I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it asked for stuff directly from Kernel space). What I am curious about is:

1.) what is the 0xffffffff about. I know that this can be interpreted by some things as -1 (two's complement). Perhaps a pointer? Does anybody know the effect of this flag (normally I see 0x4 as the only argument to conhost.exe)?

2.) Are there possible security implications of finding conhost running with this flag in your enterprise windows environment?


The argument is the console application ID/session ID to which conhost should "connect" to. The value is mediated by csrss.

  • 2
    Thank you that was the point in the right direction that I needed. Per windows "If there is no session attached to the physical console, (for example, if the physical console session is in the process of being attached or detached), this function returns 0xFFFFFFFF."
    – DarkMatter
    Feb 22 '19 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.