c++ - 修改 DACL 以防止每个人在没有调试权限的情况下杀死进程

Question

我有一些我写的代码。我需要在Windows 10中修改DACL（安全描述符）以防止在没有用户调试权限的情况下终止进程。我该怎么做？我在互联网上学习了算法，为此寻找了一些功能，但过程仍然没有任何问题地关闭。我尝试调试了很多时间，代码可以正常工作，但没有成功。

我应该如何解决这个问题？对于下面的示例，我为 Denied PROCESS_TERMINATE 添加 ACE。这是正确的方式吗？

还建议我如何检查。我知道我会收到拒绝权限的消息框，是吗？

我的代码（ps更新）：

#include <iostream>
#include <Windows.h>
PSECURITY_DESCRIPTOR GetProcessSecurityDescriptor(HANDLE processHandle, DWORD &buffSizeNeeded);
void SecurityDescriptorModifier(HANDLE hProcess);

int main()
{
    DWORD pID;
    std::cin >> pID;

    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, pID);
    SecurityDescriptorModifier(processHandle);

    HANDLE pHandle = OpenProcess(PROCESS_TERMINATE, false, pID);

    return 0;
}



void SecurityDescriptorModifier(HANDLE hProcess)
{
    DWORD                 SIDLength = 0;
    PSID                 SID;
    PACL                 pACL;   
    PACL                 pNewAcl;
    BOOL                 bDaclExist;
    BOOL                 bDaclPresent;
    PSECURITY_DESCRIPTOR pSecurityDescriptor;
    PSECURITY_DESCRIPTOR pSecurityDescriptorNew;
    ACL_SIZE_INFORMATION aclSizeInfo;
    DWORD                 dwNewAclSize;
    ACCESS_ALLOWED_ACE*  pACE;
    PVOID                pTempAce;
    DWORD buffSizeNeeded = -1;


    // "everyone" group
    //CreateWellKnownSid(WinWorldSid, NULL, NULL, &SIDLength);
    // Allocate enough memory for the largest possible SID.
    SIDLength = SECURITY_MAX_SID_SIZE;
    if (!(SID = LocalAlloc(LMEM_FIXED, SIDLength)))
    {
        fprintf(stderr, "Could not allocate memory.\n");
        exit(1);
    }

    //SID = new byte[SECURITY_MAX_SID_SIZE];
    if (!CreateWellKnownSid(WinWorldSid, NULL, SID, &SIDLength))
    {
        fprintf(stderr,
            "CreateWellKnownSid Error %u",
            GetLastError());
        LocalFree(SID);
    }

    pSecurityDescriptor = GetProcessSecurityDescriptor(hProcess, buffSizeNeeded);

    BOOL executionResult = GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pACL, &bDaclExist);

    if(!executionResult)
    {
        fprintf(stderr, "GetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }

    pSecurityDescriptorNew = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buffSizeNeeded);

    if (pSecurityDescriptorNew == NULL)
        exit(1);
    else
        printf("Heap allocated for psdNew!\n");

    // Create a new security descriptor
    if (!InitializeSecurityDescriptor(pSecurityDescriptorNew, SECURITY_DESCRIPTOR_REVISION))
    {
        fprintf(stderr, "InitializeSecurityDescriptor() failed, error %d\n", GetLastError());
        exit(1);
    }

    // Obtain the DACL from the security descriptor
    if (!GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pACL, &bDaclExist))
    {
        fprintf(stderr, "GetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }

    // Initialize
    ZeroMemory(&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION));
    aclSizeInfo.AclBytesInUse = sizeof(ACL);


    // Call only if NULL DACL
    if (pACL != NULL)
    {
        // Determine the size of the ACL information
        if (!GetAclInformation(pACL, (LPVOID)& aclSizeInfo, sizeof(ACL_SIZE_INFORMATION), AclSizeInformation))
        {
            fprintf(stderr, "GetAclInformation() failed, error %d\n", GetLastError());
            exit(1);
        }
    }

    // Compute the size of the new ACL
    dwNewAclSize = aclSizeInfo.AclBytesInUse + sizeof(ACCESS_DENIED_ACE) + GetLengthSid(SID) - sizeof(DWORD);

    // Allocate buffer for the new ACL
    pNewAcl = (PACL)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwNewAclSize);

    if (pNewAcl == NULL)
        exit(1);

    // Initialize the new ACL
    if (!InitializeAcl(pNewAcl, dwNewAclSize, ACL_REVISION))
    {

        fprintf(stderr, "InitializeAcl() failed, error %d\n", GetLastError());
        exit(1);
    }
        static const DWORD dwPoison = PROCESS_TERMINATE;

    BOOL bResult = AddAccessDeniedAce(pNewAcl, ACL_REVISION, dwPoison, SID);

    if (FALSE == bResult)
    {
        printf("AddAccessDenied Error %d\n", GetLastError());
    }


    // If DACL is present, copy it to a new DACL
    if (!bDaclPresent)
    {
        // Copy the ACEs to the new ACL.
        if (aclSizeInfo.AceCount)
        {
            for (int i = 0; i < aclSizeInfo.AceCount; i++)
            {
                // Get an ACE.
                if (!GetAce(pACL, i, &pTempAce))
                {
                    fprintf(stderr, "GetAce() failed, error %d\n", GetLastError());
                    exit(1);
                }
                else
                    fprintf(stderr, "GetAce working\n");


                // Add the ACE to the new ACL.
                if (!AddAce(pNewAcl, ACL_REVISION, MAXDWORD, pTempAce, ((PACE_HEADER)pTempAce)->AceSize))
                {
                    fprintf(stderr, "AddAce() failed, error %d\n", GetLastError());
                    exit(1);
                }
                else
                    fprintf(stderr, "AddAce() is working!\n");
            }

        }

    }


    if (!SetSecurityDescriptorDacl(pSecurityDescriptorNew, TRUE, pNewAcl, FALSE))
    {
        printf("SetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }
    else
        printf("SetSecurityDescriptorDacl() is working!\n");

    // Set the new security descriptor for the window station
    if (!SetKernelObjectSecurity(hProcess, DACL_SECURITY_INFORMATION, pSecurityDescriptorNew))
    {
        printf("SetUserObjectSecurity() failed, error %d\n", GetLastError());
        exit(1);
    }
    else
        printf("SetUserObjectSecurity() is working!\n");
}


PSECURITY_DESCRIPTOR GetProcessSecurityDescriptor(HANDLE processHandle, DWORD &buffSizeNeeded)
{
    PSECURITY_DESCRIPTOR pSD = new byte[0];
    SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;

    // To understand actual needed size for pSD
    // GetKernelObject, what diff?
    GetKernelObjectSecurity(processHandle, si, pSD, 0, &buffSizeNeeded);

    if (buffSizeNeeded <= 0)
    {
        fprintf(stderr, ":GetKernelObjectSecurity ERROR: %u\n", GetLastError());
        exit(1);
    }

    pSD = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buffSizeNeeded);

    if (pSD == NULL)
        exit(1);
    else
        printf("Heap allocated for psdNew!\n");

    //Allocate Memory & get DACL
    if (!GetKernelObjectSecurity(processHandle, si, pSD, buffSizeNeeded, &buffSizeNeeded))
    {
        fprintf(stderr, ":GetKernelObjectSecurity(With Alloc) ERROR: %u\n", GetLastError());
        exit(1);
    }

    return pSD;
}