DuplicateHandle：需要OpenProcess，但访问被拒绝
我使用 Windows 挂钩向应用程序发送消息，系统上的每个应用程序都会向应用程序通知有关 Windows 事件的信息。
为了执行消息参数的编组，我使用共享内存。外部进程调用 DuplicateHandle，但用于共享我的应用程序实例的句柄，它将调用 OpenProcess 具有 PROCESS_DUP_HANDLE 权限要求。
实际上，每个应用程序都可以使用此架构发送消息，即使我需要向外部进程启用 SeDebugPrivilege。它实际上是有效的，除了“explorer”进程之外，它没有 SeDebugPrivilege 令牌...
AdjustTokenPrivileges 函数无法向访问令牌添加新权限。它只能启用或禁用令牌的现有权限。要确定令牌的权限，请调用 GetTokenInformation 函数。
所以，问题是...如何将 SeDebugPrivilege 令牌添加到“explorer”进程，或者如何允许“explorer”进程调用 OpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)？
Using windows hooks I send messages to my application, which is notified about Windows events by every application on the system.
To execute marshal of the message parameters, I use shared memories. The external process calls DuplicateHandle, but for sharing the handle with my application instance, it shall call OpenProcess with PROCESS_DUP_HANDLE privilege requirements.
Actually every application is able to send messages using this architecture, even if I need to enable SeDebugPrivilege to the external process. It actually works, except for the 'explorer' process, which doesn't have the SeDebugPrivilege token...
The documentation of AdjustTokenPrivileges states:
The AdjustTokenPrivileges function cannot add new privileges to the access token. It can only enable or disable the token's existing privileges. To determine the token's privileges, call the GetTokenInformation function.
So, the question is... how to add the SeDebugPrivilege token to 'explorer' process, or alternatively, how to allow 'explorer' process to call OpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不明白你为什么不使用命名共享内存。如果您的共享内存对象有名称，则可以在不使用
DuplicateHandle的情况下打开该对象。如果您确实必须使用
DuplicateHandle并且需要能够在任何进程内部使用OpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)我发现您不应该使用SeDebugPrivilege。相反，您应该向每个人pId授予PROCESS_DUP_HANDLE权限以进行该进程。如果创建进程，则可以指定安全描述符。如果进程已创建，您可以使用OpenProcess、GetSecurityInfo（请参阅 http://msdn.microsoft.com/en-us/library/aa446654.aspx) 和SetSecurityInfo修改进程的安全描述符。要测试此方法，您只需启动 Process Explorer（请参阅 http://technet. microsoft.com/en-us/sysinternals/bb896653.aspx）具有管理权限，打开所选进程（带有
pId的进程）的安全选项卡并修改其安全描述符。之后，所有进程都可以使用OpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)，而无需启用SeDebugPrivilege。I don't understand why you don't use named shared memory. If your shared memory objects have a name, then this objects can be opened without the usage of
DuplicateHandle.If you do have to use
DuplicateHandleand need be able to useOpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)inside of any process I find that you should don't useSeDebugPrivilege. Instead of that you should grant permission ofPROCESS_DUP_HANDLEto everyone for the process withpId. If you create a process you can specify security descriptor. If the process is already created you can useOpenProcess,GetSecurityInfo(see http://msdn.microsoft.com/en-us/library/aa446654.aspx) andSetSecurityInfoto modify security descriptor of the process.To test this approach you can just start Process Explorer (see http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx) with administrative rights, open Security tab of the selected process (process with
pId) and modify its security descriptor. After that all processes will be able to useOpenProcess(PROCESS_DUP_HANDLE, FALSE, pId)without to enableSeDebugPrivilege.这就是你想要实现的目标吗？
如果我理解正确，那么您不需要打开您的应用程序的句柄申请过程完全。相反，只需为共享内存块指定一个确定性名称，例如 SharedMem_XXX，其中 XXX 是外部进程的 PID。然后，使用窗口消息将 PID 发送到您的应用程序。然后它可以重新创建该名称并使用它来打开共享内存块。
Is this what you're trying to accomplish?
If I've understood correctly, then you don't need to open the handle to your application process at all. Instead, just give the shared memory block a deterministic name, such as SharedMem_XXX where XXX is the PID of the external process. Then, send the PID to your application using a window message. It can then recreate the name and use it to open the shared memory block.