OpenProcessToken这个函数用法

http://www.vckbase.com/document/viewdoc/?id=687

OpenProcessToken FunctionThe OpenProcessToken function opens the access token associated with a process.
BOOL WINAPI OpenProcessToken(
  __in          HANDLE ProcessHandle,
  __in          DWORD DesiredAccess,
  __out         PHANDLE TokenHandle
);Parameters
ProcessHandle
A handle to the process whose access token is opened. The process must have the PROCESS_QUERY_INFORMATION access permission.DesiredAccess
Specifies an access mask that specifies the requested types of access to the access token. These requested access types are compared with the discretionary access control list (DACL) of the token to determine which accesses are granted or denied. For a list of access rights for access tokens, see Access Rights for Access-Token Objects.TokenHandle
A pointer to a handle that identifies the newly opened access token when the function returns.Return Value
If the function succeeds, the return value is nonzero.If the function fails, the return value is zero. To get extended error information, call GetLastError.Res
Close the access token handle returned through the TokenHandle parameter by calling CloseHandle.Requirements
Client
Requires Windows Vista, Windows XP, Windows 2000 Professional, or Windows NT Workstation.

Server
Requires Windows Server 2008, Windows Server 2003, Windows 2000 Server, or Windows NT Server.

Header
Declared in Winbase.h; include Windows.h.

Library
Use Advapi32.lib.

DLL
Requires Advapi32.dll.

BOOL bRet = FALSE ;
HANDLE hToken = NULL ;
LUID luid = { 0 } ;
TOKEN_PRIVILEGES NewTokenPrivileges = { 0 } ;
TOKEN_PRIVILEGES preTokenPrivileges = { 0 } ;
DWORD dwRetLen = 0 ; __try
{
bRet = OpenProcessToken(GetCurrentProcess() , TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY , &hToken ) ;
if (!bRet)
__leave ; bRet = LookupPrivilegeValue(NULL , SE_DEBUG_NAME, &luid ) ;
if (!bRet)
__leave ; NewTokenPrivileges.PrivilegeCount = 1 ;
NewTokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED ;
NewTokenPrivileges.Privileges[0].Luid = luid ;
bRet = AdjustTokenPrivileges(hToken , FALSE , &NewTokenPrivileges , sizeof(preTokenPrivileges) ,
&preTokenPrivileges , &dwRetLen) ;
if (!bRet)
__leave ;
}
__finally
{
if (hToken)
{
CloseHandle(hToken) ;
hToken = NULL ;
}
} return bRet ;

主要用来配合进程提权。BOOL ImprovePrivilege()                                         //将进程提权
{
    HANDLE hToken = NULL ;                              //令牌句柄
    BOOL bRet = FALSE;                                      //返回执行结果
    TOKEN_PRIVILEGES tp = {1, {0, 0, SE_PRIVILEGE_ENABLED}};   //填充权限令牌结构    LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);   //查询是否具有调试权限
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken); //打开进程权限令牌
    AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof tp, 0, 0);    //为进程申请 DEBUG 权限
    bRet = (GetLastError() == ERROR_SUCCESS);                //检测是否执行成功
    return bRet;
}

void RaisePrivilege()
{
HANDLE hToken;
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken))
{
if(LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid))
{
AdjustTokenPrivileges(hToken,FALSE,&tp,NULL,NULL,0);
}
}
if(hToken)
CloseHandle(hToken);
}打开的token不用时要CloseHandle。

//********************提升进程权限*****************************//
HANDLE hToken;
if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
{
TOKEN_PRIVILEGES tkp;
LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid ); //修改进程权限
tkp.PrivilegeCount=1;
tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL ); //通知系统修改进程权限
}
//*************************************************************//

调试易

OpenProcessToken这个函数用法

解决方案 »