您的位置:首页 > 其它

程序启动进程特别是Win7远程桌面启动进程(备注)

2013-10-30 10:05 344 查看
BOOL StartProcess(int ProcessIndex)
{
     char pTemp[1024] ={0};
 
     sprintf(pTemp, "Enter func StartProcess");
     WriteWorkLog(pTemp);
 
     LPTSTR lpszpath;
     lpszpath = new
char[nBufferSize];
     memset(lpszpath,0x00,sizeof(lpszpath));
     DWORD dwSize = GetModuleFileName(NULL,lpszpath, nBufferSize);
     lpszpath[dwSize] =0;
     while(lpszpath[dwSize] !=
'\\'&& dwSize != 0)
     {
         lpszpath[dwSize] =0; dwSize--;
     }
 
     sprintf(pTemp, "Sub process work directory is %s", lpszpath);
     WriteWorkLog(pTemp);
 
     {
     //   sprintf(pTemp,"Enter func StartProcess");
     //   WriteWorkLog(pTemp);
 
     //   sprintf(pTemp,"Sub process name is is %s", ProcessNames[ProcessIndex]);
     //   WriteWorkLog(pTemp);
 
     //   // 为了显示更加复杂的用户界面,我们需要从Session 0创建
     //   // 一个进程,但是这个进程是运行在用户环境下。
     //   // 我们可以使用CreateProcessAsUser实现这一功能。
     //   BOOL bSuccess =FALSE;
     //   STARTUPINFO si;
     //   ZeroMemory(&si, sizeof(si) );
     //   si.cb =sizeof(si);
     //   si.dwFlags=STARTF_USESHOWWINDOW;
     //   si.wShowWindow=SW_SHOW;
 
     //   // 获得当前Session ID
     //   DWORD dwSessionID= WTSGetActiveConsoleSessionId();
 
     //   HANDLE hToken =NULL;
     //   // 获得当前Session的用户令牌
     //   if(WTSQueryUserToken(dwSessionID, &hToken) == FALSE)
     //   {
     //       sprintf(pTemp,"WTSQueryUserToken error!%d",GetLastError());
     //       WriteWorkLog(pTemp);
     //       goto Cleanup;
     //   }
     //   else
     //   {
     //       sprintf(pTemp,"dwSessionID = %d",dwSessionID);
     //       WriteWorkLog(pTemp);
     //   }
 
 
     //   // 复制令牌
     //   HANDLEhDuplicatedToken = NULL;
     //   if (DuplicateTokenEx(hToken,
     //       MAXIMUM_ALLOWED,NULL,
     //       SecurityIdentification,TokenPrimary,
     //       &hDuplicatedToken)== FALSE)
     //   {
     //       sprintf(pTemp,"DuplicateTokenEx error!%d",GetLastError());
     //       WriteWorkLog(pTemp);
     //       goto Cleanup;
     //   }
 
     //   // 创建用户Session环境
     //   LPVOIDlpEnvironment = NULL;
     //   if(CreateEnvironmentBlock(&lpEnvironment,
     //       hDuplicatedToken,FALSE) == FALSE)
     //   {
     //       sprintf(pTemp,"CreateEnvironmentBlock error!%d",GetLastError());
     //       WriteWorkLog(pTemp);
     //       goto Cleanup;
     //   }
 
 
     //   // 在复制的用户Session下执行应用程序,创建进程。
     //   // 通过这个进程,就可以显示各种复杂的用户界面了
     //   if(CreateProcessAsUser(hDuplicatedToken,
     //       ProcessNames[ProcessIndex],NULL, NULL, NULL, FALSE,                   
     //       NORMAL_PRIORITY_CLASS| CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT,
     //       lpEnvironment,NULL, &si, &pProcInfo[ProcessIndex]) == FALSE)
     //   {
     //       sprintf(pTemp,"CreateProcessAsUser error!%d",GetLastError());
     //       WriteWorkLog(pTemp);
     //       goto Cleanup;
     //   }
     //   else
     //   {
     //       sprintf(pTemp,"Sucto start program '%s'", ProcessNames[ProcessIndex]);
     //       WriteWorkLog(pTemp);
     //   }
 
     //   //CloseHandle(pProcInfo[ProcessIndex].hProcess);
     //   //CloseHandle(pProcInfo[ProcessIndex].hThread);
     //   bSuccess = TRUE;
 
     //   // 清理工作
 
     //Cleanup:
     //   if (!bSuccess)
     //   {
     //   }
 
     //   if (hToken !=NULL)
     //       CloseHandle(hToken);
     //   if(hDuplicatedToken != NULL)
     //       CloseHandle(hDuplicatedToken);
     //   if (lpEnvironment!= NULL)
     //       DestroyEnvironmentBlock(lpEnvironment);
 
     //   return 0;
 
         //********************************************
 
         //BOOL bSuccess=TRUE;
         //HANDLE hToken = NULL;
         //HANDLE hTokenDup = NULL;
         //do
         //{
         //   if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken))
         //   {
         //       if(DuplicateTokenEx(hToken,MAXIMUM_ALLOWED,NULL, SecurityIdentification, TokenPrimary, &hTokenDup))
         //       {
         //            DWORDdwSessionId = WTSGetActiveConsoleSessionId();
         //            if(!SetTokenInformation(hTokenDup,TokenSessionId,&dwSessionId,sizeof(DWORD)))
         //            {
         //                 sprintf(pTemp,"SetTokenInformationerror!error code:%d",GetLastError());
         //                 WriteWorkLog(pTemp);
         //                 bSuccess= FALSE;
         //                 break;
         //            }
 
         //            STARTUPINFOsi;
         //            ZeroMemory(&si,sizeof(STARTUPINFO));
         //            si.cb =sizeof(STARTUPINFO);
         //            si.lpDesktop= _T("WinSta0\\Default");
         //            si.wShowWindow= SW_SHOW;
         //            si.dwFlags     =  STARTF_USESHOWWINDOW /*|STARTF_USESTDHANDLES*/;
 
         //            LPVOIDpEnv = NULL;
         //            DWORDdwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT;
         //            if(!CreateEnvironmentBlock(&pEnv,hTokenDup,FALSE))
         //            {
         //                 sprintf(pTemp,TEXT("CreateEnvironmentBlockerror!error code:%d\n"),GetLastError());
         //                 bSuccess= FALSE;
         //                 break;
         //            }
 
         //       if(!CreateProcessAsUser(hTokenDup,ProcessNames[ProcessIndex],NULL,NULL,NULL,FALSE,dwCreationFlag,pEnv,NULL,&si,&pProcInfo[ProcessIndex]))
         //            {
         //                 sprintf(pTemp,TEXT("CreateProcessAsUsererror!error code:%d\n"),GetLastError());
         //                 bSuccess= FALSE;
         //                 break;
         //            }
 
         //            if(pEnv)
         //            {
         //                 DestroyEnvironmentBlock(pEnv);
         //            }
         //       }
         //       else
         //       {
         //            sprintf(pTemp,TEXT("DuplicateTokenExerror!error code:%d\n"),GetLastError());
         //            bSuccess= FALSE;
         //            break;
         //       }
 
 
         //   }
         //   else
         //   {
         //       sprintf(pTemp,TEXT("cannotget administror!error code:%d\n"),GetLastError());
         //       bSuccess =FALSE;
         //       break;
         //   }
         //}while(0);
 
         //if(hTokenDup != NULL && hTokenDup !=INVALID_HANDLE_VALUE)
         //   CloseHandle(hTokenDup);
         //if(hToken != NULL && hToken !=INVALID_HANDLE_VALUE)
         //   CloseHandle(hToken);
 
         //return bSuccess;
         //********************************************************************3************************************
         PROCESS_INFORMATION pi;
         STARTUPINFO si;
         BOOL bResult = FALSE;
         DWORD dwSessionId,winlogonPid;
         HANDLE hUserToken,hUserTokenDup,hPToken,hProcess;
         DWORD dwCreationFlags;
 
         // Log the client on to the local computer.
 
         dwSessionId = WTSGetActiveConsoleSessionId();
 
         sprintf(pTemp, "dwSessionId = %d",dwSessionId);
         WriteWorkLog(pTemp);
 
         //////////////////////////////////////////
         // Find the winlogon process
         ////////////////////////////////////////
 
         PROCESSENTRY32procEntry;
 
         HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
         if (hSnap == INVALID_HANDLE_VALUE)
         {
              return 1 ;
         }
 
         procEntry.dwSize = sizeof(PROCESSENTRY32);
 
         if (!Process32First(hSnap, &procEntry))
         {
              return 1 ;
         }
 
         do
         {
              if (_stricmp(procEntry.szExeFile,"explorer.exe") == 0)
              {
                   // We found a explorer.exe process...
                   //make sure it's running in the console session
                   DWORD winlogonSessId= 0;
                   if (ProcessIdToSessionId(procEntry.th32ProcessID,&winlogonSessId)/*&&winlogonSessId == dwSessionId*/)
                   {
                       sprintf(pTemp,
"winlogonSessId = %d",winlogonSessId);
                       WriteWorkLog(pTemp);
 
                       winlogonPid = procEntry.th32ProcessID;
                       dwSessionId=winlogonSessId;
                       break;
                   }
              }
 
         }while (Process32Next(hSnap, &procEntry));
 
          ////////////////////////////////////////////////////////////////////////
 
         WTSQueryUserToken(dwSessionId,&hUserToken);
         dwCreationFlags = NORMAL_PRIORITY_CLASS|CREATE_NEW_CONSOLE;
         ZeroMemory(&si,sizeof(STARTUPINFO));
         si.cb= sizeof(STARTUPINFO);
         si.lpDesktop = "winsta0\\default";
         si.wShowWindow = SW_SHOW;
         si.dwFlags     =   STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
         ZeroMemory(&pi,sizeof(pi));
         TOKEN_PRIVILEGES tp;
         LUID luid;
         hProcess = OpenProcess(MAXIMUM_ALLOWED,FALSE,winlogonPid);
 
          if(!::OpenProcessToken(hProcess,TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY
              |TOKEN_DUPLICATE|TOKEN_ASSIGN_PRIMARY|TOKEN_ADJUST_SESSIONID
              |TOKEN_READ|TOKEN_WRITE,&hPToken))
         {
              int abcd = GetLastError();
              printf("Processtoken open Error: %u\n",GetLastError());
         }
 
         if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid))
         {
              printf("LookupPrivilege value Error: %u\n",GetLastError());
         }
         tp.PrivilegeCount=1;
         tp.Privileges[0].Luid =luid;
         tp.Privileges[0].Attributes =SE_PRIVILEGE_ENABLED;
 
         DuplicateTokenEx(hPToken,MAXIMUM_ALLOWED,NULL,
              SecurityIdentification,TokenPrimary,&hUserTokenDup);
         int dup = GetLastError();
 
         //Adjust Token privilege
         SetTokenInformation(hUserTokenDup,
              TokenSessionId,(void*)dwSessionId,sizeof(DWORD));
 
         if (!AdjustTokenPrivileges(hUserTokenDup,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),
              (PTOKEN_PRIVILEGES)NULL,NULL))
         {
              int abc =GetLastError();
              printf("AdjustPrivilege value Error: %u\n",GetLastError());
         }
 
         if (GetLastError()==ERROR_NOT_ALL_ASSIGNED)
         {
              printf("Token doesnot have the provilege\n");
         }
 
         LPVOID pEnv =NULL;
 
         if(CreateEnvironmentBlock(&pEnv,hUserTokenDup,TRUE))
         {
              dwCreationFlags|=CREATE_UNICODE_ENVIRONMENT;
         }
         else
              pEnv=NULL;
 
         // Launch the process in the client's logon session.
 
         bResult = CreateProcessAsUser(
              hUserTokenDup,                    
//client's access token
              ProcessNames[ProcessIndex],   
// file toexecute
              NULL,                // command line
              NULL,           // pointer to process SECURITY_ATTRIBUTES
              NULL,              // pointer to thread SECURITY_ATTRIBUTES
              FALSE,             // handles are not inheritable
              dwCreationFlags,    // creation flags
              pEnv,              // pointer to new environment block
              lpszpath,               //name of current directory
              &si,              // pointer to STARTUPINFO structure
              &pProcInfo[ProcessIndex]               
//receives information about new process
              );
         // End impersonation of client.
 
         //GetLastError Shud be 0
 
         int iResultOfCreateProcessAsUser= GetLastError();
 
         //Perform All the Close Handles tasks
 
         CloseHandle(hProcess);
         CloseHandle(hUserToken);
         CloseHandle(hUserTokenDup);
         CloseHandle(hPToken);
     }
 
 
     delete [] lpszpath;
     lpszpath = NULL;
 
     return 0;
}
 
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: