static uint createProcessInSession(uint dwSessionId, String commandLine, WinApi.Advapi32.CreationFlags dwCreationFlags = 0, WinApi.Advapi32.STARTUPINFO?startupInfo = null, bool bElevate = false)
{
IntPtr hUserToken = IntPtr.Zero;
IntPtr hUserTokenDup = IntPtr.Zero;
IntPtr hPToken = IntPtr.Zero;
IntPtr hProcess = IntPtr.Zero;
try
{
// Log the client on to the local computer.
//uint dwSessionId = WTSGetActiveConsoleSessionId();
//// Find the winlogon process
//var procEntry = new PROCESSENTRY32();
//uint hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
//if (hSnap == INVALID_HANDLE_VALUE)
// throw new Exception("CreateToolhelp32Snapshot == INVALID_HANDLE_VALUE. " + ErrorRoutines.GetLastError());
//procEntry.dwSize = (uint)Marshal.SizeOf(procEntry); //sizeof(PROCESSENTRY32);
//if (Process32First(hSnap, ref procEntry) == 0)
// throw new Exception("Process32First == 0. " + ErrorRoutines.GetLastError());
//uint winlogonPid = 0;
//String strCmp = "explorer.exe";
//do
//{
// if (strCmp.IndexOf(procEntry.szExeFile) == 0)
// {
// // We found a winlogon process...make sure it's running in the console session
// uint winlogonSessId = 0;
// if (ProcessIdToSessionId(procEntry.th32ProcessID, ref winlogonSessId) && winlogonSessId == dwSessionId)
// {
// winlogonPid = procEntry.th32ProcessID;
// break;
// }
// }
//}
//while (Process32Next(hSnap, ref procEntry) != 0);
//if (winlogonPid == 0)
// throw new Exception("winlogonPid == 0");
//Get the user token used by DuplicateTokenEx
//WTSQueryUserToken(dwSessionId, ref hUserToken);
//if (hUserToken == IntPtr.Zero)
// throw new Exception("WTSQueryUserToken == 0. " + ErrorRoutines.GetLastError());
WinApi.Advapi32.STARTUPINFO si;
if (startupInfo != null)
{
si = (WinApi.Advapi32.STARTUPINFO)startupInfo;
}
else
{
si = new WinApi.Advapi32.STARTUPINFO();
}
si.cb = Marshal.SizeOf(si);
si.lpDesktop = "winsta0\\default";
//hProcess = OpenProcess(MAXIMUM_ALLOWED, false, winlogonPid);
//if (hProcess == IntPtr.Zero)
// throw new Exception("OpenProcess == IntPtr.Zero. " + ErrorRoutines.GetLastError());
if (!WinApi.Advapi32.OpenProcessToken(Process.GetCurrentProcess().Handle, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, out hPToken))
{
//if (!OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_SESSIONID | TOKEN_READ | TOKEN_WRITE, ref hPToken))
throw new Exception("!OpenProcessToken. " + ErrorRoutines.GetLastError());
}
//var luid = new LUID();
//if (!LookupPrivilegeValue(IntPtr.Zero, SE_DEBUG_NAME, ref luid))
// throw new Exception("!LookupPrivilegeValue. " + ErrorRoutines.GetLastError());
var sa = new WinApi.Advapi32.SECURITY_ATTRIBUTES();
sa.Length = Marshal.SizeOf(sa);
if (!WinApi.Advapi32.DuplicateTokenEx(hPToken, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, ref sa, WinApi.Advapi32.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification, WinApi.Advapi32.TOKEN_TYPE.TokenPrimary, ref hUserTokenDup))
{
throw new Exception("!DuplicateTokenEx. " + ErrorRoutines.GetLastError());
}
//if (bElevate)
//{
// var tp = new TOKEN_PRIVILEGES();
// //tp.Privileges[0].Luid = luid;
// //tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
// tp.PrivilegeCount = 1;
// tp.Privileges = new int[3];
// tp.Privileges[2] = SE_PRIVILEGE_ENABLED;
// tp.Privileges[1] = luid.HighPart;
// tp.Privileges[0] = luid.LowPart;
// //Adjust Token privilege
// if (!SetTokenInformation(hUserTokenDup, TOKEN_INFORMATION_CLASS.TokenSessionId, ref dwSessionId, (uint)IntPtr.Size))
// throw new Exception("!SetTokenInformation. " + ErrorRoutines.GetLastError());
// if (!AdjustTokenPrivileges(hUserTokenDup, false, ref tp, Marshal.SizeOf(tp), /*(PTOKEN_PRIVILEGES)*/IntPtr.Zero, IntPtr.Zero))
// throw new Exception("!AdjustTokenPrivileges. " + ErrorRoutines.GetLastError());
//}
//dwCreationFlags |= dwCreationFlagValues.NORMAL_PRIORITY_CLASS| dwCreationFlagValues.CREATE_NEW_CONSOLE;
//IntPtr pEnv = IntPtr.Zero;
//if (CreateEnvironmentBlock(ref pEnv, hUserTokenDup, true))
// dwCreationFlags |= dwCreationFlagValues.CREATE_UNICODE_ENVIRONMENT;
//else
// pEnv = IntPtr.Zero;
// Launch the process in the client's logon session.
WinApi.Advapi32.PROCESS_INFORMATION pi;
if (!WinApi.Advapi32.CreateProcessAsUser(hUserTokenDup, // client's access token
null, // file to execute
commandLine, // command line
ref sa, // pointer to process SECURITY_ATTRIBUTES
ref sa, // pointer to thread SECURITY_ATTRIBUTES
false, // handles are not inheritable
dwCreationFlags, // creation flags
IntPtr.Zero, //pEnv, // pointer to new environment block
null, // name of current directory
ref si, // pointer to STARTUPINFO structure
out pi // receives information about new process
))
{
throw new Exception("!CreateProcessAsUser. " + ErrorRoutines.GetLastError());
}
return(pi.dwProcessId);
}
//catch(Exception e)
//{
//}
finally
{
if (hProcess != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hProcess);
}
if (hUserToken != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hUserToken);
}
if (hUserTokenDup != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hUserTokenDup);
}
if (hPToken != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hPToken);
}
//if (pEnv != IntPtr.Zero)
// DestroyEnvironmentBlock(pEnv);
}
}
static void beginMonitorServiceStartStop()
{
try
{
IntPtr hSCM = WinApi.Advapi32.OpenSCManager(null, null, WinApi.Advapi32.SCM_ACCESS.SC_MANAGER_CONNECT);//(WinApi.Advapi32.SCM_ACCESS)0xF003F);//
if (hSCM == IntPtr.Zero)
{
throw new Exception("OpenSCManager: " + ErrorRoutines.GetLastError());
}
IntPtr hService = WinApi.Advapi32.OpenService(hSCM, Cliver.CisteraScreenCaptureService.Program.SERVICE_NAME, WinApi.Advapi32.OpenServiceDesiredAccess.SERVICE_QUERY_STATUS);
if (hService == IntPtr.Zero)
{
throw new Exception("OpenService: " + ErrorRoutines.GetLastError());
}
ThreadRoutines.StartTry(() =>
{
for (; ;)
{
serviceSatusChangedNotify = new WinApi.Advapi32.SERVICE_NOTIFY();
serviceSatusChangedNotify.dwVersion = 2;
serviceSatusChangedNotify.pfnNotifyCallback = Marshal.GetFunctionPointerForDelegate(serviceStatusChangedDelegate);
serviceSatusChangedNotify.pContext = IntPtr.Zero;
serviceSatusChangedNotify.dwNotificationStatus = 0;
WinApi.Advapi32.SERVICE_STATUS_PROCESS process;
process.dwServiceType = 0;
process.dwCurrentState = 0;
process.dwControlsAccepted = 0;
process.dwWin32ExitCode = 0;
process.dwServiceSpecificExitCode = 0;
process.dwCheckPoint = 0;
process.dwWaitHint = 0;
process.dwProcessId = 0;
process.dwServiceFlags = 0;
serviceSatusChangedNotify.ServiceStatus = process;
serviceSatusChangedNotify.dwNotificationTriggered = 0;
serviceSatusChangedNotify.pszServiceNames = Marshal.StringToHGlobalUni(Cliver.CisteraScreenCaptureService.Program.SERVICE_NAME);
notifyHandle = GCHandle.Alloc(serviceSatusChangedNotify, GCHandleType.Pinned);
unmanagedNotifyStructure = notifyHandle.AddrOfPinnedObject();
if (0 != WinApi.Advapi32.NotifyServiceStatusChange(hService, WinApi.Advapi32.NotifyMask.SERVICE_NOTIFY_RUNNING | WinApi.Advapi32.NotifyMask.SERVICE_NOTIFY_STOPPED, unmanagedNotifyStructure))
{
LogMessage.Error("NotifyServiceStatusChange: " + ErrorRoutines.GetLastError());
}
serviceStatusChangedManualResetEvent.Reset();
serviceStatusChangedManualResetEvent.WaitOne();
notifyHandle.Free();
}
},
null,
() =>
{
try
{
notifyHandle.Free();
}
catch { }
}
);
}
catch (Exception e)
{
LogMessage.Error(e);
}
}
static uint createProcessInSession(uint dwSessionId, String commandLine, WinApi.Advapi32.CreationFlags dwCreationFlags = 0, WinApi.Advapi32.STARTUPINFO?startupInfo = null, bool bElevate = false)
{
Log.Main.Inform("Launching (in session " + dwSessionId + "):\r\n" + commandLine);
IntPtr hNewProcessToken = IntPtr.Zero;
IntPtr hProcessToken = IntPtr.Zero;
try
{
WinApi.Advapi32.STARTUPINFO si;
if (startupInfo != null)
{
si = (WinApi.Advapi32.STARTUPINFO)startupInfo;
}
else
{
si = new WinApi.Advapi32.STARTUPINFO();
}
si.cb = Marshal.SizeOf(si);
si.lpDesktop = "winsta0\\default";
if (!WinApi.Advapi32.OpenProcessToken(Process.GetCurrentProcess().Handle, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, out hProcessToken))
{
throw new Exception("!OpenProcessToken. " + ErrorRoutines.GetLastError());
}
var sa = new WinApi.Advapi32.SECURITY_ATTRIBUTES();
sa.Length = Marshal.SizeOf(sa);
if (!WinApi.Advapi32.DuplicateTokenEx(hProcessToken, WinApi.Advapi32.DesiredAccess.MAXIMUM_ALLOWED, ref sa, WinApi.Advapi32.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification, WinApi.Advapi32.TOKEN_TYPE.TokenPrimary, ref hNewProcessToken))
{
throw new Exception("!DuplicateTokenEx. " + ErrorRoutines.GetLastError());
}
if (!WinApi.Advapi32.SetTokenInformation(hNewProcessToken, WinApi.Advapi32.TOKEN_INFORMATION_CLASS.TokenSessionId, ref dwSessionId, (uint)IntPtr.Size))
{
throw new Exception("!SetTokenInformation. " + ErrorRoutines.GetLastError());
}
WinApi.Advapi32.PROCESS_INFORMATION pi;
if (!WinApi.Advapi32.CreateProcessAsUser(hNewProcessToken, // client's access token
null, // file to execute
commandLine, // command line
ref sa, // pointer to process SECURITY_ATTRIBUTES
ref sa, // pointer to thread SECURITY_ATTRIBUTES
false, // handles are not inheritable
dwCreationFlags, // creation flags
IntPtr.Zero, //pEnv, // pointer to new environment block
null, // name of current directory
ref si, // pointer to STARTUPINFO structure
out pi // receives information about new process
))
{
throw new Exception("!CreateProcessAsUser. " + ErrorRoutines.GetLastError());
}
return(pi.dwProcessId);
}
//catch(Exception e)
//{
//}
finally
{
if (hProcessToken != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hProcessToken);
}
if (hNewProcessToken != IntPtr.Zero)
{
WinApi.Kernel32.CloseHandle(hNewProcessToken);
}
}
}