程序启动进程特别是Win7远程桌面启动进程（备注）
BOOL StartProcess(int ProcessIndex)
{
char pTemp[1024] ={0};
sprintf(pTemp, "Enter func StartProcess");
WriteWorkLog(pTemp);
LPTSTR lpszpath;
lpszpath = new char[nBufferSize];
memset(lpszpath,0x00,sizeof(lpszpath));
DWORD dwSize = GetModuleFileName(NULL,lpszpath, nBufferSize);
lpszpath[dwSize] =0;
while(lpszpath[dwSize] != '\\'&& dwSize != 0)
{
lpszpath[dwSize] =0; dwSize--;
}
sprintf(pTemp, "Sub process work directory is %s", lpszpath);
WriteWorkLog(pTemp);
{
// sprintf(pTemp,"Enter func StartProcess");
// WriteWorkLog(pTemp);
// sprintf(pTemp,"Sub process name is is %s", ProcessNames[ProcessIndex]);
// WriteWorkLog(pTemp);
// // 为了显示更加复杂的用户界面，我们需要从Session 0创建
// // 一个进程，但是这个进程是运行在用户环境下。
// // 我们可以使用CreateProcessAsUser实现这一功能。
// BOOL bSuccess =FALSE;
// STARTUPINFO si;
// ZeroMemory(&si, sizeof(si) );
// si.cb =sizeof(si);
// si.dwFlags=STARTF_USESHOWWINDOW;
// si.wShowWindow=SW_SHOW;
// // 获得当前Session ID
// DWORD dwSessionID= WTSGetActiveConsoleSessionId();
// HANDLE hToken =NULL;
// // 获得当前Session的用户令牌
// if(WTSQueryUserToken(dwSessionID, &hToken) == FALSE)
// {
// sprintf(pTemp,"WTSQueryUserToken error!%d",GetLastError());
// WriteWorkLog(pTemp);
// goto Cleanup;
// }
// else
// {
// sprintf(pTemp,"dwSessionID = %d",dwSessionID);
// WriteWorkLog(pTemp);
// }
// // 复制令牌
// HANDLEhDuplicatedToken = NULL;
// if (DuplicateTokenEx(hToken,
// MAXIMUM_ALLOWED,NULL,
// SecurityIdentification,TokenPrimary,
// &hDuplicatedToken)== FALSE)
// {
// sprintf(pTemp,"DuplicateTokenEx error!%d",GetLastError());
// WriteWorkLog(pTemp);
// goto Cleanup;
// }
// // 创建用户Session环境
// LPVOIDlpEnvironment = NULL;
// if(CreateEnvironmentBlock(&lpEnvironment,
// hDuplicatedToken,FALSE) == FALSE)
// {
// sprintf(pTemp,"CreateEnvironmentBlock error!%d",GetLastError());
// WriteWorkLog(pTemp);
// goto Cleanup;
// }
// // 在复制的用户Session下执行应用程序，创建进程。
// // 通过这个进程，就可以显示各种复杂的用户界面了
// if(CreateProcessAsUser(hDuplicatedToken,
// ProcessNames[ProcessIndex],NULL, NULL, NULL, FALSE,
// NORMAL_PRIORITY_CLASS| CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT,
// lpEnvironment,NULL, &si, &pProcInfo[ProcessIndex]) == FALSE)
// {
// sprintf(pTemp,"CreateProcessAsUser error!%d",GetLastError());
// WriteWorkLog(pTemp);
// goto Cleanup;
// }
// else
// {
// sprintf(pTemp,"Sucto start program '%s'", ProcessNames[ProcessIndex]);
// WriteWorkLog(pTemp);
// }
// //CloseHandle(pProcInfo[ProcessIndex].hProcess);
// //CloseHandle(pProcInfo[ProcessIndex].hThread);
// bSuccess = TRUE;
// // 清理工作
//Cleanup:
// if (!bSuccess)
// {
// }
// if (hToken !=NULL)
// CloseHandle(hToken);
// if(hDuplicatedToken != NULL)
// CloseHandle(hDuplicatedToken);
// if (lpEnvironment!= NULL)
// DestroyEnvironmentBlock(lpEnvironment);
// return 0;
//********************************************
//BOOL bSuccess=TRUE;
//HANDLE hToken = NULL;
//HANDLE hTokenDup = NULL;
//do
//{
// if(OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hToken))
// {
// if(DuplicateTokenEx(hToken,MAXIMUM_ALLOWED,NULL, SecurityIdentification, TokenPrimary, &hTokenDup))
// {
// DWORDdwSessionId = WTSGetActiveConsoleSessionId();
// if(!SetTokenInformation(hTokenDup,TokenSessionId,&dwSessionId,sizeof(DWORD)))
// {
// sprintf(pTemp,"SetTokenInformationerror！error code：%d",GetLastError());
// WriteWorkLog(pTemp);
// bSuccess= FALSE;
// break;
// }
// STARTUPINFOsi;
// ZeroMemory(&si,sizeof(STARTUPINFO));
// si.cb =sizeof(STARTUPINFO);
// si.lpDesktop= _T("WinSta0\\Default");
// si.wShowWindow= SW_SHOW;
// si.dwFlags = STARTF_USESHOWWINDOW /*|STARTF_USESTDHANDLES*/;
// LPVOIDpEnv = NULL;
// DWORDdwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT;
// if(!CreateEnvironmentBlock(&pEnv,hTokenDup,FALSE))
// {
// sprintf(pTemp,TEXT("CreateEnvironmentBlockerror！error code：%d\n"),GetLastError());
// bSuccess= FALSE;
// break;
// }
// if(!CreateProcessAsUser(hTokenDup,ProcessNames[ProcessIndex],NULL,NULL,NULL,FALSE,dwCreationFlag,pEnv,NULL,&si,&pProcInfo[ProcessIndex]))
// {
// sprintf(pTemp,TEXT("CreateProcessAsUsererror！error code：%d\n"),GetLastError());
// bSuccess= FALSE;
// break;
// }
// if(pEnv)
// {
// DestroyEnvironmentBlock(pEnv);
// }
// }
// else
// {
// sprintf(pTemp,TEXT("DuplicateTokenExerror！error code：%d\n"),GetLastError());
// bSuccess= FALSE;
// break;
// }
// }
// else
// {
// sprintf(pTemp,TEXT("cannotget administror！error code：%d\n"),GetLastError());
// bSuccess =FALSE;
// break;
// }
//}while(0);
//if(hTokenDup != NULL && hTokenDup !=INVALID_HANDLE_VALUE)
// CloseHandle(hTokenDup);
//if(hToken != NULL && hToken !=INVALID_HANDLE_VALUE)
// CloseHandle(hToken);
//return bSuccess;
//********************************************************************3************************************
PROCESS_INFORMATION pi;
STARTUPINFO si;
BOOL bResult = FALSE;
DWORD dwSessionId,winlogonPid;
HANDLE hUserToken,hUserTokenDup,hPToken,hProcess;
DWORD dwCreationFlags;
// Log the client on to the local computer.
dwSessionId = WTSGetActiveConsoleSessionId();
sprintf(pTemp, "dwSessionId = %d",dwSessionId);
WriteWorkLog(pTemp);
//
// Find the winlogon process
PROCESSENTRY32procEntry;
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (hSnap == INVALID_HANDLE_VALUE)
{
return 1 ;
}
procEntry.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hSnap, &procEntry))
{
return 1 ;
}
do
{
if (_stricmp(procEntry.szExeFile,"explorer.exe") == 0)
{
// We found a explorer.exe process...
//make sure it's running in the console session
DWORD winlogonSessId= 0;
if (ProcessIdToSessionId(procEntry.th32ProcessID,&winlogonSessId)/*&&winlogonSessId == dwSessionId*/)
{
sprintf(pTemp, "winlogonSessId = %d",winlogonSessId);
WriteWorkLog(pTemp);
winlogonPid = procEntry.th32ProcessID;
dwSessionId=winlogonSessId;
break;
}
}
}while (Process32Next(hSnap, &procEntry));
WTSQueryUserToken(dwSessionId,&hUserToken);
dwCreationFlags = NORMAL_PRIORITY_CLASS|CREATE_NEW_CONSOLE;
ZeroMemory(&si,sizeof(STARTUPINFO));
si.cb= sizeof(STARTUPINFO);
si.lpDesktop = "winsta0\\default";
si.wShowWindow = SW_SHOW;
si.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
ZeroMemory(&pi,sizeof(pi));
TOKEN_PRIVILEGES tp;
LUID luid;
hProcess = OpenProcess(MAXIMUM_ALLOWED,FALSE,winlogonPid);
if(!::OpenProcessToken(hProcess,TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY
|TOKEN_DUPLICATE|TOKEN_ASSIGN_PRIMARY|TOKEN_ADJUST_SESSIONID
|TOKEN_READ|TOKEN_WRITE,&hPToken))
{
int abcd = GetLastError();
printf("Processtoken open Error: %u\n",GetLastError());
}
if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid))
{
printf("LookupPrivilege value Error: %u\n",GetLastError());
}
tp.PrivilegeCount=1;
tp.Privileges[0].Luid =luid;
tp.Privileges[0].Attributes =SE_PRIVILEGE_ENABLED;
DuplicateTokenEx(hPToken,MAXIMUM_ALLOWED,NULL,
SecurityIdentification,TokenPrimary,&hUserTokenDup);
int dup = GetLastError();
//Adjust Token privilege
SetTokenInformation(hUserTokenDup,
TokenSessionId,(void*)dwSessionId,sizeof(DWORD));
if (!AdjustTokenPrivileges(hUserTokenDup,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,NULL))
{
int abc =GetLastError();
printf("AdjustPrivilege value Error: %u\n",GetLastError());
}
if (GetLastError()==ERROR_NOT_ALL_ASSIGNED)
{
printf("Token doesnot have the provilege\n");
}
LPVOID pEnv =NULL;
if(CreateEnvironmentBlock(&pEnv,hUserTokenDup,TRUE))
{
dwCreationFlags|=CREATE_UNICODE_ENVIRONMENT;
}
else
pEnv=NULL;
// Launch the process in the client's logon session.
bResult = CreateProcessAsUser(
hUserTokenDup, //client's access token
ProcessNames[ProcessIndex], // file toexecute
NULL, // command line
NULL, // pointer to process SECURITY_ATTRIBUTES
NULL, // pointer to thread SECURITY_ATTRIBUTES
FALSE, // handles are not inheritable
dwCreationFlags, // creation flags
pEnv, // pointer to new environment block
lpszpath, //name of current directory
&si, // pointer to STARTUPINFO structure
&pProcInfo[ProcessIndex] //receives information about new process
);
// End impersonation of client.
//GetLastError Shud be 0
int iResultOfCreateProcessAsUser= GetLastError();
//Perform All the Close Handles tasks
CloseHandle(hProcess);
CloseHandle(hUserToken);
CloseHandle(hUserTokenDup);
CloseHandle(hPToken);
}
delete [] lpszpath;
lpszpath = NULL;
return 0;
}