diff --git a/include/ntapi/nt_process.h b/include/ntapi/nt_process.h
index 5792529..a58e616 100644
--- a/include/ntapi/nt_process.h
+++ b/include/ntapi/nt_process.h
@@ -474,6 +474,10 @@ typedef struct _nt_runtime_data {
 	int32_t		srv_type;
 	int32_t		srv_subtype;
 	uint32_t	srv_keys[6];
+	nt_guid		tty_guid;
+	int32_t		tty_type;
+	int32_t		tty_subtype;
+	uint32_t	tty_keys[6];
 	nt_guid		grp_guid;
 	int32_t		grp_type;
 	int32_t		grp_subtype;
diff --git a/include/ntapi/nt_tty.h b/include/ntapi/nt_tty.h
index b0d9205..4ed536f 100644
--- a/include/ntapi/nt_tty.h
+++ b/include/ntapi/nt_tty.h
@@ -83,6 +83,7 @@ typedef enum _nt_tty_opcode {
 
 typedef enum _nt_tty_session_type {
 	NT_TTY_SESSION_PRIMARY,
+	NT_TTY_SESSION_SECONDARY,
 	NT_TTY_SESSION_PRIVATE
 } nt_tty_session_type;
 
@@ -352,7 +353,8 @@ typedef int32_t __stdcall	ntapi_tty_create_session(
 	__out	nt_port_name *		port_name,
 	__in	nt_tty_session_type	type,
 	__in	const nt_guid *		guid		__optional,
-	__in	wchar16_t *		image_name	__optional);
+	__in	wchar16_t *		image_name	__optional,
+	__in	void *			htty		__optional);
 
 
 typedef int32_t __stdcall	ntapi_tty_join_session(
diff --git a/src/tty/ntapi_tty_create_session.c b/src/tty/ntapi_tty_create_session.c
index 3f8f1d7..e878160 100644
--- a/src/tty/ntapi_tty_create_session.c
+++ b/src/tty/ntapi_tty_create_session.c
@@ -28,10 +28,15 @@ int32_t __stdcall __ntapi_tty_create_session(
 	__out	nt_port_name *		port_name,
 	__in	nt_tty_session_type	type,
 	__in	const nt_guid *		guid		__optional,
-	__in	wchar16_t *		image_name	__optional)
+	__in	wchar16_t *		image_name	__optional,
+	__in	void *			htty		__optional)
 {
 	nt_status			status;
 	ntapi_internals *		__internals;
+	void *				shport;
+	nt_port_name			sport_name;
+	nt_tty_server_basic_info	ttyinfo;
+	nt_iosb				iosb;
 
 	nt_port_attr			port_attr;
 	nt_runtime_data			ssattr;
@@ -53,6 +58,9 @@ int32_t __stdcall __ntapi_tty_create_session(
 	__ntapi->tt_aligned_block_memset(
 		&port_attr,0,sizeof(port_attr));
 
+	__ntapi->tt_aligned_block_memset(
+		&ssattr,0,sizeof(ssattr));
+
 	switch (type) {
 		case NT_TTY_SESSION_PRIMARY:
 			port_attr.type    = NT_PORT_TYPE_SUBSYSTEM;
@@ -69,6 +77,21 @@ int32_t __stdcall __ntapi_tty_create_session(
 
 			break;
 
+		case NT_TTY_SESSION_SECONDARY:
+			port_attr.type    = NT_PORT_TYPE_SUBSYSTEM;
+			port_attr.subtype = NT_PORT_SUBTYPE_DEFAULT;
+
+			if (!hport)
+				hport = &shport;
+
+			if (!port_name)
+				port_name = &sport_name;
+
+			if (!image_name)
+				image_name = __tty_image_name_fallback;
+
+			break;
+
 		case NT_TTY_SESSION_PRIVATE:
 			port_attr.type    = NT_PORT_TYPE_SUBSYSTEM;
 			port_attr.subtype = NT_PORT_SUBTYPE_PRIVATE;
@@ -98,10 +121,30 @@ int32_t __stdcall __ntapi_tty_create_session(
 		port_name,
 		&port_attr);
 
-	/* subsystem attributes */
-	__ntapi->tt_aligned_block_memset(
-		&ssattr,0,sizeof(ssattr));
+	/* parent session) */
+	if (htty && (htty != NT_INVALID_HANDLE_VALUE)) {
+		if ((status = __ntapi->tty_query_information_server(
+				htty,&iosb,
+				&ttyinfo,sizeof(ttyinfo),
+				NT_TTY_SERVER_BASIC_INFORMATION)))
+			return status;
 
+		ssattr.tty_type		= ttyinfo.attr.type;
+		ssattr.tty_subtype	= ttyinfo.attr.subtype;
+
+		ssattr.tty_keys[0]	= ttyinfo.attr.keys.key[0];
+		ssattr.tty_keys[1]	= ttyinfo.attr.keys.key[1];
+		ssattr.tty_keys[2]	= ttyinfo.attr.keys.key[2];
+		ssattr.tty_keys[3]	= ttyinfo.attr.keys.key[3];
+		ssattr.tty_keys[4]	= ttyinfo.attr.keys.key[4];
+		ssattr.tty_keys[5]	= ttyinfo.attr.keys.key[5];
+
+		__ntapi->tt_guid_copy(
+			&ssattr.tty_guid,
+			&ttyinfo.attr.guid);
+	}
+
+	/* subsystem attributes */
 	ssattr.srv_type		= port_attr.type;
 	ssattr.srv_subtype	= port_attr.subtype;
 	ssattr.srv_keys[0]	= port_attr.keys.key[0];
@@ -133,6 +176,7 @@ int32_t __stdcall __ntapi_tty_create_session(
 
 	params.image_name	= image_name;
 	params.rtblock		= &rtblock;
+	params.hsession		= htty;
 
 	if ((status = __ntapi->tt_create_native_process(&params)))
 		return status;