Chris:

Can i raise a process(A) integrity level to medium from a low integrity process(B). Is it a good practice?

Chris:

Thanks for your response. What i meant is i want to convert a process from low integrity level to medium integrity level.

I wanted to do the oppposite as the function "CreateLowProcess()" from the below URL

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/IETechCol/dnwebgen/ProtectedMode.asp

-SR

It creates the low integrity process but it doesnt launch it on the desktop. Any way around this?

Chris,

Thanks for your response.

I duplicate the handle of my medium integrity process, set its token information to low integrity and run notepad using CreateProcessAsUser.

Notepad process was created but it was not launched on the desktop.

Ganesh

Hi Chris,

I just created a console app that start starts notepad with low IL. Here is the code snippet. Its almost same as the one in the site.

{

   BOOL                  fRet;

   HANDLE                hToken        = NULL;

   HANDLE                hNewToken     = NULL;

HWND h;

   PSID                  pIntegritySid = NULL;

   TOKEN_MANDATORY_LABEL TIL           = {0};

   PROCESS_INFORMATION   ProcInfo      = {0};

   STARTUPINFO           StartupInfo   = {0};

LPSTR wszProcessName = "C:\\Windows\\Notepad.exe";

LPSTR wszIntegritySid = "S-1-16-1024";

pIntegritySid = NULL;

   fRet = OpenProcessToken(GetCurrentProcess(),

                           TOKEN_DUPLICATE |

                             TOKEN_ADJUST_DEFAULT |

                             TOKEN_QUERY |

                             TOKEN_ASSIGN_PRIMARY,

                           &hToken);

   if (!fRet)

   {

   printf("Open process failed\n");

           goto CleanExit;

   }

else

   printf("Open process succeeded\n");

   fRet = DuplicateTokenEx(hToken,

                           0,

                           NULL,

                           SecurityImpersonation,

                           TokenPrimary,

                           &hNewToken);

   if (!fRet)

   {

printf("duplicate token creation failed\n");

               goto CleanExit;

   }

else

printf("duplicate token done\n");

   fRet = ConvertStringSidToSid(wszIntegritySid, &pIntegritySid);

   if (!fRet)

   {

printf("Conversion failed\n");

               goto CleanExit;

   }

else

printf("convert done\n");

   TIL.Label.Attributes = SE_GROUP_INTEGRITY|SE_GROUP_INTEGRITY_ENABLED;

   TIL.Label.Sid        = pIntegritySid;

   //

   // Set the process integrity level

   //

   fRet = SetTokenInformation(hNewToken,

                              TokenIntegrityLevel,

                              &TIL,

                              sizeof(TOKEN_MANDATORY_LABEL) + GetLengthSid(pIntegritySid));

   if (!fRet)

   {

printf("Setting token info failed\n");

       goto CleanExit;

   }

else

printf("setting token done\n");

   //

   // Create the new process at Low integrity

   //

   StartupInfo.cb= sizeof(STARTUPINFO);

   fRet  = CreateProcessAsUser(hNewToken,

                               wszProcessName,

                               0,

                               NULL,

                               NULL,

                               FALSE,

                               0,

                               NULL,

                               NULL,

                               &StartupInfo,

                               &ProcInfo);

if(!fRet)

printf("Process not created\n");

else{

printf("Process created\n");

   }

CleanExit:

   if (ProcInfo.hProcess != NULL)

   {

       CloseHandle(ProcInfo.hProcess);

   }

   if (ProcInfo.hThread != NULL)

   {

       CloseHandle(ProcInfo.hThread);

   }

   LocalFree(pIntegritySid);

   if (hNewToken != NULL)

   {

       CloseHandle(hNewToken);

   }

   if (hToken != NULL)

   {

       CloseHandle(hToken);

   }

  // return fRet;

return 0;

}

The output is

Open process succeeded

duplicate token done

convert done

setting token done

Process created

But opening notepad has failed with error code 0xc0000022. Message box is displayed as

"The application failed to initialize properly(0xc0000022). Click OK to terminate the application."

Looks like that error has again got to do with privileges. And my UAC is ON.

Thanks,

Ganesh.

Hi Chris,

Well I managed to solve that low integrity problem. But having an other problem in Vista.

I need to selectively delete certain items from the I.E. cache.

When I iterate through the I.E. cache on Windows Vista, only the entries in Visited container are enumerated.

Has anything changed in Windows Vista to break the FindFirstUrlCacheEntry /

FindNextUrlCacheEntry method of iterating through the cache?

Thanks,

Ganesh

I wasn't looking for your advanced info.; just thought my Protected Mode should be "On".

<duanekisshauer@comcast.net>