Process privileges in windows
1
Name:
Anonymous
2009-06-23 18:52
http://msdn.microsoft.com/en-us/library/ms682623(VS.85).aspx
>If OpenProcess fails, the output shows the process name as <unknown>. For example, OpenProcess fails for the Idle and CSRSS processes because their access restrictions prevent user-level code from opening them.
I'm able to access only liek 70% of SYSTEM's processes on PROCESS_QUERY_LIMITED_INFORMATION / PROCESS_QUERY_INFORMATION. Very well.
But...
How does default taskmgr.exe access these secured processes like csrss, displaying all the info about them as if it had PROCESS_ALL_ACCESS granted? After all, it's just an application, additional tool for end users, not any sort of integral kernel part. I don't think I have to remind you that it executes on user's account privileges.
2
Name:
Anonymous 2009-06-23 18:59
Magic
3
Name:
Anonymous
2009-06-23 19:34
use linux
4
Name:
Anonymous 2009-06-23 19:43
>>3
man it's not an answer
5
Name:
Anonymous
2009-06-23 21:26
use DTrace
6
Name:
Anonymous
2009-06-24 2:20
>>4
[RYDER@^_^~:] man it's not an answer
7
Name:
Anonymous 2009-06-24 2:28
>>1
taskmgr makes uses of internal "undocumented"(documented in plenty of places, including Microsoft's own places, but there's a big red disclaimer stating that APIs may be subject to change in future versions of NT) NT APIs like NtQuerySystemInformation, NtOpenThread, NtShutdownSystem and others. If you want to see how that works, just use a debugger or disassembler, it's very simple. Using an API monitor is also a (crappier) solution if you really suck at x86 assembly. There are also a lot of non-MS tools which implement the same functionality as taskmgr, and more ( prcview, procexp, lord pe, pe tools, and so on ). Google more next time, or do your own research.
8
Name:
Anonymous 2009-06-24 2:30
>>7
continuation:
http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/System%20Information/Structures/SYSTEM_PROCESS_INFORMATION.html
show the specific structure you need to request from NtQuerySystemInformation. The documented, but limited way to get similar information is to use toolhelp32 snapshots.
9
Name:
Anonymous 2009-06-24 3:42
Thank you, your answer helped me alot. I didn't even think about using debugger which is so goddamn obvious now.
12
Name:
Anonymous
2013-04-22 22:26
aye
13
Name:
FFP
2013-04-23 11:32
check your privilege!
14
Name:
Anonymous
2013-04-23 11:34
eteurtuy67jr67u46werbh serhsthsu6 646 464ws4554eww5454w5ae4
15
Name:
Anonymous
2013-04-23 13:58
16
Name:
Anonymous
2013-04-23 14:08
17
Name:
Anonymous
2013-04-23 14:18
18
Name:
Anonymous
2013-04-23 14:36
19
Name:
Anonymous
2013-04-23 14:47
20
Name:
Anonymous
2013-04-24 0:27
21
Name:
Anonymous
2013-04-24 0:33
22
Name:
Anonymous
2013-04-24 0:39
23
Name:
Anonymous
2013-04-24 0:45
24
Name:
Anonymous
2013-04-24 0:56
25
Name:
Anonymous
2013-04-24 1:01
26
Name:
Anonymous
2013-04-24 1:13
27
Name:
Anonymous
2013-04-24 12:43
28
Name:
Anonymous
2013-04-24 12:48
29
Name:
Anonymous
2013-04-24 12:54
30
Name:
Anonymous
2013-04-24 13:00
31
Name:
Anonymous
2013-04-24 13:05