Create a process from a driver

Question

Is there a way to create a user-mode process from kernel-mode on Windows NT platform (XP-W7)?

EDIT: I must install only the driver. This is a specific of the project.

Answer 1

To create a valid win32 process the driver must communicate with CSRSS (what is completely undocumented). So I ended up by queuing a user-mode APC and allocating virtual memory for the APC code in the context of the existing win32 process (that code will call CreateProcess and do the job).

It is a tricky way but it works.

Answer 2

I don't know an easier way to achieve this. But what about having a Windows service running which makes an overlapped DeviceIoControl into your driver? On return the service could examine the data it has received from the driver and start the according application.