Win7中如何在服务中启动一个当前用户的进程——函数CreateProcessAsUser()的一次使用记录 - Alvin Huang - 博客园

110 [DllImport(“Wtsapi32.dll”, EntryPoint = “WTSQueryUserToken”, SetLastError = true)] 111 private static extern bool WTSQueryUserToken(uint SessionId, ref IntPtr hToken);

来源: Win7中如何在服务中启动一个当前用户的进程——函数CreateProcessAsUser()的一次使用记录 – Alvin Huang – 博客园

这次工作中遇到要从服务中启动一个具有桌面UI交互的应用,这在winXP/2003中只是一个简单创建进程的问题。但在Vista 和 win7中增加了session隔离,这一操作系统的安全举措使得该任务变得复杂了一些。

一、Vista和win7的session隔离

一个用户会有一个独立的session。在Vista 和 win7中session 0被单独出来专门给服务程序用,用户则使用session 1、session 2…

这样在服务中通过CreateProcess()创建的进程启动UI应用用户是无法看到的。它的用户是SYSTEM。所以用户无法与之交互,达不到需要的目的。

关于更多session 0的信息请点击这里查看微软介绍。

 

二、实现代码

首先贴出自己的实现代码,使用的是C#

复制代码
  1 using System;
  2 using System.Security;
  3 using System.Diagnostics;
  4 using System.Runtime.InteropServices;
  5 
  6 namespace Handler
  7 {
  8     /// <summary>
  9     /// Class that allows running applications with full admin rights. In
 10     /// addition the application launched will bypass the Vista UAC prompt.
 11     /// </summary>
 12     public class ApplicationLoader
 13     {
 14         #region Structures
 15 
 16         [StructLayout(LayoutKind.Sequential)]
 17         public struct SECURITY_ATTRIBUTES
 18         {
 19             public int Length;
 20             public IntPtr lpSecurityDescriptor;
 21             public bool bInheritHandle;
 22         }
 23 
 24         [StructLayout(LayoutKind.Sequential)]
 25         public struct STARTUPINFO
 26         {
 27             public int cb;
 28             public String lpReserved;
 29             public String lpDesktop;
 30             public String lpTitle;
 31             public uint dwX;
 32             public uint dwY;
 33             public uint dwXSize;
 34             public uint dwYSize;
 35             public uint dwXCountChars;
 36             public uint dwYCountChars;
 37             public uint dwFillAttribute;
 38             public uint dwFlags;
 39             public short wShowWindow;
 40             public short cbReserved2;
 41             public IntPtr lpReserved2;
 42             public IntPtr hStdInput;
 43             public IntPtr hStdOutput;
 44             public IntPtr hStdError;
 45         }
 46 
 47         [StructLayout(LayoutKind.Sequential)]
 48         public struct PROCESS_INFORMATION
 49         {
 50             public IntPtr hProcess;
 51             public IntPtr hThread;
 52             public uint dwProcessId;
 53             public uint dwThreadId;
 54         }
 55 
 56         #endregion
 57 
 58         #region Enumerations
 59 
 60         enum TOKEN_TYPE : int
 61         {
 62             TokenPrimary = 1,
 63             TokenImpersonation = 2
 64         }
 65 
 66         enum SECURITY_IMPERSONATION_LEVEL : int
 67         {
 68             SecurityAnonymous = 0,
 69             SecurityIdentification = 1,
 70             SecurityImpersonation = 2,
 71             SecurityDelegation = 3,
 72         }
 73 
 74         #endregion
 75 
 76         #region Constants
 77 
 78         //public const int TOKEN_DUPLICATE = 0x0002;
 79         public const uint MAXIMUM_ALLOWED = 0x2000000;
 80         public const int CREATE_NEW_CONSOLE = 0x00000010;
 81         public const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;
 82 
 83         public const int NORMAL_PRIORITY_CLASS = 0x20;
 84         //public const int IDLE_PRIORITY_CLASS = 0x40;        
 85         //public const int HIGH_PRIORITY_CLASS = 0x80;
 86         //public const int REALTIME_PRIORITY_CLASS = 0x100;
 87 
 88         #endregion
 89 
 90         #region Win32 API Imports  
 91 
 92         [DllImport("Userenv.dll", EntryPoint = "DestroyEnvironmentBlock", 
 93                                     SetLastError = true)]
 94         private static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment);
 95 
 96         [DllImport("Userenv.dll", EntryPoint = "CreateEnvironmentBlock", 
 97                                     SetLastError = true)]
 98         private static extern bool CreateEnvironmentBlock(ref IntPtr lpEnvironment, 
 99                                                     IntPtr hToken, bool bInherit);
100 
101         [DllImport("kernel32.dll", EntryPoint = "CloseHandle", SetLastError = true)]
102         private static extern bool CloseHandle(IntPtr hSnapshot);
103 
104         [DllImport("kernel32.dll", EntryPoint = "WTSGetActiveConsoleSessionId")]
105         static extern uint WTSGetActiveConsoleSessionId();
106 
107         [DllImport("Kernel32.dll", EntryPoint = "GetLastError")]
108         private static extern uint GetLastError();
109 
110         [DllImport("Wtsapi32.dll", EntryPoint = "WTSQueryUserToken", SetLastError = true)]
111         private static extern bool WTSQueryUserToken(uint SessionId, ref IntPtr hToken);
112 
113         [DllImport("advapi32.dll", EntryPoint = "CreateProcessAsUser", SetLastError = true,
114                                     CharSet = CharSet.Unicode, 
115                                     CallingConvention = CallingConvention.StdCall)]
116         public extern static bool CreateProcessAsUser(IntPtr hToken, 
117                                                       String lpApplicationName,
118                                                       String lpCommandLine, 
119                                                       ref SECURITY_ATTRIBUTES lpProcessAttributes,
120                                                       ref SECURITY_ATTRIBUTES lpThreadAttributes, 
121                                                       bool bInheritHandle, 
122                                                       int dwCreationFlags, 
123                                                       IntPtr lpEnvironment, 
124                                                       String lpCurrentDirectory,
125                                                       ref STARTUPINFO lpStartupInfo,
126                                                       out PROCESS_INFORMATION lpProcessInformation);
127 
128         [DllImport("advapi32.dll", EntryPoint = "DuplicateTokenEx")]
129         public extern static bool DuplicateTokenEx(IntPtr ExistingTokenHandle, uint dwDesiredAccess,
130             ref SECURITY_ATTRIBUTES lpThreadAttributes, int TokenType,
131             int ImpersonationLevel, ref IntPtr DuplicateTokenHandle);
132         
133         #endregion
134 
135         /// <summary>
136         /// Launches the given application with full admin rights, and in addition bypasses the Vista UAC prompt
137         /// </summary>
138         /// <param name="commandLine">A command Line to launch the application</param>
139         /// <param name="procInfo">Process information regarding the launched application that gets returned to the caller</param>
140         /// <returns></returns>
141         public static bool StartProcessAndBypassUAC(String commandLine, out PROCESS_INFORMATION procInfo)
142         {
143             IntPtr hUserTokenDup = IntPtr.Zero, hPToken = IntPtr.Zero, hProcess = IntPtr.Zero;            
144             procInfo = new PROCESS_INFORMATION();
145 
146             // obtain the currently active session id; every logged on user in the system has a unique session id
147             uint dwSessionId = WTSGetActiveConsoleSessionId();
148 
149             if (!WTSQueryUserToken(dwSessionId, ref hPToken))
150             {
151                 return false;
152             }
153 
154             SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
155             sa.Length = Marshal.SizeOf(sa);
156 
157             // copy the access token of the dwSessionId's User; the newly created token will be a primary token
158             if (!DuplicateTokenEx(hPToken, MAXIMUM_ALLOWED, ref sa, (int)SECURITY_IMPERSONATION_LEVEL.SecurityIdentification,
159                 (int)TOKEN_TYPE.TokenPrimary, ref hUserTokenDup))
160             {
161                 CloseHandle(hPToken);
162                 return false;
163             }
164 
165             IntPtr EnvironmentFromUser = IntPtr.Zero;
166             if (!CreateEnvironmentBlock(ref EnvironmentFromUser, hUserTokenDup, false))
167             {
168                 CloseHandle(hPToken);
169                 CloseHandle(hUserTokenDup);
170                 return false;
171             }
172            
173             // By default CreateProcessAsUser creates a process on a non-interactive window station, meaning
174             // the window station has a desktop that is invisible and the process is incapable of receiving
175             // user input. To remedy this we set the lpDesktop parameter to indicate we want to enable user 
176             // interaction with the new process.
177             STARTUPINFO si = new STARTUPINFO();
178             si.cb = (int)Marshal.SizeOf(si);
179             si.lpDesktop = @"winsta0\default";
180  
181             // flags that specify the priority and creation method of the process
182             int dwCreationFlags = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT;
183 
184             // create a new process in the current user's logon session
185             bool result = CreateProcessAsUser(hUserTokenDup,        // client's access token
186                                             null,                   // file to execute
187                                             commandLine,            // command line
188                                             ref sa,                 // pointer to process SECURITY_ATTRIBUTES
189                                             ref sa,                 // pointer to thread SECURITY_ATTRIBUTES
190                                             false,                  // handles are not inheritable
191                                             dwCreationFlags,        // creation flags
192                                             EnvironmentFromUser,    // pointer to new environment block 
193                                             null,                   // name of current directory 
194                                             ref si,                 // pointer to STARTUPINFO structure
195                                             out procInfo            // receives information about new process
196                                             );
197            
198             // invalidate the handles
199             CloseHandle(hPToken);
200             CloseHandle(hUserTokenDup);
201             DestroyEnvironmentBlock(EnvironmentFromUser);
202 
203             return result; // return the result
204         }
205     }
206 }
复制代码

 

三、几个遇到的问题

  1.环境变量

起初用CreateProcessAsUser()时并没有考虑环境变量,虽然要的引用在桌面起来了,任务管理器中也看到它是以当前用户的身份运行的。进行一些简单的操作也没有什么问题。但其中有一项操作发生了问题,打开一个该程序要的特定文件,弹出如下一些错误:

Failed to write: %HOMEDRIVE%%HOMEPATH%\…

Location is not avaliable: …

通过Browser打开文件夹命名看看到文件去打不开!由于该应用是第三方的所以不知道它要做些什么。但是通过Failed to write: %HOMEDRIVE%%HOMEPATH%\…这个错误信息显示它要访问一个user目录下的文件。在桌面用cmd查看该环境变量的值为:

HOMEDRIVE=C:

HOMEPATH=\users\Alvin

的确是要访问user目录下的文件。然后我编写了一个小程序让CreateProcessAsUser()来以当前用户启动打印环境变量,结果其中没有这两个环境变量,及值为空。那么必然访问不到了,出这些错误也是能理解的了。其实CreateProcessAsUser()的环境变量参数为null的时候,会继承父进程的环境变量,即为SYSTEM的环境变量。在MSDN中有说:

使用CreateEnvironmentBlock()函数可以得到指定用户的环境变量,不过还是略有差别——没有一下两项:

PROMPT=$P$G

SESSIONNAME=Console

这个原因我就不清楚了,求告知。

  值得注意的是,产生的环境变量是Unicode的字符时dwCreationFlags 要有CREATE_UNICODE_ENVIRONMENT标识才行,在MSDN中有解释到:

An environment block can contain either Unicode or ANSI characters. If the environment block pointed to by lpEnvironment contains Unicode characters, be sure thatdwCreationFlags includes CREATE_UNICODE_ENVIRONMENT. If this parameter is NULL and the environment block of the parent process contains Unicode characters, you must also ensure that dwCreationFlags includes CREATE_UNICODE_ENVIRONMENT.

C#中字符char、string都是Unicode字符。而且这里的CreateEnvironmentBlock()函数在MSDN中有说到,是Unicode的:

lpEnvironment [in, optional]

A pointer to an environment block for the new process. If this parameter is NULL, the new process uses the environment of the calling process.

 

2.一个比较奇怪的问题

按以上分析后我加入了环境变量,并添加了CREATE_UNICODE_ENVIRONMENT标识。但是我觉得这是不是也应该把CreateProcessAsUser()的DllImport中的CharSet = CharSet.Ansi改为CharSet = CharSet.Unicode。这似乎合情合理,但是改完之后进程就起不来,且没有错误。一旦改回去就完美运行,并且没有环境变量的问题。想了半天也没有搞明白是为什么,最后问了一个前辈,他要我注意下CreateProcessAsUser()的第三个参数的声明,然后我一琢磨才知道问题的真正原因,大家先看CreateProcessAsUser()的函数声明:

注意第二、三个参数的区别,并查看我写的代码。我用的是第三个参数,第二个我赋null。LPCTSTR是一个支持自动选择字符编码[Ansi或Unicode]  的常量字符串指针;LPTSTR与之的差别是不是常量。它为什么有这样的差别呢,看MSDN的解释:

The system adds a null character to the command line string to separate the file name from the arguments. This divides the original string into two strings for internal processing.

在第二个参数为空时,可以用第三个参数完成AppName和CmdLineArg的功能,方法是添加一个null进行分割。那么这为什么能导致函数不起作用呢?原因是C#中string类型是只读的,在我这里给它的赋值是string类型。它不能完成分割的动作,所以会造成访问违例。这其实在MSDN中都有相关的描述:

The Unicode version of this function, CreateProcessAsUserW, can modify the contents of this string. Therefore, this parameter cannot be a pointer to read-only memory (such as a const variable or a literal string). If this parameter is a constant string, the function may cause an access violation.

那么为什么用CharSet = CharSet.Ansi可以呢?LPTSTR支持两种字符格式,它会自动将Unicode的字符串转变为Ansi的字符串,即产生另外一个Ansi的字符串,该字符串是复制来的当然可以修改了!!哈哈!

这里可以看出认认真真看好MSDN的解释是很有帮助的。顺便说下这第三个参数分割办法,以及我们要注意自己的路径。来看MSDN的说明:

The lpApplicationName parameter can be NULL. In that case, the module name must be the first white space–delimited token in the lpCommandLine string. If you are using a long file name that contains a space, use quoted strings to indicate where the file name ends and the arguments begin; otherwise, the file name is ambiguous. For example, consider the string “c:\program files\sub dir\program name”. This string can be interpreted in a number of ways. The system tries to interpret the possibilities in the following order:

c:\program.exe files\sub dir\program name
c:\program files\sub.exe dir\program name
c:\program files\sub dir\program.exe name
c:\program files\sub dir\program name.exe

 

关于CreateProcessAsUser()详细信息请查看http://msdn.microsoft.com/en-us/library/ms682429.aspx

关于CreateEnvironmentBlock()请查看http://msdn.microsoft.com/en-us/library/bb762270(VS.85).aspx

赞(0) 打赏
分享到: 更多 (0)

觉得文章有用就打赏一下文章作者

支付宝扫一扫打赏

微信扫一扫打赏