OpenProcess: access denied error only on Windows 8.1

前端 未结 3 865
暗喜
暗喜 2021-02-10 03:14

I have a program which adjusts SeDebugPrivilege and then starts to iterate through system processes and calls OpenProcess for them (and does other stuff, but it\'s not important

3条回答
  •  孤城傲影
    2021-02-10 03:22

    It can only be done in the kernel. The best way to get the info you need would be to:

    PsLookupProcessByProcessId()
    KeStackAttachProcess()
    ZwQueryInformationProcess() or whatever other functions you need to now call within the context of the attached process.
    KeStackDetachProcess()
    

    Or if you are just experimenting and not putting anything into production code, you can traverse the various semi-opaque structures (EPROCESS, PEB, VAD, etc) to get the information you need.

提交回复
热议问题