Win7 OpenProcess失败问题

[hzy694358]

XP上正常，win7上会出现问题，提权了也一样的结果

	DWORD		lpidprocesses[1024],cbneeded,cprocesses;
	HANDLE		hprocess,hExplorer = NULL;
	HMODULE		hmodule;
	TCHAR		normalname[MAX_PATH]=_T("UnknownProcess");
	BOOL		bMonitor = FALSE;

	if(!EnumProcesses(lpidprocesses,sizeof(lpidprocesses),&cbneeded))
	{
		OutputDebugString(_T("EnumProcesses Error\n"));
		return -1;  
	}
	cprocesses=cbneeded/sizeof(DWORD);
	//
	for(UINT i=0;i<cprocesses;i++)
	{
		hprocess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,lpidprocesses[i]);
		if(hprocess)
		{
			if(EnumProcessModules(hprocess,&hmodule,sizeof(hmodule),&cbneeded))
			{
				        GetModuleBaseName(hprocess,hmodule,normalname,sizeof(normalname));
                            ……
			}
		}
		else
		{
			DWORD s = GetLastError();
			TCHAR szT[20] = {0};
			FILE *stream;
			_stprintf(szT,_T("Privilege8:%d\r\n"),s);
			if( (stream = fopen( "C:\\Privilege.txt", "a" )) != NULL )
			{
				fwrite(szT, sizeof(TCHAR), 20, stream);
				fclose( stream );
			}
		}
	}

结果一直打印如下内容：
P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 5

P r i v i l e g e 8 : 8 7

[九州剑王]

PROCESSENTRY32   pe32  =   {0};     
	hProcessSnap   =   CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);     
	if   (hProcessSnap   ==   INVALID_HANDLE_VALUE)     
		return   (FALSE);     

	pe32.dwSize   =   sizeof(PROCESSENTRY32);     

	if (Process32First(hProcessSnap,   &pe32))     
	{       
		do     
		{   CString exefile=pe32.szExeFile;
			CString paraname=lpName;
			if(!exefile.CompareNoCase(lpName))   
			{   
				HANDLE   hProcess   =   
					OpenProcess(PROCESS_QUERY_INFORMATION,   
					FALSE,pe32.th32ProcessID);   
				bRet   =   OpenProcessToken(hProcess,TOKEN_ALL_ACCESS,&hToken);   
				CloseHandle   (hProcessSnap);     
				return   (bRet);   
			}   
		}     
		while(Process32Next(hProcessSnap,&pe32));     
		bRet   =   TRUE;     
	}     

获取进程信息什么的我是上面做的，当时的代码

[hzy694358]

忘了备注一下： 我的代码是放在服务程序里的 服务是以SYSTEM权限在运行的

[hzy694358]

引用 8 楼 tiger9991 的回复:

上一下你的提权代码，里面应该有问题。

//提权
bool EnableDebugPrivilege()   
{   
	HANDLE hToken;   
	LUID sedebugnameValue;   
	TOKEN_PRIVILEGES tkp;   
	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
	{   
		return   FALSE;   
	}   
	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))  
	{   
		CloseHandle(hToken);   
		return false;   
	}   
	tkp.PrivilegeCount = 1;   
	tkp.Privileges[0].Luid = sedebugnameValue;   
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;   
	if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL)) 
	{   
		CloseHandle(hToken);   
		return false;   
	}   
	return true;   
}

[hzy694358]

看打印出来的信息，还有个错误码87：参数错误， 这个又是怎么回事呢？

[hzy694358]

为何会没有权限呢？？？？？

[九州剑王]

引用 3 楼 hzy694358 的回复:

为何会没有权限呢？？？？？

WIN7 session0 你应该百度下

[xumaojun]

If you do not have any control over the target process running account, enabling SE_DEBUG_NAME is essential. Withou SE_DEBUG_NAME, even your service runs under Administrator or LocalSystem account, you are not guaranteed with success. The DACL on the target process object is free to remove allow ACE for Administrators and LocalSystem. Since a lot of system Administrators tools need to OpenProcess to any process object, Windows created SE_DEBUG_NAME privilege as a back door for the Administrators. This cool privilege just bypasses the security checks on the process object. So SE_DEBUG_NAME is essential for system Administration tools.(Administrators group has this privilege by default) Please note that there is no such security back door for OpenProcessToken API, so the code runs under Administrators count may even fail while calling OpenProcessToken. I once wrote a security tool to query all the token information for all the processes in system, I find it OpenProcessToken will fail for some services.(These service tokens do not grant access to Administrators). Some kernel developers argue and believe that we should add a similiar SE_DEBUG_NAME privilege for OpenProcessToken API.

[xumaojun]

参考这篇文档： https://groups.google.com/forum/?fromgroups=#!topic/microsoft.public.platformsdk.security/DDsvZBx_fXY

[Eleven]

服务都统一在session 0，用户窗口在自己的用户session，服务获取不到，可以用一个普通应用程序来获取，然后传递给服务.

[傻X]

上一下你的提权代码，里面应该有问题。

[hzy694358]

引用 7 楼 VisualEleven 的回复:

服务都统一在session 0，用户窗口在自己的用户session，服务获取不到，可以用一个普通应用程序来获取，然后传递给服务.

如果是这样，那xp上的的程序是怎么在win7上兼容的呢？ 只要涉及到OpenProcess API 就失败…… 莫非只要调用了OpenProcess 的服务的程序都不能用了？

[ZhXinQ]

以管理员身份运行就可以了