c++ - DuplicateHandle: need to OpenProcess, but the access is denied -
I send a message in my application using the hooks of windows, which are notified about each event on the system about the Windows event is done.
To execute the martial of the message parameters, I use shared memories. I call the external process, but to share the handle with my application frequency, it will call with PROCESS_DUP_HANDLE privilege requirements.
Actually every application is capable of sending messages using this architecture, even if I need to enable SeDebugPrivilege. External process actually works except for the 'Explorer' process, in which the Siebiebog prizele Do not have a token ...
State Documents:
AdjustmentTokiwalge Function Can not Add New Privileges for Access TokenAccording to the current privileges of this token Can enable or disable. To determine the token's privileges, call the GetTokenInformation function. So, the question is ... How to add SeDebugPrivilege token to the 'explorer' process, or alternatively, how to allow explorer to call the process
OpenProcess ( PROCESS_DUP_HANDLE, FALSE, pId)
?
I do not understand why you use Named shared memory If your shared memory is the name of objects, then this object can be opened without the use of duplicateHandle
.
If you have to use duplicate handles
and need to be able to use OpenProcess (PROCESS_DUP_HANDLE, FALSE, pId)
inside any process I think you should not use the SeDebugPrivilege
. Instead you should do this for all of Approval PROCESS_DUP_HANDLE
for the process with pId
. If you create a process you can specify a security descriptor. If the process has already been created, you can modify the code for the OpenProcess
, GetSecurityInfo
(see) and SetSecurityInfo
to modify the security descriptor of the process Can be used.
To test this approach, you can only start the process explorer (see) with administrative rights, open the Security tab of the selected process (with pId
) Process) and its security descriptor. After that, to enable all the process OpenProcess (PROCESS_DUP_HANDLE, FALSE, pId)
, SeDebugPrivilege
.
Comments
Post a Comment