There's some special handling when loading the image where it does different things depending on the value of the subsystem field, but I don't know whether ther

There's some special handling when loading the image where it does different things depending on the value of the subsystem field, but I don't know whether there's any special handling in the kernel that can't be duplicated by using the native api. But the NT kernel does very little when it comes to initializing new processes, most of the initialization is done in user space by ntdll, so it seems unlikely. Anyways the cygwin guys claim to have forked processes with ZwCreateProcess, but just had problems with getting it to work with the win32 subsystem: http://www.cygwin.com/ml/cygwin-developers/2011-04/msg00034.html http://www.cygwin.com/ml/cygwin-developers/2011-04/msg00034.... Also this guy seems to have managed to do it: http://stackoverflow.com/questions/10657699/cant-use-createprocess-in-child-process-using-simulating-fork-code-on-windows-7 http://stackoverflow.com/questions/10657699/cant-use-createp..., but it hang when he called a win32 function (CreateProcess) from the child.