怎样判断当前进程是否系统进程？

[Garfield]

如题

[薛定谔之死猫]

关注

[bianliuwei]

关注

[DentistryDoctor]

OpenProcessTocken to get username
NT AUTHORITY\SYSTEM,NT AUTHORITY\NETWORK SERVICE,NT AUTHORITY\LOCAL SERVICE为系统进程?

[DentistryDoctor]

TCHAR User[UNLEN + 1];
TCHAR Domain[DNLEN + 1];
DWORD cchUser;
DWORD cchDomain;

LPTSTR UserName = User;
LPDWORD cchUserName = &cchUser;
LPTSTR DomainName = Domain;
LPDWORD cchDomainName = &cchDomain;

HANDLE hToken = NULL;

#define MY_BUFSIZE 512 // 定义最大缓冲长度

UCHAR InfoBuffer[ MY_BUFSIZE ];
DWORD cbInfoBuffer = MY_BUFSIZE;

SID_NAME_USE snu;
BOOL bSuccess;

BOOL bRet = FALSE;

if(!OpenProcessToken(hProcess, TOKEN_QUERY, &hToken )) {
cout<<"!OpenProcessToken(GetCurrentProcess()"<<endl;
return -1;
}
bSuccess = GetTokenInformation(hToken, TokenUser, InfoBuffer, cbInfoBuffer, &cbInfoBuffer);
if(!bSuccess) {
cout<<"GetTokenInformation failed"<<endl;
return -1;
}
else {
// 控制台程序中该函数调用总是失败???
bRet = LookupAccountSid(NULL, ((PTOKEN_USER)InfoBuffer)->User.Sid, UserName, cchUserName, DomainName, cchDomainName, &snu );
if (!bRet) {
LPVOID lpMsgBuf;
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
GetLastError(),
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // 默认语言
(LPTSTR) &lpMsgBuf,
0,
NULL
);

TCHAR temp[80];
sprintf(temp,"出错信息 GetLastError() = %d",GetLastError());

// 显示 lpMsgBuf 缓冲中的信息.
// ...
MessageBox( NULL, (LPCTSTR)lpMsgBuf, temp, MB_OK | MB_ICONINFORMATION );
// Free the buffer.
LocalFree( lpMsgBuf );

cout<<"LookupAccountSid failed"<<endl;
CloseHandle(hToken);
return -1;
}
else {
cout << DomainName << "\n" << UserName << endl;
}
}