Hacker News Reader

Comment by poizan42 | Hacker News Reader

It is possibly to fork on Windows by using ZwCreateProcess directly, however the win32 subsystem and every single thirdparty library you are using does not expect this. If you are only using the NT native api then it should work just fine, but you are prevented from interacting with the win32 environment.

View on HN

> if you are only using the NT native API then it should work just fine

I believe I had trouble executing any instructions in the new process at all. If you can make it work I'd like to see your code, otherwise I'm skeptical.

AFAIK this is how fork() is implemented in SUA, but I haven't tried it myself. You could load the SUA subsystem dll into IDA Pro and see how they actually do it.

I believe the POSIX subsystem has some kind of support from the native API that prevents you from writing your own random subsystem and expecting it to work; I don't remember what it was though (it's been a few years).

There's some special handling when loading the image where it does different things depending on the value of the subsystem field, but I don't know whether there's any special handling in the kernel that can't be duplicated by using the native api. But the NT kernel does very little when it comes to initializing new processes, most of the initialization is done in user space by ntdll, so it seems unlikely.

Anyways the cygwin guys claim to have forked processes with ZwCreateProcess, but just had problems with getting it to work with the win32 subsystem: http://www.cygwin.com/ml/cygwin-developers/2011-04/msg00034....

Also this guy seems to have managed to do it: http://stackoverflow.com/questions/10657699/cant-use-createp..., but it hang when he called a win32 function (CreateProcess) from the child.

> had problems with getting it to work with the win32 subsystem

Keep in mind that the whole _point_ of Cygwin is to interact with the Windows world. If you want a POSIX sandbox, you can use a VM with fewer headaches and better performance.

Reply on news.ycombinator.com