以前以为下面是调用的 NtCreateProcesss 今天代码里这样写 没断下来 Windbg 调试下 才发现是这个样子的。。

kd> kbChildEBP RetAddr  Args to Child              f7d3fd38 804de7ec 0089b01c 001f0fff 00000000 nt!NtCreateProcessExf7d3fd38 7c90e4f4 0089b01c 001f0fff 00000000 nt!KiFastCallEntry+0xf80089ac34 7c90d14c 7c8192ce 0089b01c 001f0fff ntdll!KiFastSystemCallRet0089ac38 7c8192ce 0089b01c 001f0fff 00000000 ntdll!ZwCreateProcessEx+0xc0089b688 7c802362 00000000 00000000 0089b6f8 kernel32!CreateProcessInternalW+0x13270089b6c0 0043089e 00000000 0089b6f8 00000000 kernel32!CreateProcessW+0x2cWARNING: Stack unwind information not available. Following frames may be wrong.0089f79c 0044d413 00000000 00000000 00000000 sujnlomrjc+0x3089e00000000 00000000 00000000 00000000 00000000 sujnlomrjc+0x4d413