开发者

Windows 7 x64: low IL process msdn example does not work

开发者 https://www.devze.com 2023-01-04 22:03 出处:网络
I want to create process with low integrity level from process with medium integrity level. I found msdn example: Designing Applications to Run at a Low Integrity Level

I want to create process with low integrity level from process with medium integrity level. I found msdn example: Designing Applications to Run at a Low Integrity Level

But it does not work on my system. Process is created successfully, but message box

"Alpplication failed to initialized properly(0xC0000022 -- STATUS_ACCESS_DENIED) ..." is appeared. Did anybody meet the same pr开发者_JAVA百科oblem?


I ran into this too. The SID used in the example is incorrect. It should be "S-1-16-4096", not "S-1-16-1024".


I have upvoted @dyared's answer because it helped me find the complete answer. I should mention first that I am not specialized in this matter and this is only a summary of my findings.

It seems that the MSDN example does not work with the specified SID string because it specifies an integrity level that is too low. From the Chromium's source code, the S-1-16-1024 SID used in the example is between INTEGRITY_LEVEL_BELOW_LOW and INTEGRITY_LEVEL_UNTRUSTED:

const wchar_t* GetIntegrityLevelString(IntegrityLevel integrity_level) {
  switch (integrity_level) {
    case INTEGRITY_LEVEL_SYSTEM:
      return L"S-1-16-16384";
    case INTEGRITY_LEVEL_HIGH:
      return L"S-1-16-12288";
    case INTEGRITY_LEVEL_MEDIUM:
      return L"S-1-16-8192";
    case INTEGRITY_LEVEL_MEDIUM_LOW:
      return L"S-1-16-6144";
    case INTEGRITY_LEVEL_LOW:
      return L"S-1-16-4096";
    case INTEGRITY_LEVEL_BELOW_LOW:
      return L"S-1-16-2048";
    case INTEGRITY_LEVEL_UNTRUSTED:
      return L"S-1-16-0";
    case INTEGRITY_LEVEL_LAST:
      return NULL;
  }

Furthermore, it seems that the SID S-1-16-4096, suggested by @dyared, is also used when launching Internet Explorer in protected mode, as claimed in Creating a Process in Protected Mode on Windows Vista article on MSDN Blogs.

However, because it was enough to get the example working does not mean it is strict enough for every situation and choosing the appropriate integrity level must be made understanding its implications.

0

精彩评论

暂无评论...
验证码 换一张
取 消