0

我想获得主令牌，以便我可以访问 OpenInputDesktop() 并做我必要的事情。

我浏览了所有站点以寻求帮助，并找到了如下的结论性代码，但是在调用DuplicateTokenEx () is 998 时出现错误，这意味着对内存位置的访问无效。

 HANDLE GetCurrentUserToken()
{
    HANDLE currentToken = 0;
    PHANDLE primaryToken = 0;

    unsigned int winlogonPid = 0;

    int dwSessionId = 0;
    PHANDLE hUserToken = 0;
    PHANDLE hTokenDup = 0;

    PWTS_SESSION_INFO pSessionInfo = 0;
    DWORD dwCount = 0;

    WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, 
                         &pSessionInfo, &dwCount);

    //TestLog("Error on WTSEnumerateSessions(): %d",GetLastError());

    int dataSize = sizeof(WTS_SESSION_INFO);

    for (DWORD i = 0; i < dwCount; ++i)
    {
        WTS_SESSION_INFO si = pSessionInfo[i];
        if (WTSActive == si.State)
        {
            dwSessionId = si.SessionId;
            break;
        }
    }

    WTSFreeMemory(pSessionInfo);

    array<Process^>^localByName = Process::GetProcessesByName( "winlogon" );


    for (int i=0;i<localByName->Length;i++)
    {
        Process ^ p1 = (Process^)(localByName->GetValue(i));

        if ((unsigned int)p1->SessionId == dwSessionId)
        {
            winlogonPid = (unsigned int)p1->Id;
        }
    }

    // obtain a handle to the winlogon process
    HANDLE hProcess = OpenProcess(MAXIMUM_ALLOWED, false, winlogonPid);
    TestLog("Error on OpenProcess():",GetLastError());

    // obtain a handle to the access token of the winlogon process
    if (!OpenProcessToken(hProcess, TOKEN_DUPLICATE, &currentToken))
    {
        TestLog("Error on OpenProcessToken():",GetLastError());
        CloseHandle(hProcess);
        return false;
    }

    BOOL bRet ;
    // bRet = DuplicateTokenEx(currentToken,
    //         MAXIMUM_ALLOWED /*TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS*/, 
    //         NULL/*0*/, 
    //         SecurityImpersonation, TokenImpersonation, primaryToken);

    bRet = DuplicateTokenEx(currentToken, 
                            TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS, 
                            NULL, SecurityImpersonation, 
                            TokenPrimary, primaryToken);

    TestLog("Error on DuplicateTokenEx():",GetLastError());
    TestLog("return value of DuplicateTokenEx()",bRet);

    int errorcode = GetLastError();
    if (bRet == false)
    {
        return 0;
    }

    return primaryToken;
}

int main(array<System::String ^> ^args)
{
    Console::WriteLine(L"Hello World");

    TestLog("**Start TestLaunchExeOneTime**",0);
    HANDLE hTokenNew = NULL, hTokenDup = NULL;
    HMODULE  hmod = LoadLibrary(L"kernel32.dll");

    hTokenDup = GetCurrentUserToken();

    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    memset(&si,0,sizeof(STARTUPINFO));
    si.cb = sizeof( STARTUPINFO );
    si.lpDesktop = L"winsta0\\default";

    LPVOID  pEnv = NULL;
    DWORD dwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
    HMODULE hModule = LoadLibrary(L"Userenv.dll");
    if(hModule )
    {
        if(CreateEnvironmentBlock(&pEnv,hTokenDup,FALSE))
        {
            //WriteToLog("CreateEnvironmentBlock Ok");
            dwCreationFlag |= CREATE_UNICODE_ENVIRONMENT;    
        }
        else
        {
            TestLog("Error on CreateEnvironmentBlock():",GetLastError());
            pEnv = NULL;
        }
    }

    //

    if ( !CreateProcessAsUser( hTokenDup,
        NULL,
        L"C:\\temp\\DesktopDuplicationmilliseconds.exe",  
        NULL,
        NULL,
        FALSE,
        dwCreationFlag,
        pEnv,
        NULL,
        &si,
        &pi
        ))
    {

    }
    else
    {
        TestLog("Error on CreateProcessAsUser():",GetLastError());
        // printf("error : %d",GetLastError());
    }

    return 0;
}
4

1 回答 1

1

您尚未为主令牌分配任何内存。primaryToken 变量是指向句柄的指针，但实际上您并没有将它指向任何东西。（您还声明GetCurrentUserToken了一个返回句柄的函数，但实际上返回的是指向句柄的指针。）

您需要为句柄显式分配内存：

primaryToken = malloc(sizeof(HANDLE));

[...]

return *primaryToken;

或者，更明智的是，将 primaryToken 定义为 HANDLE 而不是指针，并在适当的位置传递对它的引用：

HANDLE primaryToken;

[...]

bRet = DuplicateTokenEx(currentToken, 
                        TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS, 
                        NULL, SecurityImpersonation, 
                        TokenPrimary, &primaryToken);
于 2012-11-01T20:27:02.270 回答