我试图枚举所有正在运行的进程 EXE 名称，但在 XP 来宾帐户上尝试此操作时遇到了麻烦。我可以使用 EnumProcesses 枚举所有进程 ID，但是当我尝试使用 PROCESS_QUERY_INFORMATION 或 PROCESS_VM_READ OpenProcess 时，该函数失败。
我在 XP Guest 帐户下启动了 Process Explorer，它能够枚举所有进程名称（尽管正如预期的那样，来自 Guest 用户空间之外的进程的大多数其他信息不存在）。
所以，我的问题是，如何复制 Process Explorer 魔法来获取在来宾帐户用户空间之外运行的服务和其他进程的进程名称？
I'm attempting to enumerate all running process EXE names, and have stumbled when attempting this on the XP Guest account. I am able to enumerate all Process IDs using EnumProcesses, but when I attempt OpenProcess with PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, the function fails.
I fired up Process Explorer under the XP Guest account, and it was able to enumerate all process names (though as expected, most other information from processes outside the Guest user-space was not present).
So, my question is, how can I duplicate the Process Explorer magic to get the process names of services and other processes running outside the Guest account user-space?
发布评论
评论（4）
我认为 Process Explorer 使用 NtQuerySystemInformation 与参数
SystemProcessInformation来获取进程列表。有关代码示例，请参阅我的旧答案。此外，函数 NtQueryInformationProcess 将用于获取附加信息。顺便说一句，如果您在 Dependency Walker 下启动 Process Explorer（菜单“Profile”/“Start Profiling”或F7）然后您将看到 Process Explorer 真正使用 NTDLL.DLL 的所有函数。您可以看到 NtQuerySystemInformation 和 NtQueryInformationProcess将真正被使用。
I suppose that the Process Explorer use NtQuerySystemInformation with parameter
SystemProcessInformationto get the list of processes. For the code example see my old answer. Additionally the function NtQueryInformationProcess will be used to get additional information.By the way, if you start Process Explorer under Dependency Walker (menu "Profile" / "Start Profiling" or F7) then you will see all functions which Process Explorer really use from NTDLL.DLL. You can see that NtQuerySystemInformation and NtQueryInformationProcess will be really used.
NtQuerySystemInformation 几乎没有记录，并且“可能会在未来版本的 Windows 中更改或不可用” CreateToolhelp32Snapshot 已完整记录，并且应该为您提供图像名称。
NtQuerySystemInformation is only barely documented and "may be altered or unavailable in future versions of Windows" CreateToolhelp32Snapshot is fully documented and should give you the image name.
当进程启动时，它被分配一组基本的访问权限。某些 API 调用需要额外的权限才能成功完成。具体来说，
OpenProcess<在某些情况下，/a> 可能需要SeDebugPrivilege权限。您可以在此处找到如何修改进程令牌以启用其他权限的示例：在 C++ 中启用和禁用权限。When a process starts, it is assigned a basic set of access privileges. Certain API calls require additional privileges to complete successfully. Specifically,
OpenProcesscan require theSeDebugPrivilegeprivilege in certain cases. You can find an example of how to modify your process token to enable additional privileges here: Enabling and Disabling Privileges in C++.从 Vista 开始，
GetProcessImageFileName仅需要 PROCESS_QUERY_LIMITED_INFORMATION，但在 XP 上它确实需要 PROCESS_QUERY_INFORMATION。您不应该需要，而且绝对不应该能够从来宾帐户获取 PROCESS_VM_READ。
GetProcessImageFileNameonly needs PROCESS_QUERY_LIMITED_INFORMATION starting with Vista, but on XP it does need PROCESS_QUERY_INFORMATION.You shouldn't need, and definitely shouldn't be able to get from a guest account, PROCESS_VM_READ.