createprocess does not show window contents

Looking at filesystem and registry activity while creating a new process reveals plenty of peculiarities. I know at least three programs that utilize this mechanism for non-debugging purposes: widely known Process Explorer and Process Hacker - to replace Windows Task Manager, and AkelPad - to replace the Notepad. I must say that it is not an innovative approach. Those who want to start experimenting right away can find the GitHub repository here. So, are there any limitations on what we can do if we register ourselves as a debugger? Let’s push this opportunity to the limits and see what we can achieve. Therefore, it becomes the debugger’s responsibility to start the application and then attach itself to it. Internally, the system swaps the path to the image file with the debugger’s location, passing the former as a parameter. Even more importantly, it happens synchronously, i.e., the target won’t start unless we allow it. I don’t know about you, but I immediately saw this feature as a mechanism for executing arbitrary code when someone creates a new process. Then you can single-step through the code and figure what goes wrong.

With IFEO, however, you can instruct the system to launch your favorite debugger right when it’s about to start this troublesome process. In case you cannot launch this child manually (that can happen for various reasons), you might have a hard time troubleshooting this problem. Imagine a scenario where some program creates a child process that crashes immediately. One of its features that drew my attention is a mechanism designed to help developers debug multi-process applications. Have you ever heard of Image File Execution Options ( IFEO)? It is a registry key under HKEY_LOCAL_MACHINE that controls things like Global Flags and Mitigation Policies on a per-process basis.

Createprocess does not show window contents