Name: Anonymous 2009-06-23 18:52
http://msdn.microsoft.com/en-us/library/ms682623(VS.85).aspx
>If OpenProcess fails, the output shows the process name as <unknown>. For example, OpenProcess fails for the Idle and CSRSS processes because their access restrictions prevent user-level code from opening them.
I'm able to access only liek 70% of SYSTEM's processes on PROCESS_QUERY_LIMITED_INFORMATION / PROCESS_QUERY_INFORMATION. Very well.
But...
How does default taskmgr.exe access these secured processes like csrss, displaying all the info about them as if it had PROCESS_ALL_ACCESS granted? After all, it's just an application, additional tool for end users, not any sort of integral kernel part. I don't think I have to remind you that it executes on user's account privileges.
>If OpenProcess fails, the output shows the process name as <unknown>. For example, OpenProcess fails for the Idle and CSRSS processes because their access restrictions prevent user-level code from opening them.
I'm able to access only liek 70% of SYSTEM's processes on PROCESS_QUERY_LIMITED_INFORMATION / PROCESS_QUERY_INFORMATION. Very well.
But...
How does default taskmgr.exe access these secured processes like csrss, displaying all the info about them as if it had PROCESS_ALL_ACCESS granted? After all, it's just an application, additional tool for end users, not any sort of integral kernel part. I don't think I have to remind you that it executes on user's account privileges.