Click here to Skip to main content
12,454,612 members (56,878 online)
Click here to Skip to main content
Add your own
alternative version

Stats

53.5K views
673 downloads
30 bookmarked
Posted

Creating a Process with Medium Integration Level from the Process with High Integration Level in Vista

, 26 Jan 2008 CPOL
Rate this:
Please Sign up or sign in to vote.
This tip suggests the way of launching a process with Medium IL from the process with High IL.

Introduction

Since Windows Vista introduced process integration level (IL), it sometimes is highly desired to be specified when creating a new process. This tip suggests the way of launching a process with Medium IL from the process with High IL.

Background

There are the several reasons to specify IL explicitly when launching a new process.

  • The most common task is to launch the application at the end of the installation. It’s usual for an application to be executed without elevation, but installer always runs with High IL, therefore the child process will start with the same (High) IL, unless additional enforcement is specified by a developer.
  • If a part of the application is loaded as DLL into explorer.exe, it’s required for the application to execute with the same IL as explorer.exe.
  • If an application consists of a number of processes which sends messages to each others, all the processes must have the same IL.
  • If an application connects to the object in ROT, it must have the same IL as the server which registered the object.

There are some solutions for this problem. Kenny Kerr in his article Windows Vista for Developers – A New Series suggests to create a new token and correct the elevation level for it, however this is not a complete solution because the set of privileges will still correspond to the set of the parent process. Also, the created process doesn't refer to ROT correctly.

The most correct way is explained in the following articles:

However, this way requires to utilize an external DLL (one DLL for 32-bits caller and another one DLL for 64-bits caller).

Solution

This tip suggests a direct way of launching a process with Medium IL from the process with High IL. In Vista, the function looks up for explorer and gets a token to its process. Then, the token is duplicated, and its privileges are adjusted. Finally, it's passed to CreateProcessWithTokenW function. In the other OS, it simply starts a new process using CreateProcess().

This is explained step-by-step below.

Prologue

HRESULT CreateProcessWithExplorerIL(LPWSTR szProcessName, LPWSTR szCmdLine)
{
HRESULT hr=S_OK;

BOOL bRet;
HANDLE hToken;
HANDLE hNewToken;

bool bVista=false;
{ // When the function is called from IS12, GetVersionEx returns dwMajorVersion=5 on Vista!
    HMODULE hmodKernel32=LoadLibrary(L"Kernel32");
    if(hmodKernel32 && GetProcAddress(hmodKernel32, "GetProductInfo"))
        bVista=true;
    if(hmodKernel32) FreeLibrary(hmodKernel32);
}

PROCESS_INFORMATION ProcInfo = {0};
STARTUPINFO StartupInfo = {0};

if(bVista)
{

1. Obtain a handle Shell Window and obtain the ID of its process (explorer.exe)

DWORD dwCurIL=SECURITY_MANDATORY_HIGH_RID; 
DWORD dwExplorerID=0, dwExplorerIL=SECURITY_MANDATORY_HIGH_RID;

HWND hwndShell=::FindWindow( _T("Progman"), NULL);
if(hwndShell)
    GetWindowThreadProcessId(hwndShell, &dwExplorerID);

hr=GetProcessIL(dwExplorerID, &dwExplorerIL);
if(SUCCEEDED(hr))
    hr=GetProcessIL(GetCurrentProcessId(), &dwCurIL);

2. Get the token of the process

if(SUCCEEDED(hr))
{
    if(dwCurIL==SECURITY_MANDATORY_HIGH_RID && 
    	dwExplorerIL==SECURITY_MANDATORY_MEDIUM_RID)
    {
        HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwExplorerID);
        if(hProcess)
        {
            if(OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hToken))
            {

3. Duplicate the token

if(!DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL,
    SecurityImpersonation, TokenPrimary, &hNewToken))
    hr=HRESULT_FROM_WIN32(GetLastError());

4. Modify the set of privileges by removing/disabling the privileges which doesn’t relay to a process with Medium IL

if(SUCCEEDED(hr))
{
    if(dwCurIL==SECURITY_MANDATORY_MEDIUM_RID &&
    dwExplorerIL==SECURITY_MANDATORY_MEDIUM_RID)
    {
        hr=ReducePrivilegesForMediumIL(hNewToken);
    }//if(dwCurIL==...)

5. Creating new process using CreateProcessWithTokenW

if(SUCCEEDED(hr))
{
    typedef BOOL (WINAPI *LPFN_CreateProcessWithTokenW)(
        HANDLE hToken,
        DWORD dwLogonFlags,
        LPCWSTR lpApplicationName,
        LPWSTR lpCommandLine,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCWSTR lpCurrentDirectory,
        LPSTARTUPINFOW lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInfo
        );
    LPFN_CreateProcessWithTokenW fnCreateProcessWithTokenW=NULL;
    HINSTANCE hmodAdvApi32=LoadLibraryA("AdvApi32");
    if(hmodAdvApi32)
        fnCreateProcessWithTokenW=(LPFN_CreateProcessWithTokenW)
        GetProcAddress(hmodAdvApi32, "CreateProcessWithTokenW");
    if(fnCreateProcessWithTokenW)
    {
        bRet=fnCreateProcessWithTokenW(hNewToken, 0,
            szProcessName, szCmdLine,
            0, NULL, NULL, &StartupInfo, &ProcInfo);
        if(!bRet)
            hr=HRESULT_FROM_WIN32(GetLastError());
    }
    else
        hr=E_UNEXPECTED;
    if(hmodAdvApi32)
        FreeLibrary(hmodAdvApi32);
}//if(SUCCEEDED(hr))

Epilogue

                    CloseHandle(hNewToken);
                }//if (DuplicateTokenEx(...)
                else
                    hr=HRESULT_FROM_WIN32(GetLastError());
                CloseHandle(hToken);
            }//if(OpenProcessToken(...))
            else
                hr=HRESULT_FROM_WIN32(GetLastError());
            CloseHandle(hProcess);
        }//if(hProcess)
    }//if(dwCurIL==SECURITY_MANDATORY_HIGH_RID && 
    dwExplorerIL==SECURITY_MANDATORY_MEDIUM_RID)
    else if(dwCurIL==SECURITY_MANDATORY_MEDIUM_RID && 
    dwExplorerIL==SECURITY_MANDATORY_HIGH_RID)
        hr=E_ACCESSDENIED;
}//if(SUCCEEDED(hr))
}//if(bVista)

if(SUCCEEDED(hr) && !ProcInfo.dwProcessId)
{// 2K | XP | Vista & !UAC
    bRet = CreateProcess(szProcessName, szCmdLine, 
        NULL, NULL, FALSE, 0, NULL, NULL, &StartupInfo, &ProcInfo);
    if(!bRet)
        hr=HRESULT_FROM_WIN32(GetLastError());
}// 2K | XP | Vista & !UAC

return hr;
}

Using the Code

Using the code is very simple. Just copy the code into your project and call CreateProcessWithExplorerIL().

CreateProcessWithExplorerIL(L"C:\\Program Files\\Microsoft Visual Studio\\Common\\
Tools\\irotview.exe", NULL);

Comments

This function cannot be used in service processes as finding shell window will fail. In this case, the ID of shell process should be obtained using another way. Moreover, there may be several explorer.exe processes.
The parent of the created process will be taskmgr.exe, but not the caller process.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Volirvag Yexela
Software Developer
Reunion Reunion
No Biography provided

You may also be interested in...

Pro
Pro

Comments and Discussions

 
QuestionHow to run Pin
isaprgmr16-Oct-12 19:30
memberisaprgmr16-Oct-12 19:30 
QuestionThis works well. Thank you. Pin
flobadob197521-Sep-12 1:44
memberflobadob197521-Sep-12 1:44 
GeneralMethod that doesn't require injection or process token changes Pin
Leo Davidson24-Feb-10 1:02
memberLeo Davidson24-Feb-10 1:02 
GeneralRe: Method that doesn't require injection or process token changes Pin
Gif13-Jul-11 19:55
memberGif13-Jul-11 19:55 
GeneralLaunching this from a dll Pin
Yusuf Cinar5-Feb-10 8:29
memberYusuf Cinar5-Feb-10 8:29 
GeneralRe: Launching this from a dll Pin
Yusuf Cinar5-Feb-10 14:09
memberYusuf Cinar5-Feb-10 14:09 
NewsSIX bugs in your code !! Pin
Elmue7-Nov-09 15:37
memberElmue7-Nov-09 15:37 
Hello

Your article is interesting.
I want to use it in an installer which runs under admin privileges and at the end of the installation it should run the installed application under the account of the currently logged in user.
______________

In your code is missing a: #include "Windows.h"
______________

The worst is: Your code does not work.
It has multiple problems.

I tried it on Vista under a User account.
I compile the EXE and run it "As Administrator".
The Vista Elevation Windows pops up and asks to enter the admin password.

What happens is VERY strange.

I narrowed down your code to the follwing test code which demonstrates what is happening:

int main(int argc, char* argv[])
{
   DWORD dwExplorerIL=0;
   HRESULT hr=GetProcessIL(2896, &dwExplorerIL);
   printf("ExplorerIL=0x%X", dwExplorerIL);
   return 0;
}
The explorer process has ID 2896 during my tests.

The STRANGE thing is that
the output shows ExplorerIL=0x2000 (MEDIUM_RID) when running the EXE as the currently logged in user, but
the output shows ExplorerIL=0x3000 (HIGH_RID) when running the EXE "As Administrator"!!!

This is complete nonsense!
The explorer does not change it's IL!!
But exactly this happens!

The reason is your crappy error handling:
Instead of returning IL=0 when an error occurres your function GetProcessIL() returns HIGH_RID.
_________________

The cause is that
HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS, ..., ...);
returns ERROR_ACCESS_DENIED although the program runs "As Administrator".

I thought that ALL_ACCESS is quite exaggerated and changed it into PROCESS_QUERY_INFORMATION.
This must be replaced once in
(BUG 1) GetProcessIL() and another time in
(BUG 2) CreateProcessWithExplorerIL()
After that there is no more ERROR_ACCESS_DENIED.
________________

And the code has another error:
OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hToken)
also returns ERROR_ACCESS_DENIED

Again I thought that TOKEN_ALL_ACCESS is quite exaggerated and changed it into
(BUG 3) TOKEN_QUERY in the function GetProcessIL() and into
(BUG 4) TOKEN_DUPLICATE in the function CreateProcessWithExplorerIL().
________________

There is another BUG 5:
Your function ReducePrivilegesForMediumIL() will NEVER be called!
First you check
if (dwCurIL==HIGH_RID && dwExplorerIL==MEDIUM_RID)
if this is true you check some lines later
if (dwCurIL==MEDIUM_RID && dwExplorerIL==MEDIUM_RID)
which will NEVER happen!
I don't understand why you wrote this function at all?
If Explorer already runs with MEDIUM_RID why do you want to reduce the privileges to MEDIUM_RID then?

Why do you check at all if Explorer runs with MEDIUM IL ?
Did you ever see that it didn't ?

So you can completely remove the unused functions SetPrivilege() and ReducePrivilegesForMediumIL()
_______________

The BUG 6 is another time crappy error handling:
If GetSidSubAuthority() returns NULL your application will crash.
_______________

LoadLibrary("Kernel32") and then FreeLibrary() can be replaced by
GetModuleHandle("Kernel32")
_______________

Your comments dont always make sense:
// If Explorer has Medium IL, and the current process has High IL, new token is created, its rights are adjusted and CreateProcessWithTokenW is called. 
// If Explorer has Medium IL, and the current process has High IL, error is returned.
_______________

Your code is NOT a cleanly written code and it does NOT have clean error handling.
Nevertheless: thanks for your code!

The interesting thing is that although the admin runs your code the new process which is created will run under the user name of the currenlty logged-in user as I can see in Taskmanager.
This is exactly what I need for my installer because the new process must access the correct "Documents and Settings" folder.

Elmü
NewsHere the cleaned and bugfixed code Pin
Elmue8-Nov-09 5:52
memberElmue8-Nov-09 5:52 
GeneralRe: Here the cleaned and bugfixed code Pin
Brunhilde8-Nov-09 7:07
memberBrunhilde8-Nov-09 7:07 
GeneralRe: Here the cleaned and bugfixed code Pin
flamierd15-Feb-11 5:40
memberflamierd15-Feb-11 5:40 
GeneralRe: Here the cleaned and bugfixed code - still errors (leaked handles) Pin
patzw27-May-11 5:41
memberpatzw27-May-11 5:41 
GeneralRe: Closing handles Pin
Elmue27-May-11 17:13
memberElmue27-May-11 17:13 
NewsRe: Here the cleaned and bugfixed code Pin
Member 82097377-Nov-11 21:56
memberMember 82097377-Nov-11 21:56 
GeneralVista don't allow AppInit_Dlls to inject Pin
sunil_20084-Sep-09 19:46
membersunil_20084-Sep-09 19:46 
QuestionGood job, can this be done even better? Pin
Ellery Pierce13-Aug-08 18:23
memberEllery Pierce13-Aug-08 18:23 
GeneralThank you very much Pin
JuanT25-Jul-08 0:40
memberJuanT25-Jul-08 0:40 
GeneralGood solution Pin
FaxedHead28-May-08 20:52
memberFaxedHead28-May-08 20:52 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160826.1 | Last Updated 26 Jan 2008
Article Copyright 2008 by Volirvag Yexela
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid