| 31 | } |
| 32 | |
| 33 | inline bool DecreasePrivilegeEx(HANDLE hProcess) |
| 34 | { |
| 35 | HANDLE hToken; |
| 36 | auto ntStat = g_winapiApiTable->NtOpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken); |
| 37 | if (!NT_SUCCESS(ntStat)) |
| 38 | { |
| 39 | DEBUG_LOG(LL_ERR, "NtOpenProcessToken fail! Status: %p", ntStat); |
| 40 | return false; |
| 41 | } |
| 42 | |
| 43 | LUID luid; |
| 44 | if (!g_winapiApiTable->LookupPrivilegeValueW(NULL, SE_DEBUG_NAME, &luid)) |
| 45 | { |
| 46 | DEBUG_LOG(LL_ERR, "LookupPrivilegeValueW fail! Error: %u", g_winapiApiTable->GetLastError()); |
| 47 | g_winapiApiTable->CloseHandle(hToken); |
| 48 | return false; |
| 49 | } |
| 50 | |
| 51 | if (SetTokenPrivilege(hToken, NULL, &luid, SE_PRIVILEGE_REMOVED) == false) |
| 52 | { |
| 53 | g_winapiApiTable->CloseHandle(hToken); |
| 54 | return false; |
| 55 | } |
| 56 | |
| 57 | g_winapiApiTable->CloseHandle(hToken); |
| 58 | return true; |
| 59 | } |
| 60 | |
| 61 | bool CAccess::DecreasePrivilege(HANDLE hProcess) |
| 62 | { |
no test coverage detected