/*+
 *
 *  Microsoft Windows
 *  Copyright (C) Microsoft Corporation, 1997 - 1998.
 *
 *  Name : cseclogn.cxx
 *  Author:Jeffrey Richter (v-jeffrr)
 *
 * Abstract:
 * This is the client side for Secondary Logon Service
 * implemented as CreateProcessWithLogon API
 * in advapi32.dll
 *
 * Revision History:
 * PraeritG    10/8/97  To integrate this in to services.exe
 *
-*/

#define UNICODE

#define SECURITY_WIN32

#include <Windows.h>
#include <wincred.h>
#include <rpc.h>
#include "seclogon.h"
#include "security.h"
#include "dbgdef.h"

//
// must move to winbase.h soon!
#define LOGON_WITH_PROFILE              0x00000001
#define LOGON_NETCREDENTIALS_ONLY       0x00000002

//
// Global function pointers to user32 functions
// This is to dynamically load user32 when CreateProcessWithLogon
// is called.
//

HMODULE hModule1 = NULL;

typedef HDESK (*OPENDESKTOP) (
    LPWSTR lpszDesktop,
    DWORD dwFlags,
    BOOL fInherit,
    ACCESS_MASK dwDesiredAccess);

OPENDESKTOP myOpenDesktop = NULL;

typedef HDESK (*GETTHREADDESKTOP)(
    DWORD dwThreadId);

GETTHREADDESKTOP    myGetThreadDesktop = NULL;

typedef BOOL (*CLOSEDESKTOP)(
    HDESK hDesktop);

CLOSEDESKTOP    myCloseDesktop = NULL;

typedef HWINSTA (*OPENWINDOWSTATION)(
    LPWSTR lpszWinSta,
    BOOL fInherit,
    ACCESS_MASK dwDesiredAccess);

OPENWINDOWSTATION   myOpenWindowStation = NULL;

typedef HWINSTA (*GETPROCESSWINDOWSTATION)(
    VOID);

GETPROCESSWINDOWSTATION myGetProcessWindowStation = NULL;


typedef BOOL (*SETPROCESSWINDOWSTATION)(HWINSTA hWinSta); 
                                      
SETPROCESSWINDOWSTATION mySetProcessWindowStation; 


typedef BOOL (*CLOSEWINDOWSTATION)(
    HWINSTA hWinSta);

CLOSEWINDOWSTATION  myCloseWindowStation = NULL;

typedef BOOL (*SETUSEROBJECTSECURITY)(
    HANDLE hObj,
    PSECURITY_INFORMATION pSIRequested,
    PSECURITY_DESCRIPTOR pSID);

SETUSEROBJECTSECURITY   mySetUserObjectSecurity = NULL;

typedef BOOL (*GETUSEROBJECTSECURITY)(
    HANDLE hObj,
    PSECURITY_INFORMATION pSIRequested,
    PSECURITY_DESCRIPTOR pSID,
    DWORD nLength,
    LPDWORD lpnLengthNeeded);

GETUSEROBJECTSECURITY  myGetUserObjectSecurity = NULL;

typedef BOOL (*GETUSEROBJECTINFORMATION)(
    HANDLE hObj,
    int nIndex,
    PVOID pvInfo,
    DWORD nLength,
    LPDWORD lpnLengthNeeded);

GETUSEROBJECTINFORMATION    myGetUserObjectInformation = NULL;

////////////////////////////////////////////////////////////////////////
//
// Function prototypes:
//
////////////////////////////////////////////////////////////////////////

DWORD c_SeclCreateProcessWithLogonW(IN   SECL_SLI   *psli,
                                    OUT  SECL_SLRI  *pslri);

DWORD To_SECL_BLOB_A(IN   LPVOID      lpEnvironment,
                     OUT  SECL_BLOB  *psb);

DWORD To_SECL_BLOB_W(IN   LPVOID      lpEnvironment,
                     OUT  SECL_BLOB  *psb);


/////////////////////////////////////////////////////////////////////////
//
// Useful macros:
//
/////////////////////////////////////////////////////////////////////////

#define ARRAYSIZE(array) ((sizeof(array)) / (sizeof(array[0])))

#define ASSIGN_SECL_STRING(ss, wsz) \
    { \
        ss.pwsz = wsz; \
        if (NULL != wsz) {\
            ss.ccLength = ss.ccSize = (wcslen(wsz) + 1); \
         } \
        else { \
            ss.ccLength = ss.ccSize = 0; \
        } \
    }

////////////////////////////////////////////////////////////////////////
//
// Module implementation:
//
//////////////////////////////////////////////////////////////////////////


extern "C" void *__cdecl _alloca(size_t);

BOOL
WINAPI
CreateProcessWithLogonW(
      LPCWSTR lpUsername,
      LPCWSTR lpDomain,
      LPCWSTR lpPassword,
      DWORD dwLogonFlags,
      LPCWSTR lpApplicationName,
      LPWSTR lpCommandLine,
      DWORD dwCreationFlags,
      LPVOID lpEnvironment,
      LPCWSTR lpCurrentDirectory,
      LPSTARTUPINFOW lpStartupInfo,
      LPPROCESS_INFORMATION lpProcessInformation)

/*++

Routine Description:

Arguments:

Return Value:

--*/
{

   BOOL                             AccessWasAllowed           = FALSE;
   BOOL                             fOk                        = FALSE;
   BOOL                             fRevertWinsta              = FALSE; 
   DWORD                            LastError                  = ERROR_SUCCESS;
   HANDLE                           hheap                      = GetProcessHeap();
   HDESK                            hDesk                      = NULL; 
   HWINSTA                          hWinsta                    = NULL; 
   HWINSTA                          hWinstaSave                = NULL; 
   LPWSTR                           pszApplName                = NULL;
   LPWSTR                           pszCmdLine                 = NULL;
   LPWSTR                           pwszEmptyString            = L"";
   SECL_SLI                         sli;
   SECL_SLRI                        slri;
   WCHAR                            wszDesktopName[2*MAX_PATH + 1];

   ZeroMemory(&sli,             sizeof(sli));
   ZeroMemory(&slri,            sizeof(slri));
   ZeroMemory(&wszDesktopName,  sizeof(wszDesktopName));

   //
   // dynamically load user32.dll and resolve the functions.
   //
   // note: last error is left as returned by loadlib or getprocaddress

   if(hModule1 == NULL)
   {
       hModule1 = LoadLibrary(L"user32.dll");
       if(hModule1)
       {
            myOpenDesktop = (OPENDESKTOP) GetProcAddress(hModule1,
                                                         "OpenDesktopW");
            if(!myOpenDesktop) return FALSE;


            myGetThreadDesktop = (GETTHREADDESKTOP)
                                        GetProcAddress( hModule1,
                                                        "GetThreadDesktop");
            if(!myGetThreadDesktop) return FALSE;


            myCloseDesktop = (CLOSEDESKTOP) GetProcAddress(hModule1,
                                                           "CloseDesktop");
            if(!myCloseDesktop) return FALSE;


            myOpenWindowStation = (OPENWINDOWSTATION)
                                        GetProcAddress(hModule1,
                                                       "OpenWindowStationW");
            if(!myOpenWindowStation) return FALSE;


            myGetProcessWindowStation = (GETPROCESSWINDOWSTATION)
                                        GetProcAddress(hModule1,
                                                    "GetProcessWindowStation");
            if(!myGetProcessWindowStation) return FALSE;

            mySetProcessWindowStation = (SETPROCESSWINDOWSTATION)GetProcAddress(hModule1, "SetProcessWindowStation"); 
            if (!mySetProcessWindowStation) return FALSE; 

            myCloseWindowStation = (CLOSEWINDOWSTATION) GetProcAddress(hModule1,
                                                "CloseWindowStation");

            if(!myCloseWindowStation) return FALSE;


            myGetUserObjectSecurity = (GETUSEROBJECTSECURITY)
                                                GetProcAddress(hModule1,
                                                "GetUserObjectSecurity");
            if(!myGetUserObjectSecurity) return FALSE;

            mySetUserObjectSecurity = (SETUSEROBJECTSECURITY)
                                                GetProcAddress(hModule1,
                                                "SetUserObjectSecurity");
            if(!mySetUserObjectSecurity) return FALSE;


            myGetUserObjectInformation = (GETUSEROBJECTINFORMATION)
                                                GetProcAddress(hModule1,
                                                "GetUserObjectInformationW");
            if(!mySetUserObjectSecurity) return FALSE;
       }
       else
       {
            return FALSE;
       }
   }

   __try {


      //
      // JMR: Do these flags work: CREATE_SEPARATE_WOW_VDM,
      //       CREATE_SHARED_WOW_VDM
      // Valid flags: CREATE_SUSPENDED, CREATE_UNICODE_ENVIRONMENT,
      //              *_PRIORITY_CLASS
      //
      // The following flags are illegal. Fail the call if any are specified.
      //
      if ((dwCreationFlags & (DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS
                              | DETACHED_PROCESS)) != 0) {
         LastError = ERROR_INVALID_PARAMETER;
         __leave;
      }

      if(dwLogonFlags & ~(LOGON_WITH_PROFILE | LOGON_NETCREDENTIALS_ONLY))
      {
         LastError = ERROR_INVALID_PARAMETER;
         __leave;
      }

      //
      // Turn on the flags that MUST be turned on
      //
      // We are overloading CREATE_NEW_CONSOLE to
      // CREATE_WITH_NETWORK_LOGON
      //
      dwCreationFlags |= CREATE_DEFAULT_ERROR_MODE | CREATE_NEW_CONSOLE
                           | CREATE_NEW_PROCESS_GROUP;

      //
      // If no priority class explicitly specified and this process is IDLE, force IDLE (See CreateProcess documentation)
      //
      if ((dwCreationFlags & (NORMAL_PRIORITY_CLASS | IDLE_PRIORITY_CLASS
                              | HIGH_PRIORITY_CLASS
                              | REALTIME_PRIORITY_CLASS)) == 0) {

         if (GetPriorityClass(GetCurrentProcess()) == IDLE_PRIORITY_CLASS)
                  dwCreationFlags |= IDLE_PRIORITY_CLASS;
      }

      pszApplName = (LPWSTR) HeapAlloc(hheap, 0, sizeof(WCHAR) * (MAX_PATH));
      //
      // Lookup the fullpathname of the specified executable
      //
      pszCmdLine = (LPWSTR) HeapAlloc(hheap, 0, sizeof(WCHAR) *
                                             (MAX_PATH + lstrlenW(lpCommandLine)));

      if(pszApplName == NULL || pszCmdLine == NULL)
      {
        LastError = ERROR_INVALID_PARAMETER;
        __leave;
      }


      if(lpApplicationName == NULL)
      {
         if(lpCommandLine != NULL)
         {
            //
            // Commandline contains the name, we should parse it out and get
            // the full path so that correct executable is invoked.
            //

            DWORD   Length;
            DWORD   fileattr;
            WCHAR   TempChar = L'\0';
            LPWSTR  TempApplName = NULL;
            LPWSTR  TempRemainderString = NULL;
            LPWSTR  WhiteScan = NULL;
            BOOL    SearchRetry = TRUE;
            LPWSTR  ApplName = (LPWSTR) HeapAlloc(
                                                hheap, 0,
                                                sizeof(WCHAR) * (lstrlenW(lpCommandLine)+1));

            LPWSTR  NameBuffer = (LPWSTR) HeapAlloc(
                                                hheap, 0,
                                                sizeof(WCHAR) * (MAX_PATH+1));

	    if (ApplName == NULL || NameBuffer == NULL)
	    {
	        LastError = ERROR_NOT_ENOUGH_MEMORY;
		__leave;
	    }

            lstrcpy(ApplName, lpCommandLine);
            WhiteScan = ApplName;

            //
            // if there is a leading quote
            //
            if(*WhiteScan == L'\"')
            {
                // we will NOT retry search, as app name is quoted.

                SearchRetry = FALSE;
                WhiteScan++;
                TempApplName = WhiteScan;
                while(*WhiteScan) {
                    if( *WhiteScan == L'\"')
                    {
                        TempChar = *WhiteScan;
                        *WhiteScan = L'\0';
                        TempRemainderString = WhiteScan;
                        break;
                    }
                    WhiteScan++;
                }
            }
            else
            {
                // skip to the first non-white char
                while(*WhiteScan) {
                    if( *WhiteScan == L' ' || *WhiteScan == L'\t')
                    {
                        WhiteScan++;
                    }
                    else
                        break;
                }
                TempApplName = WhiteScan;

                while(*WhiteScan) {
                    if( *WhiteScan == L' ' || *WhiteScan == L'\t')
                    {
                        TempChar = *WhiteScan;
                        *WhiteScan = L'\0';
                        TempRemainderString = WhiteScan;
                        break;
                    }
                    WhiteScan++;
                }

            }

RetrySearch:
            Length = SearchPathW(
                            NULL,
                            TempApplName,
                            (PWSTR)L".exe",
                            MAX_PATH,
                            NameBuffer,
                            NULL
                            );

            if(!Length || Length > MAX_PATH)
            {
                if(LastError)
                    SetLastError(LastError);
                else
                    LastError = GetLastError();

CoverForDirectoryCase:
                    //
                    // If we still have command line left, then keep going
                    // the point is to march through the command line looking
                    // for whitespace so we can try to find an image name
                    // launches of things like:
                    // c:\word 95\winword.exe /embedding -automation
                    // require this. Our first iteration will
                    // stop at c:\word, our next
                    // will stop at c:\word 95\winword.exe
                    //
                    if(TempRemainderString)
                    {
                        *TempRemainderString = TempChar;
                        WhiteScan++;
                    }
                    if(*WhiteScan & SearchRetry)
                    {
                        // again skip to the first non-white char
                        while(*WhiteScan) {
                            if( *WhiteScan == L' ' || *WhiteScan == L'\t')
                            {
                                WhiteScan++;
                            }
                            else
                                break;
                        }
                        while(*WhiteScan) {
                            if( *WhiteScan == L' ' || *WhiteScan == L'\t')
                            {
                                TempChar = *WhiteScan;
                                *WhiteScan = L'\0';
                                TempRemainderString = WhiteScan;
                                break;
                            }
                            WhiteScan++;
                        }
                        // we'll do one last try of the whole string.
                        if(!WhiteScan) SearchRetry = FALSE;
                        goto RetrySearch;
                    }

                    //
                    // otherwise we have failed.
                    //
                    if(NameBuffer) HeapFree(hheap, 0, NameBuffer);
                    if(ApplName) HeapFree(hheap, 0, ApplName);

                    // we should let CreateProcess do its job.
                    if (pszApplName)
                    {
                        HeapFree(hheap, 0, pszApplName);
                        pszApplName = NULL;
                    }
                    lstrcpy(pszCmdLine, lpCommandLine);
            }
            else
            {
                // searchpath succeeded.
                // but it can find a directory!
                fileattr = GetFileAttributesW(NameBuffer);
                if ( fileattr != 0xffffffff &&
                        (fileattr & FILE_ATTRIBUTE_DIRECTORY) ) {
                        Length = 0;
                        goto CoverForDirectoryCase;
                }

                //
                // so it is not a directory.. it must be the real thing!
                //
                lstrcpy(pszApplName, NameBuffer);
                lstrcpy(pszCmdLine, lpCommandLine);

                HeapFree(hheap, 0, ApplName);
                HeapFree(hheap, 0, NameBuffer);
            }

         }
         else
         {

            LastError = ERROR_INVALID_PARAMETER;
            __leave;
         }

      }
      else
      {

         //
         // If ApplicationName is not null, we need to handle
         // one case here -- the application name is present in
         // current directory.  All other cases will be handled by
         // CreateProcess in the server side anyway.
         //

         //
         // let us get a FullPath relative to current directory
         // and try to open it.  If it succeeds, then the full path
         // is what we'll give as app name.. otherwise will just
         // pass what we got from caller and let CreateProcess deal with it.

         LPWSTR lpFilePart;

         DWORD  cchFullPath = GetFullPathName(
                                            lpApplicationName,
                                            MAX_PATH,
                                            pszApplName,
                                            &lpFilePart
                                            );

         if(cchFullPath)
         {
             HANDLE hFile;
             //
             // let us try to open it.
             // if it works, pszApplName is already setup correctly.
             // just close the handle.

             hFile = CreateFile(lpApplicationName, GENERIC_READ,
                                FILE_SHARE_READ | FILE_SHARE_WRITE,
                                NULL,
                                OPEN_EXISTING,
                                0,
                                NULL
                                );

             if(hFile == INVALID_HANDLE_VALUE)
             {
                // otherwise, keep what the caller gave us.
                lstrcpy(pszApplName,lpApplicationName);
             }
             else
                CloseHandle(hFile);

         }
         else
            // lets keep what the caller gave us.
            lstrcpyn(pszApplName, lpApplicationName, MAX_PATH);

         //
         // Commandline should be kept as is.
         //
         if(lpCommandLine != NULL)
                 lstrcpy(pszCmdLine, lpCommandLine);
         else
         {
            HeapFree(hheap, 0, pszCmdLine);
            pszCmdLine = NULL;
         }
      }

#if 0
      if(lpApplicationName != NULL) lstrcpy(pszApplName,lpApplicationName);
      else {
            HeapFree(hheap, 0, pszApplName);
            pszApplName = NULL;
      }
      if(lpCommandLine != NULL) lstrcpy(pszCmdLine, lpCommandLine);
      else {
            HeapFree(hheap, 0, pszCmdLine);
            pszCmdLine = NULL;
      }
#endif

      // Construct a memory block will all the info that needs to go to the server

      sli.lLogonIdHighPart   = 0;
      sli.ulLogonIdLowPart   = 0;
      sli.ulLogonFlags       = dwLogonFlags;
      sli.ulProcessId        = GetCurrentProcessId();
      sli.ulCreationFlags    = dwCreationFlags;

      ASSIGN_SECL_STRING(sli.ssUsername,          (LPWSTR) lpUsername);
      ASSIGN_SECL_STRING(sli.ssDomain,            (LPWSTR) lpDomain);
      ASSIGN_SECL_STRING(sli.ssPassword,          (LPWSTR)lpPassword);
      ASSIGN_SECL_STRING(sli.ssApplicationName,   pszApplName);
      ASSIGN_SECL_STRING(sli.ssCommandLine,       pszCmdLine);
      ASSIGN_SECL_STRING(sli.ssCurrentDirectory,  (LPWSTR)lpCurrentDirectory);
      ASSIGN_SECL_STRING(sli.ssDesktop,           lpStartupInfo->lpDesktop);
      ASSIGN_SECL_STRING(sli.ssTitle,             lpStartupInfo->lpTitle);

      if (0 != (sli.ulCreationFlags & CREATE_UNICODE_ENVIRONMENT)) {
          LastError = To_SECL_BLOB_W(lpEnvironment, &(sli.sbEnvironment));
      }
      else {
          LastError = To_SECL_BLOB_A(lpEnvironment, &(sli.sbEnvironment));
      }
      if (ERROR_SUCCESS != LastError) { __leave; }

      // If the caller hasn't specified their own desktop, we'll do it for 
      // them  (the seclogon service will take care of granting access
      // to the desktop). 
      if (sli.ssDesktop.pwsz == NULL || sli.ssDesktop.pwsz[0] == L'\0')
      {
          DWORD    Length;
          HWINSTA  Winsta  = myGetProcessWindowStation();
          HDESK    Desk    = myGetThreadDesktop(GetCurrentThreadId());
          
          // Send seclogon handles to the current windowstation and desktop: 
          if (0 == (dwLogonFlags & LOGON_NETCREDENTIALS_ONLY)) 
          {
              sli.hWinsta = (unsigned __int64)Winsta; 
              sli.hDesk   = (unsigned __int64)Desk; 
          } 
          else 
          {
              // In the /netonly case, we don't need to grant access to the desktop:
              sli.hWinsta = 0; 
              sli.hDesk = 0; 
          }

          // Send seclogon the name of the current windowstation and desktop. 
          // Default to empty string if we can't get the name: 
          ASSIGN_SECL_STRING(sli.ssDesktop, pwszEmptyString);
          
          if (myGetUserObjectInformation(Winsta, UOI_NAME, wszDesktopName, (MAX_PATH*sizeof(WCHAR)), &Length))
          {
              Length = wcslen(wszDesktopName); 
              wszDesktopName[Length++] = L'\\'; 
              
              if(myGetUserObjectInformation(Desk, UOI_NAME, &wszDesktopName[Length], (MAX_PATH*sizeof(WCHAR)), &Length))
              {
                  // sli.ssDesktop now contains "windowstation\desktop"
                  ASSIGN_SECL_STRING(sli.ssDesktop, wszDesktopName);
              }
          }
      } 
      else
      {
          LPWSTR pwszDeskName; 

          // The caller specified their own desktop
          sli.ulSeclogonFlags |= SECLOGON_CALLER_SPECIFIED_DESKTOP; 

          // Open a handle to the specified windowstation and desktop: 
          wcscpy(wszDesktopName, sli.ssDesktop.pwsz); 
          pwszDeskName = wcschr(wszDesktopName, L'\\'); 
          if (NULL == pwszDeskName)
          {
              SetLastError(ERROR_INVALID_PARAMETER); 
              __leave; 
          }
          *pwszDeskName++ = L'\0'; 
          
          hWinsta = myOpenWindowStation(wszDesktopName, TRUE, MAXIMUM_ALLOWED); 
          if (NULL == hWinsta)
              __leave; 

          hWinstaSave = myGetProcessWindowStation(); 
          if (NULL == hWinstaSave)
              __leave; 

          if (!mySetProcessWindowStation(hWinsta))
              __leave; 
          fRevertWinsta = TRUE; 

          hDesk = myOpenDesktop(pwszDeskName, 0, TRUE, MAXIMUM_ALLOWED); 
          if (NULL == hDesk)
              __leave; 

          // Pass the windowstation and desktop handles to seclogon: 
          sli.hWinsta  = (unsigned __int64)hWinsta; 
          sli.hDesk    = (unsigned __int64)hDesk; 
      }

      // Perform the RPC call to the seclogon service:
      LastError = c_SeclCreateProcessWithLogonW(&sli, &slri);
      if (ERROR_SUCCESS != LastError) __leave;

      fOk = (slri.ulErrorCode == NO_ERROR);  // This function succeeds if the server's function succeeds

      if (!fOk) {
          //
          // If the server function failed, set the server's
          // returned eror code as this thread's error code
          //
          LastError = slri.ulErrorCode;
          SetLastError(slri.ulErrorCode);
      } else {
          //
          // The server function succeeded, return the
          // PROCESS_INFORMATION info
          //
          lpProcessInformation->hProcess     = (HANDLE)slri.hProcess;
          lpProcessInformation->hThread      = (HANDLE)slri.hThread;
          lpProcessInformation->dwProcessId  = slri.ulProcessId;
          lpProcessInformation->dwThreadId   = slri.ulThreadId;
          LastError = ERROR_SUCCESS;
      }
   }
   __finally {
      if (NULL != pszCmdLine)   HeapFree(hheap, 0, pszCmdLine);
      if (NULL != pszApplName)  HeapFree(hheap, 0, pszApplName);
      if (fRevertWinsta)        mySetProcessWindowStation(hWinstaSave); 
      if (NULL != hWinsta)      myCloseWindowStation(hWinsta); 
      if (NULL != hDesk)        myCloseDesktop(hDesk); 
      SetLastError(LastError);
   }

   return(fOk);
}

////////////////////////////////////////////////////////////////////////
//
// RPC Utility methods:
//
////////////////////////////////////////////////////////////////////////

DWORD To_SECL_BLOB_W(IN   LPVOID      lpEnvironment,
                     OUT  SECL_BLOB  *psb) {
    DWORD    cb        = 0;
    DWORD    dwResult  = NULL;
    HANDLE   hHeap     = NULL;
    LPBYTE   pb        = NULL;
    LPWSTR   pwsz      = NULL;

    hHeap = GetProcessHeap();
    _JumpCondition(NULL == hHeap, GetProcessHeapError);

    if (NULL != lpEnvironment) {
        for (pwsz = (LPWSTR)lpEnvironment; pwsz[0] != L'\0'; pwsz += wcslen(pwsz) + 1);

        cb = sizeof(WCHAR) * (DWORD)(((1 + (pwsz - (LPWSTR)lpEnvironment))) & 0xFFFFFFFF);
        pb = (LPBYTE)HeapAlloc(hHeap, HEAP_ZERO_MEMORY, cb);
        _JumpCondition(NULL == pb, MemoryError);

        CopyMemory(pb, (LPBYTE)lpEnvironment, cb);
    }

    psb->cb  = cb;
    psb->pb  = pb;
    dwResult = ERROR_SUCCESS;
 CommonReturn:
    return dwResult;

 ErrorReturn:
    if (NULL != pb) { HeapFree(hHeap, 0, pb); }
    goto CommonReturn;

SET_DWRESULT(GetProcessHeapError, GetLastError());
SET_DWRESULT(MemoryError,         ERROR_NOT_ENOUGH_MEMORY);
}

DWORD To_SECL_BLOB_A(IN   LPVOID      lpEnvironment,
                     OUT  SECL_BLOB  *psb) {
    DWORD    cb        = 0;
    DWORD    dwResult;
    HANDLE   hHeap     = NULL;
    LPBYTE   pb        = NULL;
    LPSTR    psz       = NULL;

    hHeap = GetProcessHeap();
    _JumpCondition(NULL == hHeap, GetProcessHeapError);

    if (NULL != lpEnvironment) {
        for (psz = (LPSTR)lpEnvironment; psz[0] != '\0'; psz += strlen(psz) + 1);

        cb = (DWORD)((1 + (psz - (LPSTR)lpEnvironment) & 0xFFFFFFFF));
        pb = (LPBYTE)HeapAlloc(hHeap, HEAP_ZERO_MEMORY, cb);
        _JumpCondition(NULL == pb, MemoryError);

        CopyMemory(pb, (LPBYTE)lpEnvironment, cb);
    }

    psb->cb  = cb;
    psb->pb  = pb;
    dwResult = ERROR_SUCCESS;
 CommonReturn:
    return dwResult;

 ErrorReturn:
    if (NULL != pb) { HeapFree(hHeap, 0, pb); }
    goto CommonReturn;

SET_DWRESULT(GetProcessHeapError, GetLastError());
SET_DWRESULT(MemoryError,         ERROR_NOT_ENOUGH_MEMORY);
}


DWORD StartSeclogonService() {
    BOOL            fResult;
    DWORD           dwInitialCount;
    DWORD           dwResult;
    SC_HANDLE       hSCM;
    SC_HANDLE       hService;
    SERVICE_STATUS  sSvcStatus;

    hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);
    _JumpCondition(hSCM == NULL, OpenSCManagerError);

    hService = OpenService(hSCM, wszSvcName, SERVICE_START | SERVICE_QUERY_STATUS);
    _JumpCondition(NULL == hService, OpenServiceError);

    fResult = StartService(hService, NULL, NULL);
    _JumpCondition(FALSE == fResult, StartServiceError);

    // Wait until the service has actually started.
    // Set timeout to 20 seconds.
    dwInitialCount = GetTickCount();

    // Keep polling to see if the service has started ...
    while (TRUE)
    {
        fResult = QueryServiceStatus(hService, &sSvcStatus);
        _JumpCondition(FALSE == fResult, QueryServiceStatusError);

        // The service is running.  We can stop waiting for it.
        if (sSvcStatus.dwCurrentState == SERVICE_RUNNING)
            break;

        // Check to see if we've timed out.  If GetTickCount() rolls over,
        // then at worst we time out early.
        _JumpCondition((GetTickCount() - dwInitialCount) > 20000, ServiceTimeoutError);

        // Don't hose the service.
        SleepEx(100, FALSE);
    }

    // Ok, the service has successfully started.
    dwResult = ERROR_SUCCESS;
 CommonReturn:
    if (NULL != hSCM)     { CloseServiceHandle(hSCM); }
    if (NULL != hService) { CloseServiceHandle(hService); }
    return dwResult;

 ErrorReturn:
    goto CommonReturn;

SET_DWRESULT(OpenSCManagerError,       GetLastError());
SET_DWRESULT(OpenServiceError,         GetLastError());
SET_DWRESULT(QueryServiceStatusError,  GetLastError());
SET_DWRESULT(StartServiceError,        GetLastError());
SET_DWRESULT(ServiceTimeoutError,      ERROR_SERVICE_REQUEST_TIMEOUT);
}

DWORD c_SeclCreateProcessWithLogonW
(IN   SECL_SLI  *psli,
 OUT  SECL_SLRI *pslri)
{
    BOOL                 fResult;
    DWORD                dwResult;
    LPWSTR               pwszBinding  = NULL;
    RPC_BINDING_HANDLE   hRPCBinding  = NULL;

    dwResult = RpcStringBindingCompose
          (NULL,
           (USHORT *)L"ncacn_np",
           NULL,
           (USHORT *)L"\\PIPE\\" wszSeclogonSharedProcEndpointName,
           (USHORT *)L"Security=impersonation static false",
           (USHORT **)&pwszBinding);
    _JumpCondition(RPC_S_OK != dwResult, RpcStringBindingComposeError);

    dwResult = RpcBindingFromStringBinding((USHORT *)pwszBinding, &hRPCBinding);
    _JumpCondition(0 != dwResult, RpcBindingFromStringBindingError);

    // Perform the RPC call to the seclogon service.  If the call fails because the
    // service was not started, try again.  If the call still fails, give up.
    for (BOOL fFirstTry = TRUE; TRUE; fFirstTry = FALSE) {
        __try {
            SeclCreateProcessWithLogonW(hRPCBinding, psli, pslri);
            break;
        }
        __except(EXCEPTION_EXECUTE_HANDLER) {
              dwResult = RpcExceptionCode();
              if ((RPC_S_SERVER_UNAVAILABLE == dwResult || RPC_S_UNKNOWN_IF == dwResult) && 
                  (TRUE == fFirstTry)) { 
                  // Ok, the seclogon service is probably just not started.
                  // Attempt to start it up and try again.
                  dwResult = StartSeclogonService();
                  _JumpCondition(ERROR_SUCCESS != dwResult, SeclCreateProcessWithLogonWError);
              }
              else {
                  goto SeclCreateProcessWithLogonWError;
              }
        }
    }

    dwResult = ERROR_SUCCESS;
 CommonReturn:
    if (NULL != pwszBinding) { RpcStringFree((USHORT **)&pwszBinding); }
    if (NULL != hRPCBinding) { RpcBindingFree(&hRPCBinding); }
    return dwResult;

 ErrorReturn:
    goto CommonReturn;

SET_DWRESULT(RpcBindingFromStringBindingError,  dwResult);
SET_DWRESULT(RpcStringBindingComposeError,      dwResult);
SET_DWRESULT(SeclCreateProcessWithLogonWError,  dwResult);
}

void DbgPrintf( DWORD dwSubSysId, LPCSTR pszFormat , ...)
{
}

//////////////////////////////// End Of File /////////////////////////////////