NtCreateUserProcess returns XXXXXXXX

[nomi-san]

Commonly 0xC0000039 (STATUS_OBJECT_PATH_INVALID), this error status usually occurs on Windows 7/8.
NtCreateUserProcess is an undocumented function, so there is no good info about usage.

I just found the best way to detach the debugger when create process with flag DEBUG_ONLY_THIS_PROCESS to avoid IFEO recursion.

CreateProcessW(NULL, commandLine, NULL, NULL, FALSE,
  CREATE_SUSPENDED | DEBUG_ONLY_THIS_PROCESS, NULL, NULL, &si, &pi);

HANDLE hDebug;
if (0 <= NtQueryInformationProcess(pi.hProcess, ProcessDebugObjectHandle, &hDebug, sizeof(HANDLE), 0))
{
  NtRemoveProcessDebug(pi.hProcess, hDebug);
  NtClose(hDebug);
}