3A%2F%2Fwww.osronline.com%2Fshowlists.cfm%3Flist%3Dntde v&data=02%7C01%7CDoron.Holan%40microsoft.com%7C5b391794e62142610abf08d47cc2aacf%7 C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636270622909190160&sdata=OzNHnIb42W4P PMVemRR5eKC3arp%2FHviALgYKBIadwjM%3D&reserved=0>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars<https://na01.safelinks.protection.outlook.com/?url=h ttp%3A%2F%2Fwww.osr.com%2Fseminars&data=02%7C01%7CDoron.Holan%40microsoft.com%7C5 b391794e62142610abf08d47cc2aacf%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6362 70622909190160&sdata=4ZoP8DhYgVSov30LXzqwhH%2Bg6iGpqydsMGVf0ijBsvo%3D&reserved=0> > To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer<https://na01.safelinks.protect ion.outlook.com/?url=http%3A%2F%2Fwww.osronline.com%2Fpage.cfm%3Fname%3DListServe r&data=02%7C01%7CDoron.Holan%40microsoft.com%7C5b391794e62142610abf08d47cc2aacf%7 C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636270622909190160&sdata=lSvjUimejeLa eiVKk%2BAPybD%2F%2FPv4P0Eke9PEqY88yIw%3D&reserved=0>> --- NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at --
  Message 7 of 27  
06 Apr 17 12:01
D. T.
xxxxxx@gmail.com
Join Date: 01 Apr 2017
Posts To This List: 180
Does Process have a GUI?

This is not documented. There is a bitfield in the _KTHREAD structure called ThreadFlags. One of these bits is named GuiThread. Just run the command ????dt nt??!_KTHREAD???? in a debugger and you will see. --
  Message 8 of 27  
06 Apr 17 12:24
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11487
Does Process have a GUI?

A P wrote: > > i would think there is some conenction to the kernel, since it is > possible to send messaes from one process's window to the other, which > means the kernel has some knowledge, else that would never > work...swouldnt it? Of course it would. There are many ways to do interprocess communication without involving the kernel. DLL with a shared section. Shared memory-mapped file and events. Even if the kernel provides the IPC plumbing, it doesn't need to know what the content is. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 9 of 27  
06 Apr 17 16:23
D. T.
xxxxxx@gmail.com
Join Date: 01 Apr 2017
Posts To This List: 180
Does Process have a GUI?

GUI capabilities are thread specific and not process specific. Although a process could be called a GUI process if one of its threads is a GUI thread. For instance the Notepad process here has a GUI thread and two non-GUI threads. kd> !process PROCESS ffffdf0b23d64800 SessionId: 1 Cid: 113c Peb: e1de36a000 ParentCid: 052c DirBase: 5dd0e000 ObjectTable: ffff9500433a9bc0 HandleCount: <Data Not Accessible> Image: notepad.exe .. THREAD ffffdf0b23d5a800 Cid 113c.0f90 Teb: 000000e1de36b000 Win32Thread: ffffdf0b2531f240 WAIT: (WrUserRequest) UserMode Non-Alertable ffffdf0b261cd230 SynchronizationEvent THREAD ffffdf0b261b7800 Cid 113c.13b0 Teb: 000000e1de36f000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable ffffdf0b23d85300 QueueObject THREAD ffffdf0b23d66080 Cid 113c.0f40 Teb: 000000e1de371000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable ffffdf0b23d85300 QueueObject kd> dt nt!_KTHREAD GuiThread ffffdf0b23d5a800 +0x078 GuiThread : 0y1 kd> dt nt!_KTHREAD GuiThread ffffdf0b261b7800 +0x078 GuiThread : 0y0 kd> dt nt!_KTHREAD GuiThread ffffdf0b23d66080 +0x078 GuiThread : 0y0
  Message 10 of 27  
07 Apr 17 17:07
Pavel A
xxxxxx@fastmail.fm
Join Date: 21 Jul 2008
Posts To This List: 2377
Does Process have a GUI?

> For instance the Notepad process here has a GUI thread and two non-GUI threads. This GuiThread flag most probably indicates that the thread has a Win32 message queue. Any thread automatically gets a message queue once it calls any related API. Then it becomes a "GUI thread". If this is all Mr. Pinto wants to know, this _KTHREAD field looks like a solution. -- pa
  Message 11 of 27  
08 Apr 17 20:05
Awbadhho
xxxxxx@gmail.com
Join Date: 20 May 2011
Posts To This List: 74
Does Process have a GUI?

The GuiThread solution discussed above is undocumented. If we are discussing undocumented solution then perhaps calling the undocumented NtUserBuildHwndList in the Kernel should also be discussed. This is what the user mode API EnumWindows calls internally, and is perhaps a bit more stanble thatn looking into windows structures and offsets? Those are prone to change and cause additional maintenence headche from windows version to version and service pack to service pack On Fri, Apr 7, 2017 at 2:07 PM, <xxxxx@fastmail.fm> wrote: > > For instance the Notepad process here has a GUI thread and two non-GUI > threads. > > This GuiThread flag most probably indicates that the thread has a Win32 > message queue. Any thread automatically gets a message queue once it calls > any related API. Then it becomes a "GUI thread". If this is all Mr. Pinto > wants to know, this _KTHREAD field looks like a solution. > > -- pa > <...excess quoted lines suppressed...> --
  Message 12 of 27  
08 Apr 17 21:45
D. T.
xxxxxx@gmail.com
Join Date: 01 Apr 2017
Posts To This List: 180
Does Process have a GUI?

I???ve noticed that when a non-GUI thread loads USER32.DLL, the thread is GUI after the DllMain has returned. When the Notepad is initialized, the main thread becomes a GUI thread when the DLL initialization routine of USER32.DLL has run and before WinMain has started. So, I think that if an executable is linked with USER32.DLL, there is a great chance that the main thread will be a GUI thread. --
  Message 13 of 27  
08 Apr 17 23:35
Awbadhho
xxxxxx@gmail.com
Join Date: 20 May 2011
Posts To This List: 74
Does Process have a GUI?

thats interesting, just curious, have u tried with other graphics libs, like SDL? On Sat, Apr 8, 2017 at 6:45 PM, <xxxxx@gmail.com> wrote: > I???ve noticed that when a non-GUI thread loads USER32.DLL, the thread is > GUI after the DllMain has returned. > > > > When the Notepad is initialized, the main thread becomes a GUI thread when > the DLL initialization routine of USER32.DLL has run and before WinMain has > started. > > <...excess quoted lines suppressed...> --
  Message 14 of 27  
09 Apr 17 16:27
D. T.
xxxxxx@gmail.com
Join Date: 01 Apr 2017
Posts To This List: 180
Does Process have a GUI?

No but D3D11.DLL(DirectX) is linked to WIN32U.DLL just like USER32.DLL. WIN32U.DLL is where some (at least) WIN32K.SYS system calls are exported. The IsGUIThread API converts a non-GUI thread to a GUI thread with a WIN32K.SYS system call. Le 9 avr. 2017 05:35, "Ami Awbadhho" <xxxxx@gmail.com> a ??crit : > thats interesting, just curious, have u tried with other graphics libs, > like SDL? > > On Sat, Apr 8, 2017 at 6:45 PM, <xxxxx@gmail.com> wrote: > >> I???ve noticed that when a non-GUI thread loads USER32.DLL, the thread is >> GUI after the DllMain has returned. >> >> >> <...excess quoted lines suppressed...> --
  Message 15 of 27  
09 Apr 17 22:06
R0b0t1
xxxxxx@gmail.com
Join Date: 24 Mar 2017
Posts To This List: 35
Does Process have a GUI?

On Wed, Apr 5, 2017 at 10:04 PM, A P <xxxxx@gmail.com> wrote: > Hello veterans, > > Is there a way for a kernel driver to find out whether a process/thread has > a Windows/GUI? I know it is possible in user mode, but just wanted to see if > the same is possible in the kernel a well? > > thanks > Pinto Hello, If you read about Window's user session compartmentalization you will find a part where it is documented that some major drivers and services did have graphical interfaces, but this has since been explicitly deprecated and may not have been intentional behavior in the first place. Based on the replies so far you may be able to directly manipulate the Window queue but that might turn into "puppeting" a user mode process instead of actually having a GUI attached to your driver. Cheers, R0b0t1
  Message 16 of 27  
18 Apr 17 23:17
Albert
xxxxxx@gmail.com
Join Date: 08 Aug 2005
Posts To This List: 320
Does Process have a GUI?

thanks everyone for the pointers. looks like there is no way to do this in the kernel in a documented fashion. we have a user mode service running in session 0 (not the user session), the actual win32 APIs EnumThreadWindows etc fail there as well if we try to fetch the windo list for preocesses running in the user session. Is there a way out here? On Sun, Apr 9, 2017 at 7:06 PM, R0b0t1 <xxxxx@gmail.com> wrote: > On Wed, Apr 5, 2017 at 10:04 PM, A P <xxxxx@gmail.com> wrote: > > Hello veterans, > > > > Is there a way for a kernel driver to find out whether a process/thread > has > > a Windows/GUI? I know it is possible in user mode, but just wanted to > see if > > the same is possible in the kernel a well? > > > > thanks <...excess quoted lines suppressed...> --
  Message 17 of 27  
19 Apr 17 12:53
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11487
Does Process have a GUI?

A P wrote: > > we have a user mode service running in session 0 (not the user > session), the actual win32 APIs EnumThreadWindows etc fail there as > well if we try to fetch the windo list for preocesses running in the > user session. Is there a way out here? If you want to interact with the UI session, you will need to be part of the UI session. The purpose of sessions is to keep these things separated. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 18 of 27  
19 Apr 17 15:10
M M
xxxxxx@hotmail.com
Join Date: 21 Oct 2010
Posts To This List: 731
Does Process have a GUI?

Read about the windows station APIs. Assuming that your service is session aware, and you have the necessary permissions, you can probably do what you need. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: Tim Roberts<mailto:xxxxx@probo.com> Sent: April 19, 2017 12:52 PM To: Windows System Software Devs Interest List<mailto:xxxxx@lists.osr.com> Subject: Re: [ntdev] Does Process have a GUI? A P wrote: > > we have a user mode service running in session 0 (not the user > session), the actual win32 APIs EnumThreadWindows etc fail there as > well if we try to fetch the windo list for preocesses running in the > user session. Is there a way out here? If you want to interact with the UI session, you will need to be part of the UI session. The purpose of sessions is to keep these things separated. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc. --- NTDEV is sponsored by OSR Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer> --
  Message 19 of 27  
19 Apr 17 16:50
R0b0t1
xxxxxx@gmail.com
Join Date: 24 Mar 2017
Posts To This List: 35
Does Process have a GUI?

Essentially if you are running a service to communicate with your driver then you will need to create a process which communicates with the service. The alternative is to eschew the service and only run the GUI application. I admit this seems slightly circuitous, but this is by far the best way to compartmentalize driver interaction. Major software projects (such as X11) implement this pattern and it behaves quite well. For an independent developer it can be a bit of a burden, though. On Tue, Apr 18, 2017 at 10:15 PM, A P <xxxxx@gmail.com> wrote: > thanks everyone for the pointers. looks like there is no way to do this in > the kernel in a documented fashion. > > we have a user mode service running in session 0 (not the user session), the > actual win32 APIs EnumThreadWindows etc fail there as well if we try to > fetch the windo list for preocesses running in the user session. Is there a > way out here? > > On Sun, Apr 9, 2017 at 7:06 PM, R0b0t1 <xxxxx@gmail.com> wrote: >> <...excess quoted lines suppressed...>
  Message 20 of 27  
20 Apr 17 02:08
Johnny Shaw
xxxxxx@live.com
Join Date: 11 Apr 2017
Posts To This List: 15
Does Process have a GUI?

I'm kind of perplexed why EnumThreadWindows isn't working for you. Maybe the token needs modified? Though usually Microsoft is good about documenting that. Maybe try EnumWindows and GetWindowThreadProcessId. Then EnumChildWindows and walk the chain from there. Not the most direct method but worth a shot maybe.
  Message 21 of 27  
20 Apr 17 14:58
Albert
xxxxxx@gmail.com
Join Date: 08 Aug 2005
Posts To This List: 320
Does Process have a GUI?

@Johnny With EnumThreadWindows I tried impersonating the process before passing the threads to EnumThreadWindows. here is the impersonation code below: // First open the process handle with query info rights. It is needed to open a token. HANDLE oProcHandle; oProcHandle = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessID); if (oProcHandle == NULL) { DoTraceError("OpenProcess failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } // Open the process token with query and duplicate rights. They are needed for impersonation. HANDLE oTokenHandle; if (FALSE == OpenProcessToken(oProcHandle, TOKEN_QUERY | TOKEN_DUPLICATE, &oTokenHandle)) { DoTraceError("OpenProcessToken failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } // Impersonate the process token if (FALSE == ImpersonateLoggedOnUser(oTokenHandle)) { DoTraceError("ImpersonateLoggedOnUser failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } I do not impersonate each thread (is that needed?) After this code executes I call EnumWindows with the actual thread of this process, assuming that my calling thread now has the same privilege as that of the process being queried. For EnumWindows and GetWindowThreadProcessId, the enumeration only returns processes in the same session (session 0) I dont see any calls to the EnumProc fucntion for any other process. On Wed, Apr 19, 2017 at 11:05 PM, <xxxxx@live.com> wrote: > I'm kind of perplexed why EnumThreadWindows isn't working for you. Maybe > the token needs modified? Though usually Microsoft is good about > documenting that. Maybe try EnumWindows and GetWindowThreadProcessId. Then > EnumChildWindows and walk the chain from there. Not the most direct method > but worth a shot maybe. > > > --- > NTDEV is sponsored by OSR > <...excess quoted lines suppressed...> --
  Message 22 of 27  
20 Apr 17 16:40
D. T.
xxxxxx@gmail.com
Join Date: 01 Apr 2017
Posts To This List: 180
Does Process have a GUI?

Why don't you launch a process in the user session (with the registry) and then setup an IPC channel between the two sessions ?
  Message 23 of 27  
20 Apr 17 16:55
Albert
xxxxxx@gmail.com
Join Date: 08 Aug 2005
Posts To This List: 320
Does Process have a GUI?

oh yeah, that is a solution we have, I was merely answering @Johnny's question to see if we did something specifically wrong. For the sake of a future reader searching for a similar issue, this blog post migth be very helpful: https://brianbondy.com/blog/100/understanding-windows-at-a-deeper-level-sessions- window-stations-and-desktops On Thu, Apr 20, 2017 at 1:38 PM, <xxxxx@gmail.com> wrote: > Why don't you launch a process in the user session (with the registry) and > then setup an IPC channel between the two sessions ? > > --- > NTDEV is sponsored by OSR > > Visit the list online at: <http://www.osronline.com/ > showlists.cfm?list=ntdev> > > MONTHLY seminars on crash dump analysis, WDF, Windows internals and <...excess quoted lines suppressed...> --
  Message 24 of 27  
20 Apr 17 17:36
R0b0t1
xxxxxx@gmail.com
Join Date: 24 Mar 2017
Posts To This List: 35
Does Process have a GUI?

On Thu, Apr 20, 2017 at 1:56 PM, A P <xxxxx@gmail.com> wrote: > @Johnny > > With EnumThreadWindows I tried impersonating the process before passing t= he > threads to EnumThreadWindows. here is the impersonation code below: > > // First open the process handle with query info rights. It is neede= d > to open a token. > HANDLE oProcHandle; > oProcHandle =3D OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, > dwProcessID); > if (oProcHandle =3D=3D NULL) > { > DoTraceError("OpenProcess failed. Last Error =3D %!WINERROR!", > GetLastError()); > return HRESULT_FROM_WIN32(GetLastError()); > } <...excess quoted lines suppressed...> !", > GetLastError()); > return HRESULT_FROM_WIN32(GetLastError()); > } > > // Impersonate the process token > if (FALSE =3D=3D ImpersonateLoggedOnUser(oTokenHandle)) > { > DoTraceError("ImpersonateLoggedOnUser failed. Last Error =3D > %!WINERROR!", GetLastError()); > return HRESULT_FROM_WIN32(GetLastError()); s > process, assuming that my calling thread now has the same privilege as th= at > of the process being queried. > > For EnumWindows and GetWindowThreadProcessId, the enumeration only return= s > processes in the same session (session 0) I dont see any calls to the > EnumProc fucntion for any other process. > > > On Wed, Apr 19, 2017 at 11:05 PM, <xxxxx@live.com> wrote: >> >> I'm kind of perplexed why EnumThreadWindows isn't working for you. Maybe >> the token needs modified? Though usually Microsoft is good about documen= ting >> that. Maybe try EnumWindows and GetWindowThreadProcessId. Then >> EnumChildWindows and walk the chain from there. Not the most direct meth= od >> but worth a shot maybe. >> >> As best I know the window enumeration isn't working because sessions and stations are isolated in the kernel. They are incapable of communicating without kernel involvement, and memory is in different segments. I strongly suggest following some of the links from this landing: https://msdn.microsoft.com/en-us/library/windows/desktop/ms687096(v=3Dvs.85= ).aspx. >The interactive window station is the only window station that can display= a user >interface or receive user input. It is assigned to the logon sessi= on of the >interactive user, and contains the keyboard, mouse, and display = device. It is >always named "WinSta0". All other window stations are nonint= eractive, which >means they cannot display a user interface or receive user= input. Notably it is not explained why this is the case, nor is any mechanism provided to subvert it. It is likely impossible to share GUI state between sessions precisely because the kernel doesn't want you to - even if you used some form of IPC to pass handles between stations, those handles are likely invalid on any other station. If you have code running in the kernel that spans multiple stations then you are doing something very odd and are completely on your own. Some of the primitives you may need to access might not be accessible and there may be no way to examine events that you might need to. On Thu, Apr 20, 2017 at 3:53 PM, A P <xxxxx@gmail.com> wrote: > oh yeah, that is a solution we have, I was merely answering @Johnny's > question to see if we did something specifically wrong. > > For the sake of a future reader searching for a similar issue, this blog > post migth be very helpful: > https://brianbondy.com/blog/100/understanding-windows-at-a-deeper-level-s= essions-window-stations-and-desktops > The heading "How to circumvent all security in Windows" is dubious, but as mentioned, this won't help you in the case of session and station isolation. > On Thu, Apr 20, 2017 at 1:38 PM, <xxxxx@gmail.com> wrote: >> >> Why don't you launch a process in the user session (with the registry) a= nd >> then setup an IPC channel between the two sessions ? >> I would strongly recommend https://msdn.microsoft.com/en-us/library/windows/hardware/dn653293(v=3Dvs.8= 5).aspx. The above, which has been mentioned many times, is the only supported way to do what the original question wants.
  Message 25 of 27  
23 Apr 17 17:11
M M
xxxxxx@hotmail.com
Join Date: 21 Oct 2010
Posts To This List: 731
Does Process have a GUI?

Impersonating the user from the execution context of the process will have no effect here. The security boundary is not based on the security principal, but rather the process context from a GDI point of view. Look at the windows station APIs in MSDN. Here is a good place to start https://msdn.microsoft.com/en-us/library/windows/desktop/ms687096(v=vs.85).aspx and then you will want to go here https://msdn.microsoft.com/en-us/library/windows/desktop/ms686232(v=vs.85).aspx Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: A P<mailto:xxxxx@gmail.com> Sent: April 20, 2017 2:56 PM To: Windows System Software Devs Interest List<mailto:xxxxx@lists.osr.com> Subject: Re: [ntdev] Does Process have a GUI? @Johnny With EnumThreadWindows I tried impersonating the process before passing the threads to EnumThreadWindows. here is the impersonation code below: // First open the process handle with query info rights. It is needed to open a token. HANDLE oProcHandle; oProcHandle = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessID); if (oProcHandle == NULL) { DoTraceError("OpenProcess failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } // Open the process token with query and duplicate rights. They are needed for impersonation. HANDLE oTokenHandle; if (FALSE == OpenProcessToken(oProcHandle, TOKEN_QUERY | TOKEN_DUPLICATE, &oTokenHandle)) { DoTraceError("OpenProcessToken failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } // Impersonate the process token if (FALSE == ImpersonateLoggedOnUser(oTokenHandle)) { DoTraceError("ImpersonateLoggedOnUser failed. Last Error = %!WINERROR!", GetLastError()); return HRESULT_FROM_WIN32(GetLastError()); } I do not impersonate each thread (is that needed?) After this code executes I call EnumWindows with the actual thread of this process, assuming that my calling thread now has the same privilege as that of the process being queried. For EnumWindows and GetWindowThreadProcessId, the enumeration only returns processes in the same session (session 0) I dont see any calls to the EnumProc fucntion for any other process. On Wed, Apr 19, 2017 at 11:05 PM, <xxxxx@live.com<mailto:xxxxx@live.com>> wrote: I'm kind of perplexed why EnumThreadWindows isn't working for you. Maybe the token needs modified? Though usually Microsoft is good about documenting that. Maybe try EnumWindows and GetWindowThreadProcessId. Then EnumChildWindows and walk the chain from there. Not the most direct method but worth a shot maybe. --- NTDEV is sponsored by OSR Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer> --- NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at --
  Message 26 of 27  
23 Apr 17 17:14
M M
xxxxxx@hotmail.com
Join Date: 21 Oct 2010
Posts To This List: 731
Does Process have a GUI?

This statement >The interactive window station is the only window station that can display a user >interface or receive user input. It is assigned to the logon session of the >interactive user, and contains the keyboard, mouse, and display device. It is >always named "WinSta0". All other window stations are noninteractive, which >means they cannot display a user interface or receive user input. Is false. It dates from Windows 2000 and should be updated. Remote desktop and fast user switching rely on multiple interactive desktops and windows stations Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: R0b0t1<mailto:xxxxx@gmail.com> Sent: April 20, 2017 5:35 PM To: Windows System Software Devs Interest List<mailto:xxxxx@lists.osr.com> Subject: Re: [ntdev] Does Process have a GUI? On Thu, Apr 20, 2017 at 1:56 PM, A P <xxxxx@gmail.com> wrote: > @Johnny > > With EnumThreadWindows I tried impersonating the process before passing the > threads to EnumThreadWindows. here is the impersonation code below: > > // First open the process handle with query info rights. It is needed > to open a token. > HANDLE oProcHandle; > oProcHandle = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, > dwProcessID); <...excess quoted lines suppressed...> As best I know the window enumeration isn't working because sessions and stations are isolated in the kernel. They are incapable of communicating without kernel involvement, and memory is in different segments. I strongly suggest following some of the links from this landing: https://msdn.microsoft.com/en-us/library/windows/desktop/ms687096(v=vs.85).aspx. >The interactive window station is the only window station that can display a user >interface or receive user input. It is assigned to the logon session of the >interactive user, and contains the keyboard, mouse, and display device. It is >always named "WinSta0". All other window stations are noninteractive, which >means they cannot display a user interface or receive user input. Notably it is not explained why this is the case, nor is any mechanism provided to subvert it. It is likely impossible to share GUI state between sessions precisely because the kernel doesn't want you to - even if you used some form of IPC to pass handles between stations, those handles are likely invalid on any other station. If you have code running in the kernel that spans multiple stations then you are doing something very odd and are completely on your own. Some of the primitives you may need to access might not be accessible and there may be no way to examine events that you might need to. On Thu, Apr 20, 2017 at 3:53 PM, A P <xxxxx@gmail.com> wrote: > oh yeah, that is a solution we have, I was merely answering @Johnny's > question to see if we did something specifically wrong. > > For the sake of a future reader searching for a similar issue, this blog > post migth be very helpful: > https://brianbondy.com/blog/100/understanding-windows-at-a-deeper-level-sessions- window-stations-and-desktops > The heading "How to circumvent all security in Windows" is dubious, but as mentioned, this won't help you in the case of session and station isolation. > On Thu, Apr 20, 2017 at 1:38 PM, <xxxxx@gmail.com> wrote: >> >> Why don't you launch a process in the user session (with the registry) and >> then setup an IPC channel between the two sessions ? >> I would strongly recommend https://msdn.microsoft.com/en-us/library/windows/hardware/dn653293(v=vs.85).aspx. The above, which has been mentioned many times, is the only supported way to do what the original question wants. --- NTDEV is sponsored by OSR Visit the list online at: <http://www.osronline.com/showlists.cfm?list=ntdev> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer> --
  Message 27 of 27  
23 Apr 17 19:10
R0b0t1
xxxxxx@gmail.com
Join Date: 24 Mar 2017
Posts To This List: 35
Does Process have a GUI?

On Sun, Apr 23, 2017 at 4:12 PM, Marion Bond <xxxxx@hotmail.com> wrote: > This statement > > > >>The interactive window station is the only window station that can display >> a user >interface or receive user input. It is assigned to the logon session >> of the >interactive user, and contains the keyboard, mouse, and display >> device. It is >always named "WinSta0". All other window stations are >> noninteractive, which >means they cannot display a user interface or receive >> user input. <...excess quoted lines suppressed...> Multiple interactive desktops are possible due to the creation of multiple sessions. Each session has a sole interactive window station. There are privileges granted to sessions that are not granted to anything else, and there is no way to create a session besides logging in - and if your computer is not licensed as a terminal server you can only log in one user at a time. This implies it is impossible to implement fast user switching or remote desktop (i.e. terminal services) without low-level OS involvement, which is the case. > > From: R0b0t1 > Sent: April 20, 2017 5:35 PM > To: Windows System Software Devs Interest List > Subject: Re: [ntdev] Does Process have a GUI? > > > > On Thu, Apr 20, 2017 at 1:56 PM, A P <xxxxx@gmail.com> wrote: >
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 06:33.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license