char cmdLine[] = "cmd";
 // Create the child process.
 bFuncRetn = CreateProcess(NULL,
        cmdLine,  // command line
        NULL,   // process security attributes
        NULL,   // primary thread security attributes
        TRUE,   // handles are inherited
        0,     // creation flags
        NULL,   // use parent's environment
        NULL,   // use parent's current directory
        &siStartInfo, // STARTUPINFO pointer
        &piProcInfo); // receives PROCESS_INFORMATION

 CHAR cmds[] = "@ECHO OFF\n"
     "cd..\n"
     "dir\n"

#include <stdio.h>
#include <windows.h>
#define BUFSIZE 4096
HANDLE hChildStdinRd, hChildStdinWr, hChildStdinWrDup,
  hChildStdoutRd, hChildStdoutWr, hChildStdoutRdDup,
  hInputFile, hStdout;
BOOL CreateChildProcess(VOID);
VOID WriteToPipe(VOID);
VOID ReadFromPipe(VOID);
VOID ErrorExit(const char *);
VOID ErrMsg(LPTSTR, BOOL);
int main(int argc, char *argv[]) {
 // SECURITY_ATTRIBUTES結(jié)構(gòu)包含一個(gè)對(duì)象的安全描述符，并指定檢索到指定這個(gè)結(jié)構(gòu)的句柄是否是可繼承的。
 // 這個(gè)結(jié)構(gòu)為很多函數(shù)創(chuàng)建對(duì)象時(shí)提供安全性設(shè)置
 SECURITY_ATTRIBUTES saAttr;
 BOOL fSuccess;
 // Set the bInheritHandle flag so pipe handles are inherited.
 // 設(shè)置句柄為可繼承的，使得子線程可以使用父線程
 saAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
 saAttr.bInheritHandle = TRUE;
 saAttr.lpSecurityDescriptor = NULL;
 // Get the handle to the current STDOUT.
 // 取得當(dāng)前應(yīng)用的標(biāo)準(zhǔn)輸出句柄，對(duì)于Windows控制臺(tái)應(yīng)用來說，一般是輸出到屏幕
 hStdout = GetStdHandle(STD_OUTPUT_HANDLE);
 // Create a pipe for the child process's STDOUT.
 // 創(chuàng)建一個(gè)用于輸出操作的匿名管道。
 if (! CreatePipe(&hChildStdoutRd, &hChildStdoutWr, &saAttr, 0))
  ErrorExit("Stdout pipe creation failed\n");
 // Create noninheritable read handle and close the inheritable read handle.
 // 將輸出管道的句柄綁定到當(dāng)前進(jìn)程
 fSuccess = DuplicateHandle(GetCurrentProcess(), hChildStdoutRd,
        GetCurrentProcess(), &hChildStdoutRdDup , 0,
        FALSE,
        DUPLICATE_SAME_ACCESS);
 if( !fSuccess )
  ErrorExit("DuplicateHandle failed");
 CloseHandle(hChildStdoutRd);
 // Create a pipe for the child process's STDIN.
 // 創(chuàng)建一個(gè)用于輸入操作的匿名管道。
 if (! CreatePipe(&hChildStdinRd, &hChildStdinWr, &saAttr, 0))
  ErrorExit("Stdin pipe creation failed\n");
 // Duplicate the write handle to the pipe so it is not inherited.
 // 將輸入管道的句柄綁定到當(dāng)前進(jìn)程
 fSuccess = DuplicateHandle(GetCurrentProcess(), hChildStdinWr,
        GetCurrentProcess(), &hChildStdinWrDup, 0,
        FALSE,     // not inherited
        DUPLICATE_SAME_ACCESS);
 if (! fSuccess)
  ErrorExit("DuplicateHandle failed");
 CloseHandle(hChildStdinWr);
 // Now create the child process.
 // 創(chuàng)建DOS子進(jìn)程
 fSuccess = CreateChildProcess();
 if (! fSuccess)
  ErrorExit("Create process failed");
 // Write to pipe that is the standard input for a child process.
 WriteToPipe();
 // Read from pipe that is the standard output for child process.
 ReadFromPipe();
 return 0;
}
BOOL CreateChildProcess() {
 PROCESS_INFORMATION piProcInfo;
 STARTUPINFO siStartInfo;
 BOOL bFuncRetn = FALSE;
 // Set up members of the PROCESS_INFORMATION structure.
 ZeroMemory( &piProcInfo, sizeof(PROCESS_INFORMATION) );
 // Set up members of the STARTUPINFO structure.
 // 設(shè)定DOS進(jìn)程的標(biāo)準(zhǔn)輸入、輸出和錯(cuò)誤信息的管道
 // 使用前面創(chuàng)建的值，DOS窗口的輸入輸出都會(huì)被定向到本應(yīng)用中
 ZeroMemory( &siStartInfo, sizeof(STARTUPINFO) );
 siStartInfo.cb = sizeof(STARTUPINFO);
 siStartInfo.hStdError = hChildStdoutWr;
 siStartInfo.hStdOutput = hChildStdoutWr;
 siStartInfo.hStdInput = hChildStdinRd;
 siStartInfo.dwFlags |= STARTF_USESTDHANDLES;
 char cmdLine[] = "cmd";
 // Create the child process.
 bFuncRetn = CreateProcess(NULL,
        cmdLine,  // command line
        NULL,   // process security attributes
        NULL,   // primary thread security attributes
        TRUE,   // handles are inherited
        0,    // creation flags
        NULL,   // use parent's environment
        NULL,   // use parent's current directory
        &siStartInfo, // STARTUPINFO pointer
        &piProcInfo); // receives PROCESS_INFORMATION
 if (bFuncRetn == 0)
  ErrorExit("CreateProcess failed");
 else {
  CloseHandle(piProcInfo.hProcess);
  CloseHandle(piProcInfo.hThread);
  return bFuncRetn;
 }
}
VOID WriteToPipe(VOID) {
 DWORD dwRead, dwWritten;
 CHAR chBuf[BUFSIZE];
 CHAR cmds[] = "@ECHO ON\n"
     "cd..\n"
     "dir\n"; 
 WriteFile(hChildStdinWrDup, cmds, sizeof(cmds), &dwWritten, NULL);
 // Close the pipe handle so the child process stops reading.
 if (! CloseHandle(hChildStdinWrDup))
  ErrorExit("Close pipe failed");
}
VOID ReadFromPipe(VOID) {
 DWORD dwRead, dwWritten;
 CHAR chBuf[BUFSIZE];
 // Close the write end of the pipe before reading from the
 // read end of the pipe.
 if (!CloseHandle(hChildStdoutWr))
  ErrorExit("CloseHandle failed");
 // Read output from the child process, and write to parent's STDOUT.
 // 獲取子線程，即DOS窗口的輸出，顯示到標(biāo)準(zhǔn)輸出設(shè)備上
 for (;;) {
  if( !ReadFile( hChildStdoutRdDup, chBuf, BUFSIZE, &dwRead,
      NULL) || dwRead == 0) break;
  if (! WriteFile(hStdout, chBuf, dwRead, &dwWritten, NULL))
   break;
 }
}

VOID ErrorExit (const char *lpszMessage) {
 fprintf(stderr, "%s\n", lpszMessage);
 ExitProcess(0);
}