OpenProcess for PID owned by "NT AUTHORITY \ SYSTEM"
I am trying to open a handle to a process in C # using the OpenProcess function like this:
IntPtr hProcess = OpenProcess(0x410, false, pid);
where pid
is the process id of the process that I would like to open.
When calling a PID whose user is "NT AUTHORITY \ SYSTEM" (on Vista x64), the above call fails with the "Access Denied" error.
How do I get a handle to such a process?
What makes me think this is possible at all is that the .NET class System.Diagnostics.Process
seems to be capable of running on such processes. For example, it Process.ProcessName
works great with such processes. Under the hood, it calls Process.MainModule.ModuleName
, which ends up calling OpenProcess
just like me. However System.Diagnostics
does not get the "Access Denied" error, as I do.
Curiously, anything trying to get a handle to a process in my application throws an exception as well. For example, Process.Handle
and Process.MainModule
the two will generate an error "Access Denied", despite the fact that Process.MainModule
obviously does well when called indirectly through Process.ProcessName
.
Does it work System.Diagnostics
under some kind of elevated privileges? How can I elevate the privileges of my application to be able to do the same?
a source to share
How do I get a handle to such a process? How can I elevate the privileges of my application to be able to do the same?
Apparently the app should provide SeDebugPrivilege
How to use SeDebugPrivilege to acquire any processing handle
However, it's not a great idea for a universal app to rely on this because SeDebugPrivilege is equivalent to admin privilege (security).
I'm still not sure exactly how it System.Diagnostics
provides Process.ProcessName
without requiring SeDebugPrivilege
, but then I know almost nothing about the .NET code protection features.
a source to share
The process name and some other things do not require privileges.
In any case, the reason you need SeDebugPrivilege is because with most OpenProcess arguments, you can compromise the security of the machine if you open the SYSTEM process.
See WriteProcessMemory for obvious reason.
Also, .NET processes are not kernel-specific. If you can declare OpenProcess, you have all System.Diagnostics.Process privileges.
a source to share