myvtm/Module/mod_BranchDevice/TWProcHelper.h

#ifndef _TWINKLE_PROCESS_HELPER_H_
#define _TWINKLE_PROCESS_HELPER_H_

#pragma comment(lib, "advapi32.lib")

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <Psapi.h>
#include <Sddl.h>
#include <AccCtrl.h>
#include <Aclapi.h>
#include <userenv.h>
#include <TlHelp32.h>
#include <Accctrl.h>
#include <Aclapi.h>
#include <Ntsecapi.h>
//#include <Ntstatus.h>
#include "SpFSM.h"

#ifndef STATUS_SUCCESS
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#endif


#pragma comment(lib, "Psapi.lib")

#pragma comment(lib, "netapi32.lib")

#pragma comment(lib, "Userenv.lib")

#include <lm.h>

#define MAX_NAME 256

#define TWHeapAlloc(x) (HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, x))
#define TWHeapFree(x)  (HeapFree(GetProcessHeap(), 0, x))

#define DESKTOP_ALL (DESKTOP_READOBJECTS | DESKTOP_CREATEWINDOW | \
	DESKTOP_CREATEMENU | DESKTOP_HOOKCONTROL | DESKTOP_JOURNALRECORD | \
	DESKTOP_JOURNALPLAYBACK | DESKTOP_ENUMERATE | DESKTOP_WRITEOBJECTS | \
	DESKTOP_SWITCHDESKTOP | STANDARD_RIGHTS_REQUIRED)

#define WINSTA_ALL (WINSTA_ENUMDESKTOPS | WINSTA_READATTRIBUTES | \
	WINSTA_ACCESSCLIPBOARD | WINSTA_CREATEDESKTOP | \
	WINSTA_WRITEATTRIBUTES | WINSTA_ACCESSGLOBALATOMS | \
	WINSTA_EXITWINDOWS | WINSTA_ENUMERATE | WINSTA_READSCREEN | \
	STANDARD_RIGHTS_REQUIRED)

#define GENERIC_ACCESS (GENERIC_READ | GENERIC_WRITE | \
	GENERIC_EXECUTE | GENERIC_ALL)

BOOL StartInteractiveClientProcess (
	LPTSTR lpszUsername,    // client to log on
	LPTSTR lpszDomain,      // domain of client's account
	LPTSTR lpszPassword,    // client's password
	LPTSTR lpCommandLine,    // command line to execute
	LPSTARTUPINFO psi,
	DWORD fdwCreate,
	PDWORD pDwProcessId
	);

class CTWProcHelper
{
public:
	CTWProcHelper(void);
	CTWProcHelper(HANDLE hJob);
	~CTWProcHelper(void);

	operator HANDLE() const { return(m_hJob); }

	BOOL Create(PSECURITY_ATTRIBUTES psa, PCTSTR pszName);
	BOOL Open(PCTSTR pszName, DWORD dwDesiredAccess, BOOL fInheritHandle);
	BOOL AssignProcess(HANDLE hProcess);
	BOOL AssignProcess(DWORD dwProcessId);

	BOOL DestoryProcess(DWORD dwProcessId);

	void GetProcessName(DWORD PID, PTSTR szProcessName, size_t cchSize);

	BOOL SetBasicLimitInfo(PJOBOBJECT_BASIC_LIMIT_INFORMATION pjobli);
	BOOL SetExtendedLimitInfo(PJOBOBJECT_EXTENDED_LIMIT_INFORMATION pjobeli);
	BOOL SetBasicUIRestrictions(DWORD fdwLimits);
	BOOL SetSecurityLimitInfo(PJOBOBJECT_SECURITY_LIMIT_INFORMATION pjobsli);

	BOOL SetEndOfJobInfo(DWORD fdwEndOfJobInfo = JOB_OBJECT_TERMINATE_AT_END_OF_JOB);
	BOOL QueryEndOfJobTimeInfo(PDWORD pfdwEndOfJobTimeInfo);

	BOOL QueryBaseAndIOInfo(PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION pjobai);
	BOOL QueryExtendLimitInfo(PJOBOBJECT_EXTENDED_LIMIT_INFORMATION pjobeli);

	BOOL QueryBasicProcessIdList(
		DWORD dwMaxProcesses, PDWORD pdwProcessIdList, PDWORD pdwProcessesReturned);

	BOOL QueryBasicUIRestrictions(PDWORD pfdwRestrictions);
	BOOL QuerySecurityLimitInfo(PJOBOBJECT_SECURITY_LIMIT_INFORMATION pjosli);

	BOOL AssociateCompletionPort(HANDLE hIOCP, ULONG_PTR CompKey);
	BOOL QueryAssociatedCompletionPort(PJOBOBJECT_ASSOCIATE_COMPLETION_PORT pjoacp);
	
	BOOL Terminate(UINT uExitCode);

private:
	HANDLE m_hJob;

public:
	/*++
     Function : ModifyDefaultDacl
     Synopsis : Add EVERYONE ACE to the process token DACL.
     Parameter: hProcess - Handle to process to modify the DACL.
     Return   : 0 if successful, otherwise error code.
	--*/ 
	static DWORD ModifyDefaultDacl(HANDLE hProcess);

	//Allow or disallow a process to perform system-level actions.
	//See more: https://msdn.microsoft.com/en-us/library/bb530716(v=vs.85).aspx
	static BOOL SetPrivilege(
		HANDLE hToken,          // access token handle
		LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
		BOOL bEnablePrivilege   // to enable or disable privilege
		);

	static BOOL SetPrivilege(LPCTSTR lpszPrivilege,  BOOL bEnablePrivilege);



	//<param:lpCommandLine>: command line to execute
	static BOOL CreateLowerProcess(LPTSTR lpCommandLine);

	static BOOL GetProcessIntegrityLevel(HANDLE hProcess, PDWORD pIntegrityLevel, 
		PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy);

	static BOOL GetProcessIntegrityLevel(DWORD PID, PDWORD pIntegrityLevel, 
		PDWORD pPolicy, PDWORD pResourceIntegrityLevel, PDWORD pResourcePolicy);

	static BOOL CreateSecurityDescriptor();

	static DWORD AddAceToObjectsSecurityDescriptor (
		LPTSTR pszObjName,          // name of object
		SE_OBJECT_TYPE ObjectType,  // type of object
		LPTSTR pszTrustee,          // trustee for new ACE
		TRUSTEE_FORM TrusteeForm,   // format of trustee structure
		DWORD dwAccessRights,       // access mask for new ACE
		ACCESS_MODE AccessMode,     // type of ACE
		DWORD dwInheritance         // inheritance flags for new ACE
		) ;

	static BOOL TakeOwnership(LPTSTR lpszOwnFile);

	static BOOL FindOwnerOfFile(LPCTSTR lpszOwnFile, LPTSTR lpszOwnerAccount);

	static LPCTSTR ErrorMessage(DWORD error);

	static void PrintError(LPCTSTR errDesc);

	static void PrintInfo(LPCTSTR lpszDesc);

	//降低线程的完整性级别
	static BOOL LowerThreadIntegirtyLevel();

	static void SetLowLabelToFile(LPCTSTR lpszFileName);
	
	static BOOL GetSecurityDescriptorOfFile(LPCSTR lpszFileName, PSECURITY_DESCRIPTOR *ppSD);
	static BOOL CustomAccessCheck(LPTSTR lpszFileName);

	static BOOL ImpersonateAndCheckAccess(
		PSECURITY_DESCRIPTOR pSD,        // security descriptor to check
		DWORD dwAccessDesired,           // access rights to check
		PGENERIC_MAPPING pGeneric,       // generic mapping for object
		PDWORD pdwAccessAllowed          // returns allowed access rights
		);

	static BOOL SearchTokenGroupsForSID (VOID);

	static BOOL AddUserAccount();
	static BOOL AddMemberToGroup();

	static BOOL GetTokenByName(HANDLE &hToken,LPSTR lpName);

	static BOOL GetPIDByName(LPCTSTR lpszPName, DWORD& dwProcessID);

	static BOOL CreateSystemProcess( LPTSTR szProcessName);

	static BOOL GetPrivilegeLUIDWithSID(PSID pSID, PLUID *pLUID, PDWORD pDwCount);
};

#endif //_TWINKLE_PROCESS_HELPER_H_