9

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it asked for stuff directly from Kernel space). What I am curious about is:

1.) what is the 0xffffffff about. I know that this can be interpreted by some things as -1 (two's complement). Perhaps a pointer? Does anybody know the effect of this flag (normally I see 0x4 as the only argument to conhost.exe)?

2.) Are there possible security implications of finding conhost running with this flag in your enterprise windows environment?

Improve this question

1 Answer 1

Reset to default
6

The argument is the console application ID/session ID to which conhost should "connect" to. The value is mediated by csrss.

Improve this answer
1
  • 3
    Thank you that was the point in the right direction that I needed. Per windows "If there is no session attached to the physical console, (for example, if the physical console session is in the process of being attached or detached), this function returns 0xFFFFFFFF."
    – DarkMatter
    Feb 22, 2019 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .