[utsav.0202]

Hi

I am developing an application control module i.e. restricting some applications from executing.
For this I registered a callback routine using PsSetCreateProcessNotifyRoutine.
In the callback routine I get the process ID using which I decide whether to allow the process or not.
If I don't have to allow the process I set the value of CreateInfo->CreationStatus of PS_CREATE_NOTIFY_INFO structure to STATUS_ACCESS_DENIED.
Everything works fine but the problem is when I prevent the process from being created the user gets a dialog box saying
"Windows cannot access the specified device, path or file. You may not have appropriate permissions to access the item"
I don't want this dialog box to be displayed.

Thanks and Regards
Utsav

[utsav.0202]

sorry
It's PsSetCreateProcessNotifyRoutineEx routine that I have used

[EP_X0FF]

How about returning any other error status code?

[utsav.0202]

I tried STATUS_UNSUCCESSFUL
it returned "A device attached to the system is not functioning"

then I tried STATUS_THREAD_IS_TERMINATING
even then a dialog box popped.

Please help

[EP_X0FF]

I'm afraid since this is system mechanism there is no documented way with this API. If you really care about this error messages then probably you should try other methods, for example sending APC with shellcode. I don't have any sample at hand.

[xqrzd]

I think Malwarebytes does this by minifilter with IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION, and then replacing file object with a dummy.

[Brock]

CreationStatus
The NTSTATUS value to return for the process-creation operation. Drivers can change this value to an error code to prevent the process from being created.

Errors like this are reported within the Windows OS environment, as suggested by EP_X0FF try queuing an APC to the process to have itself terminate in some fashion, by the way doing this in PsCreateProcessNotificationRoutine will not help you, look into loadimage or createthread callbacks. Preferably LoadImage callbacks, since you have pointers you will need in user space dynamically / at run-time available for you before the process entrypoint is run. Actually, what you're asking for is very simple but you're not using the best/most stable callback to terminate a process cleanly from. If you choose to use a loadimage callback images such as ntdll and kernel32 are loaded and you are notified, making your job very simple.