MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / GetProcessIntegrityLevel

Function GetProcessIntegrityLevel

r77api/r77win.c:189–216  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

187 return module ? (LPVOID)GetProcAddress(module, function) : NULL;
188}
189BOOL GetProcessIntegrityLevel(HANDLE process, LPDWORD integrityLevel)
190{
191 BOOL result = FALSE;
192
193 HANDLE token;
194 if (OpenProcessToken(process, TOKEN_QUERY, &token))
195 {
196 DWORD tokenSize;
197 if (!GetTokenInformation(token, TokenIntegrityLevel, NULL, 0, &tokenSize) && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
198 {
199 PTOKEN_MANDATORY_LABEL tokenMandatoryLabel = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, tokenSize);
200 if (tokenMandatoryLabel)
201 {
202 if (GetTokenInformation(token, TokenIntegrityLevel, tokenMandatoryLabel, tokenSize, &tokenSize))
203 {
204 *integrityLevel = *GetSidSubAuthority(tokenMandatoryLabel->Label.Sid, *GetSidSubAuthorityCount(tokenMandatoryLabel->Label.Sid) - 1);
205 result = TRUE;
206 }
207
208 LocalFree(tokenMandatoryLabel);
209 }
210 }
211
212 CloseHandle(token);
213 }
214
215 return result;
216}
217BOOL GetProcessFileName(DWORD processId, PWCHAR fileName, DWORD fileNameLength)
218{
219 BOOL result = FALSE;

Callers 2

InjectDllFunction · 0.85
GetProcessListFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected