CreateProcess - wine is not doing it right

Vitaliy Margolen wine-devel at
Thu Sep 8 21:12:16 CDT 2005

Now I really need you help people.

Ok, here is the problem:
LdrInitializeThunk is called from within start_process - the first thing to be
executed in the new process's context. But this is not right. All what I found
so far indicates, that LdrInitializeThunk should be queued as an APC, so it
executes first no matter what.

To complicate matters more, LdrInitializeThunk calling wineserver to stop the
process if it's created with CREATE_SUSPENDED flag set. This is wrong. New
process should never make it to it's main thread yet.
And even worse, none of this happens where it should be - in ntdll.
Functions such as NtCreateProcess and NtCreateThread are stubs. So when I'm
looking on-line for any information, they all refer to these ntdll functions.

I'm looking at this code and can't figure out what part of it belongs where.
In kernel we have:
1. CreateProcessW that figures out what the executable is and calls the one of
   the other functions. That's talk about PE for now (create_process).
2. create_process: I'm not sure what the first part does (something about
   child). It looks to me that most of the first part including new_process
   wineserver call should be a part of NtCreateProcess.
   Everything else from create_process should go into NtCreateThread.
3. THREAD_InitStack shoul probably stay, except all the memory allocation goes to
4. start_process should stay the way it is, except delete call to
5. LdrInitializeThunk - have no clue what should stay, and what should go
   somewhere else.

Then we have a wineserver's init_process_done. Some parts of it looks like
should go into create_process. But I'm not sure here ether.

Best regards,

More information about the wine-devel mailing list