空指针的乐园

独立寒秋，叹逝者如斯

日志

关于我

空指针

释名：指针在计算机领域是指一类表示内存地址的数据,空指针,就是指向未知内存地址的指针。我现在感觉我的前途就像空指针一样指向未知的远方。

文章分类

UAC编程

2011-09-13 16:14:17| 分类：笔记 | 标签： |举报 |字号大中小订阅

下载LOFTER 我的照片书 |

七、手动提升进程权限
shellExecutEx函数
BOOL ShellExecuteEx(LPSHELLEXECUTEINFO pExecInfo);
typedef struct _SHELLEXECUTEINFO {
DWORD cbSize;
ULONG fMask;
HWND hwnd;
PCTSTR lpVerb; // 必须设为runas
PCTSTR lpFile; // 提升后的权限启动一个可执行文件路径
PCTSTR lpParameters;
PCTSTR lpDirectory;
int nShow;
HINSTANCE hInstApp;
PVOID lpIDList;
PCTSTR lpClass;
HKEY hkeyClass;
DWORD dwHotKey;
union {
HANDLE hIcon;
HANDLE hMonitor;
} DUMMYUNIONNAME;
HANDLE hProcess;
} SHELLEXECUTEINFO,*LPSHELLEXECUTEINFO;
========================================================================
实用例子:
// Initialize the structure.
SHELLEXECUTEINFO sei = { sizeof(SHELLEXECUTEINFO) };
// Ask for privileges elevation.
sei.lpVerb = TEXT("runas");
// Create a Command Prompt fromwhich you will be able to start
// other elevated applications.
sei.lpFile = TEXT("cmd.exe");
// Don't forget this parameter; otherwise, the window will be hidden.
sei.nShow = SW_SHOWNORMAL;
if (!ShellExecuteEx(&sei)) {
DWORD dwStatus = GetLastError();
if (dwStatus == ERROR_CANCELLED) {
// The user refused to allow privileges elevation.
}
else
if (dwStatus == ERROR_FILE_NOT_FOUND) {
// The file defined by lpFile wasnot found and
// an error message popped up.
}
}
用户拒绝提升权限，shellExecutEx返回Flase，GetLastError通过使用一个ERROR_CANCELLED值来指出情况
当父进程以已经用shellExecutEx函数取得相关权限时,有继承权的子进程就不要在用CreateProcess函数
去申请同样释放权限，否则调用会失败的，GetLastError会返回 ERROR_ELEVATION_REQUIRED
八、何为当前权限上下文
我们可以通过GetProcessElevation函数来返回提升类型和一个指出进程是否正以管理员身份运行的布尔值。
BOOL GetProcessElevation(TOKEN_ELEVATION_TYPE* pElevationType, BOOL* pIsAdmin) {
HANDLE hToken = NULL;
DWORD dwSize;
// Get current process token
//获得当前的访问令牌
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
return(FALSE);
BOOL bResult = FALSE;
// Retrieve elevation type information
//函数检索一个指定的的访问令牌信息。可以读出是否是受限权限pElevationType，
//如果要判断一个用户是一个特定组的成员，使用 CheckTokenMembership 功能。
if (GetTokenInformation(hToken,TokenElevationType,
pElevationType, sizeof(TOKEN_ELEVATION_TYPE),&dwSize)) {
// Create the SID corresponding to the Administrators group
BYTE adminSID[SECURITY_MAX_SID_SIZE];
dwSize = sizeof(adminSID);
//CreateWellKnownSid创建预定义的sid
CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID,
&dwSize);
//如果以受限制权限运行的话。
if (*pElevationType == TokenElevationTypeLimited) {
// Get handle to linked token (will have one if we are lua)
HANDLE hUnfilteredToken = NULL;
GetTokenInformation(hToken, TokenLinkedToken, (VOID*)
&hUnfilteredToken, sizeof(HANDLE), &dwSize);
// Check if this original tokencontains admin SID
if (CheckTokenMembership(hUnfilteredToken, &adminSID, pIsAdmin)) {
bResult = TRUE;
}
// Don't forget to close the unfiltered token
CloseHandle(hUnfilteredToken);
} else {
*pIsAdmin = IsUserAnAdmin();
bResult = TRUE;
}
}
// Don't forget to close the process token
CloseHandle(hToken);
return(bResult);
}
其中GetTokenInformation使用的与进程关联的安全令牌和 TokenElevationType 参数获得提升类型，
提升类型的值由TOKEN_ELEVATION_TYPE 枚举类型来定义。
TOKEN_ELEVATION_TYPE 的值
值说明
TokenElevationTypeDefault 默认运行用户运行,UAC被禁用
TokenElevationTypeFull 权限被成功提升,而且令牌没有被筛选过
TokenElevationTypeLimited 进程以受限的权限运行,它对应于一个筛选过的令牌
根据这些值我们可以知道进程在运行时使用的令牌时候被涮选过。下一步是判断用户是否是管理员。如果令牌没有被帅选过。为了知道是否正在以管理员的身份运行。IsUserAnAdmin函数最理想。在令牌被帅选的情况下。我们需要获取未帅选的令牌（把TokenLinkedToken传给GetToKenInfomation）,然后判断其中时候包含一个管理员SID(借助CreateWellKnownSid和CheckTokenMembership)

评论这张

转发至微博

阅读(1777)| 评论(0)

历史上的今天

this.p={  m:2,
              b:2,
              loftPermalink:'',
              id:'fks_087067084080089066082083081066072095081065092087095070',
              blogTitle:'UAC编程',
              blogAbstract:'七、手动提升进程权限<br /\>   shellExecutEx函数<br /\>BOOL ShellExecuteEx(LPSHELLEXECUTEINFO pExecInfo);<br /\>typedef struct _SHELLEXECUTEINFO {<br /\>    DWORD cbSize;<br /\>    ULONG fMask;<br /\>    HWND hwnd;<br /\>    PCTSTR lpVerb;      // 必须设为runas<br /\>    PCTSTR lpFile;      // 提升后的权限启动一个可执行文件路径<br /\>    PCTSTR lpParameters;<br /\>    PCTSTR lpDirectory;<br /\>    int nShow;<br /\>    HINSTANCE hInstApp;',
              blogTag:'',
              blogUrl:'blog/static/9028195201181341417421',
              isPublished:1,
              istop:false,
              type:0,
              modifyTime:0,
              publishTime:1315901657421,
              permalink:'blog/static/9028195201181341417421',
              commentCount:0,
              mainCommentCount:0,
              recommendCount:0,
              bsrk:-100,
              publisherId:0,
              recomBlogHome:false,
              currentRecomBlog:false,
              attachmentsFileIds:[],
              vote:{},
              groupInfo:{},
              friendstatus:'none',
              followstatus:'unFollow',
              pubSucc:'',
              visitorProvince:'',
              visitorCity:'',
              visitorNewUser:false,
              postAddInfo:{},
              mset:'000',
              mcon:'',
              srk:-100,
              remindgoodnightblog:false,
              isBlackVisitor:false,
              isShowYodaoAd:false,
              hostIntro:'释名：指针在计算机领域是指一类表示内存地址的数据,空指针,就是指向未知内存地址的指针。我现在感觉我的前途就像空指针一样指向未知的远方。',
              hmcon:'0',
              selfRecomBlogCount:'0',
              lofter_single:'<iframe width="140" height="560" style="overflow:hidden;" src="http://www.lofter.com/mailEntry.do?blogad=1&blog" frameBorder="0"></iframe>'
            }

{list a as x}
    {if !!x}
    <div class="iblock nbw-fce nbw-f40">
      <a class="fc03 noul" target="_blank" hidefocus="true" href="http://blog.163.com/${x.visitorName}/">
      {if x.visitorName==visitor.userName}
      <img alt="${x.visitorNickname|escape}" onerror="this.src=location.f40" class="cwd bdwa bdc0" src="${fn1(x.visitorName)}&r=${visitor.imageUpdateTime}"/>
      {else}
      <img alt="${x.visitorNickname|escape}" onerror="this.src=location.f40" class="cwd bdwa bdc0" src="${fn1(x.visitorName)}"/>
      {/if}
      </a>
      <div class="cwd vname thide">
        {if x.moveFrom=='wap'}
          <a class="noul pnt" target="_blank" href="http://blog.163.com/services/wapblog.html?frompersonalbloghome"><span title="来自网易手机博客" class="iblock wapIcon"> </span></a>
        {elseif x.moveFrom=='iphone'}
          <a class="noul pnt" target="_blank"><span title="来自iPhone客户端" class="iblock iphoneIcon"> </span></a>
        {elseif x.moveFrom=='android'}
          <a class="noul pnt" target="_blank"><span title="来自Android客户端" class="iblock androidIcon"> </span></a>
        {elseif x.moveFrom=='mobile'}
          <a class="noul pnt" target="_blank" href="http://blog.163.com/services/emsblog.html?frompersonalbloghome"><span title="来自网易短信写博" class="iblock wapIcon"> </span></a>
        {/if}
        <a class="fc03 m2a"  target="_blank" hidefocus="true" href="http://blog.163.com/${x.visitorName}/">
          ${fn(x.visitorNickname,8)|escape}
        </a>
      </div>
    </div>
    {/if}
    {/list}

<#--最新日志，群博日志--> <#--推荐日志-->

<p class="fc06">推荐过这篇日志的人：</p>
    <div>
      {list a as x}
      {if !!x}
      <div class="iblock nbw-fce nbw-f40">
        <a class="fc03 noul" target="_blank" hidefocus="true" href="http://blog.163.com/${x.recommenderName}/">
        <img alt="${x.recommenderNickname|escape}" onerror="this.src=location.f40" class="cwd bdwa bdc0" src="${fn1(x.recommenderName)}"/>
        </a>
        <div class="cwd thide">
          <a class="fc03 m2a" target="_blank" hidefocus="true" href="http://blog.163.com/${x.recommenderName}/">
            ${fn(x.recommenderNickname,6)|escape}
          </a>
        </div>
      </div>
      {/if}
      {/list}
    </div>
    {if !!b&&b.length>0}
    <p  class="fc06">他们还推荐了：</p>
    <ul>
    {list b as y}
      {if !!y}
        <li class="rrb"><span class="iblock">·</span><a class="fc03 m2a" target="_blank" href="http://blog.163.com/${y.recommendBlogPermalink}/?from=blog/static/9028195201181341417421">${y.recommendBlogTitle|escape}</a></li>
      {/if}
    {/list}
    </ul>
    {/if}

<#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇，下一篇--> <#-- 热度 -->

{list a as x}
    {if !!x}
    <div class="hotItem iblock nbw-fce nbw-f40">
      <a class="fc03 noul" target="_blank" hidefocus="true" href="http://blog.163.com/${x.publisherUsername}/">
      {if x.publisherUsername==visitor.userName}
      <img alt="${x.publisherNickname|escape}" onerror="this.src=location.f40" class="cwd bdwa bdc0" src="${fn1(x.publisherUsername)}&r=${visitor.imageUpdateTime}"/>
      {else}
      <img alt="${x.publisherNickname|escape}" onerror="this.src=location.f40" class="cwd bdwa bdc0" src="${fn1(x.publisherUsername)}"/>
      {/if}
      </a>
      <div class="cwd vname thide">
        <a class="fc03 m2a"  target="_blank" hidefocus="true" href="http://blog.163.com/${x.publisherUsername}/">
          ${fn(x.publisherNickname,8)|escape}
        </a>
      </div>
      <a class="f-myLikeIcons hottype {if x.type==1} js-liketype{elseif x.type==2} js-reblogtype{elseif x.type==3} js-sharetype{else}{/if}" target="_blank" hidefocus="true" href="http://blog.163.com/${x.publisherUsername}/"> </a>
    </div>
    {/if}
    {/list}

<#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->

页脚

我的照片书 - 手机博客 - 下载LOFTER APP - 订阅此博客

空指针的乐园

导航

日志

UAC编程

历史上的今天

最近读者

热度

评论

页脚