Tuesday, August 09, 2011

What does the CreateProcess function do if there is no space between the program name and the arguments?

In an old discussion of why the Create­Process function modifies its command line, commenter Random832 asked, "What if there is no space between the program name and arguments - like "cmd/?" - where does it put the null then?"

The Create­Process function requires a space between the program name and arguments. If you leave out the space, then the arguments are considered as part of the program name (and you'll almost certainly get ERROR_FILE_NOT_FOUND back).

It sounds like Random832 has confused Create­Process command line parsing with cmd.exe command line parsing. Clearly the two parsers are different; you can see this even without playing with spaces between the program name and the arguments:

C:\>C:\Program Files\Windows NT\Accessories\wordpad.exe
'C:\Program' is not recognized as an internal or external command,
operable program or batch file.

If the command line had been parsed by Create­Process, this would have succeeded in running the Wordpad program, because, as I noted in the original article, the Create­Process function modifies its command line in order to find where the program name ends and the command lines begin, an example of which can be found in the Create­Process documentation. In this case, it would have plunked the null character into each of the spaces in the command line, finding that each one failed, until it finally tried treating the entire string as the program name, at which point it would have succeeded. The fact that it failed demonstrates that Create­Process didn't do the parsing.

The cmd.exe program permits the space between a program name and its arguments to be elided if the arguments begin with a character not permitted in file names. Once it figures out what you're running, and it determines that what you're running is a program, it call the Create­Process function with an explicit application and command line.

Read more: The old new thing
QR: 10193473.aspx

Posted via email from Jasper-Net