title: Far jump in ntdll.dll's internal ZwCreateUserProcess
body: <p>I'm trying to understand how the Windows API creates processes so I can create a program to determine where invalid exes fail. I have a program that calls <code>kernel32.CreateProcessA</code>. Following along in OllyDbg, this calls <code>kernel32.CreateProcessInternalA</code>, which calls <code>kernel32.CreateProcessInternalW</code>, which calls <code>ntdll.ZwCreateUserProcess</code>. This function goes:</p>
  
  <pre><code>mov eax, 0xAA
  xor ecx, ecx
  lea edx, dword ptr [esp+4]
  call dword ptr fs:[0xC0]
  add esp, 4
  retn 0x2C
  </code></pre>
  
  <p>So I follow the call to <code>fs:[0xC0]</code>, which contains a single instruction:</p>
  
  <pre><code>jmp far 0x33:0x74BE271E
  </code></pre>
  
  <p>But when I step this instruction, Olly just comes back to <code>ntdll.ZwCreateUserProcess</code> at the <code>add esp, 4</code> right after the call (which is not at <code>0x74BE271E</code>). I put a breakpoint at <code>retn 0x2C</code>, and I find that the new process was somehow created during the execution of <code>add esp, 4</code>.</p>
  
  <p>So I'm assuming there's some magic involved in the far jump. I tried to change the CS register to <code>0x33</code> and EIP to <code>0x74BE271E</code> instead of actually executing the far jump, but that just gave me an access violation after a few instructions. What's going on here? I need to be able to delve deeper beyond the abstraction of this <code>ZwCreateUserProcess</code> to figure out how exactly Windows creates processes.</p>