Do I need to adjust token privileges in order to successfully call CreateRemoteThread?

Question

I\'m developing a debugging facility for my application to help me diagnose deadlocks. The application runs on my client\'s machines and so I expect a wide range of operatin

Answer 1

Ordinarily, if the target process is running in the same context (i.e., as the same user) as the debugger, no privileges are required for either OpenProcess or CreateRemoteThread.

If the target process is running as a different user, or if the process permissions have been modified, you might need to enable SE_DEBUG_NAME before calling OpenProcess. This privilege allows you to open any process, bypassing the security permissions assigned to the process. (This is analogous to the way that the backup/restore privileges allow you to bypass the security permissions on files and directories.)

Some applications modify their own process permissions so that, e.g., the user can't use Task Manager to kill the process. In this case, it's your own code, so that won't be a problem. It is possible in principle for some other software (anti-virus software, for example) to modify the permissions on your process, but I've never heard of it happening, so you probably don't need to worry about enabling SE_DEBUG_NAME.