Added get_debug_token().

New function to obtain SeDebugPrivilege privilege.

diff --git a/process.cpp b/process.cpp
index fa8de6b..220411b 100644 (file)
--- a/process.cpp
+++ b/process.cpp
@@ -2,6 +2,47 @@
 \r
 extern imports_t imports;\r
 \r
+HANDLE get_debug_token() {\r
+  long error;\r
+  HANDLE token;\r
+  if (! OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, false, &token)) {\r
+    error = GetLastError();\r
+    if (error == ERROR_NO_TOKEN) {\r
+      (void) ImpersonateSelf(SecurityImpersonation);\r
+      (void) OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, false, &token);\r
+    }\r
+  }\r
+  if (! token) return INVALID_HANDLE_VALUE;\r
+\r
+  TOKEN_PRIVILEGES privileges, old;\r
+  unsigned long size = sizeof(TOKEN_PRIVILEGES);\r
+  LUID luid;\r
+  if (! LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) {\r
+    CloseHandle(token);\r
+    return INVALID_HANDLE_VALUE;\r
+  }\r
+\r
+  privileges.PrivilegeCount = 1;\r
+  privileges.Privileges[0].Luid = luid;\r
+  privileges.Privileges[0].Attributes = 0;\r
+\r
+  if (! AdjustTokenPrivileges(token, false, &privileges, size, &old, &size)) {\r
+    CloseHandle(token);\r
+    return INVALID_HANDLE_VALUE;\r
+  }\r
+\r
+  old.PrivilegeCount = 1;\r
+  old.Privileges[0].Luid = luid;\r
+  old.Privileges[0].Attributes |= SE_PRIVILEGE_ENABLED;\r
+\r
+  if (! AdjustTokenPrivileges(token, false, &old, size, NULL, NULL)) {\r
+    CloseHandle(token);\r
+    return INVALID_HANDLE_VALUE;\r
+  }\r
+\r
+  return token;\r
+}\r
+\r
 void service_kill_t(nssm_service_t *service, kill_t *k) {\r
   if (! service) return;\r
   if (! k) return;\r

diff --git a/process.h b/process.h
index fe36f2f..de39cf0 100644 (file)
--- a/process.h
+++ b/process.h
@@ -21,6 +21,7 @@ typedef struct {
 \r
 typedef int (*walk_function_t)(nssm_service_t *, kill_t *);\r
 \r
+HANDLE get_debug_token();\r
 void service_kill_t(nssm_service_t *, kill_t *);\r
 int get_process_creation_time(HANDLE, FILETIME *);\r
 int get_process_exit_time(HANDLE, FILETIME *);\r