如何判断进程是否具有administrator权限

最新推荐文章于 2022-05-31 15:47:09 发布

原创最新推荐文章于 2022-05-31 15:47:09 发布 · 1.7k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#security #domain #token #query #byte

VC++ 专栏收录该内容

39 篇文章

订阅专栏

判断进程是否具有admin权限的source code。

是的话返回TRUE，否则为FALSE。

static BOOL IsAdmin(void)
{
     HANDLE                   hAccessToken;
     BYTE                     InfoBuffer[1024];
     PTOKEN_GROUPS            ptgGroups;
     DWORD                    dwInfoBufferSize;
     PSID                     psidAdministrators;
     SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
     UINT                     i;
     BOOL                     bRet = FALSE;

     if(!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&hAccessToken))
        return bRet;

     bRet = GetTokenInformation(hAccessToken, TokenGroups, InfoBuffer, 1024, &dwInfoBufferSize);
     CloseHandle(hAccessToken);
     if(!bRet)
        return bRet;

     if(!AllocateAndInitializeSid(&siaNtAuthority,
                                  2,
                                  SECURITY_BUILTIN_DOMAIN_RID,
                                  DOMAIN_ALIAS_RID_ADMINS,
                                  0,0,0,0,0,0,
                                  &psidAdministrators))
        return FALSE;

     bRet = FALSE;
     ptgGroups = (PTOKEN_GROUPS)InfoBuffer;
     for(i=0;i<ptgGroups->GroupCount;i++)
         if(EqualSid(psidAdministrators,ptgGroups->Groups[i].Sid))
             bRet = TRUE;

     FreeSid(psidAdministrators);
     return bRet;
}