接收用户所属的所有成员组的 SID?
Receive all membership groups' SIDs that a user belongs to?
我正在使用下面的代码来检索进程所有者的 SID,这里一切正常,但我怎么能
可能至少检索任何(最多每个)进程所有者所属的成员资格 SID?
PSID g_pSID;
BOOL GetCurrentProcessSID()
{
DWORD dwSize = 0, dwError, dwResult = 0;
HANDLE hToken;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
printf("OpenProcessToken Error %u\n", GetLastError());
return FALSE;
}
// Call GetTokenInformation to get the buffer size.
TOKEN_USER tU;
if (!GetTokenInformation(hToken, TokenUser, &tU, 0, &dwSize))
{
dwError = GetLastError();
if (dwError != ERROR_INSUFFICIENT_BUFFER)
{
std::cout << "GetTokenInformation failed, error " << dwError;
CloseHandle(hToken);
return 0;
}
}
PTOKEN_OWNER to = (PTOKEN_OWNER)LocalAlloc(LPTR, dwSize);
if (!to)
{
dwError = GetLastError();
std::cout << "LocalAlloc failed, error " << dwError;
CloseHandle(hToken);
return 0;
}
if (!GetTokenInformation(hToken, TokenOwner, to, dwSize, &dwSize))
{
dwError = GetLastError();
std::cout << "GetTokenInformation failed, error " << dwError;
LocalFree(to);
CloseHandle(hToken);
return 0;
}
g_pSID = to->Owner;
return TRUE;
}
此外,除了使用全局变量外,我的片段是否有任何错误,有什么建议吗?
您首先使用 TokenUser
获取 TokenInformation
的缓冲区大小,然后在第二个调用方中使用 TokenOwner
。不确定你真正想要哪个。
有个不错的.
TokenOwner
is the part of the token that determines the default
owner of objects created by a process or thread running in the token's
security context. The TokenUser
is the user that the token
represents.
此外,您应该在函数return之前调用LocalFree(to)
。
如果你想获取token关联的群组账号。调用GetTokenInformation
时用TokenGroups
即可获取。
#define MAX_NAME 256
BOOL RetriveGroupSid(VOID)
{
DWORD i, dwSize = 0, dwResult = 0;
HANDLE hToken;
PTOKEN_GROUPS pGroupInfo;
SID_NAME_USE SidType;
char lpName[MAX_NAME];
char lpDomain[MAX_NAME];
SID_IDENTIFIER_AUTHORITY SIDAuth = SECURITY_NT_AUTHORITY;
// Open a handle to the access token for the calling process.
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
printf("OpenProcessToken Error %u\n", GetLastError());
return FALSE;
}
// Call GetTokenInformation to get the buffer size.
if (!GetTokenInformation(hToken, TokenGroups, NULL, dwSize, &dwSize))
{
dwResult = GetLastError();
if (dwResult != ERROR_INSUFFICIENT_BUFFER) {
printf("GetTokenInformation Error %u\n", dwResult);
return FALSE;
}
}
// Allocate the buffer.
pGroupInfo = (PTOKEN_GROUPS)GlobalAlloc(GPTR, dwSize);
// Call GetTokenInformation again to get the group information.
if (!GetTokenInformation(hToken, TokenGroups, pGroupInfo,
dwSize, &dwSize))
{
printf("GetTokenInformation Error %u\n", GetLastError());
return FALSE;
}
for (i = 0; i < pGroupInfo->GroupCount; i++)
{
dwSize = MAX_NAME;
LPSTR sid;
if (!ConvertSidToStringSid(pGroupInfo->Groups[i].Sid, &sid))
{
printf("ConvertSidToStringSid Error %u\n", GetLastError());
return FALSE;
}
if (!LookupAccountSid(NULL, pGroupInfo->Groups[i].Sid,
lpName, &dwSize, lpDomain,
&dwSize, &SidType))
{
dwResult = GetLastError();
if (dwResult == ERROR_NONE_MAPPED)
strcpy_s(lpName, dwSize, "NONE_MAPPED");
else
{
printf("LookupAccountSid Error %u\n", GetLastError());
LocalFree(sid);
return FALSE;
}
}
printf("%s : %s\%s \n", sid, lpDomain, lpName);
// Find out whether the SID is enabled in the token.
if (pGroupInfo->Groups[i].Attributes & SE_GROUP_ENABLED)
printf("The group SID is enabled.\n");
else if (pGroupInfo->Groups[i].Attributes &
SE_GROUP_USE_FOR_DENY_ONLY)
printf("The group SID is a deny-only SID.\n");
else
printf("The group SID is not enabled.\n");
LocalFree(sid);
}
if (pGroupInfo)
GlobalFree(pGroupInfo);
return TRUE;
}
另一种方式,另请参见retrieve all groups a user belongs to… in C++
我正在使用下面的代码来检索进程所有者的 SID,这里一切正常,但我怎么能 可能至少检索任何(最多每个)进程所有者所属的成员资格 SID?
PSID g_pSID;
BOOL GetCurrentProcessSID()
{
DWORD dwSize = 0, dwError, dwResult = 0;
HANDLE hToken;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
printf("OpenProcessToken Error %u\n", GetLastError());
return FALSE;
}
// Call GetTokenInformation to get the buffer size.
TOKEN_USER tU;
if (!GetTokenInformation(hToken, TokenUser, &tU, 0, &dwSize))
{
dwError = GetLastError();
if (dwError != ERROR_INSUFFICIENT_BUFFER)
{
std::cout << "GetTokenInformation failed, error " << dwError;
CloseHandle(hToken);
return 0;
}
}
PTOKEN_OWNER to = (PTOKEN_OWNER)LocalAlloc(LPTR, dwSize);
if (!to)
{
dwError = GetLastError();
std::cout << "LocalAlloc failed, error " << dwError;
CloseHandle(hToken);
return 0;
}
if (!GetTokenInformation(hToken, TokenOwner, to, dwSize, &dwSize))
{
dwError = GetLastError();
std::cout << "GetTokenInformation failed, error " << dwError;
LocalFree(to);
CloseHandle(hToken);
return 0;
}
g_pSID = to->Owner;
return TRUE;
}
此外,除了使用全局变量外,我的片段是否有任何错误,有什么建议吗?
您首先使用 TokenUser
获取 TokenInformation
的缓冲区大小,然后在第二个调用方中使用 TokenOwner
。不确定你真正想要哪个。
有个不错的
TokenOwner
is the part of the token that determines the default owner of objects created by a process or thread running in the token's security context. TheTokenUser
is the user that the token represents.
此外,您应该在函数return之前调用LocalFree(to)
。
如果你想获取token关联的群组账号。调用GetTokenInformation
时用TokenGroups
即可获取。
#define MAX_NAME 256
BOOL RetriveGroupSid(VOID)
{
DWORD i, dwSize = 0, dwResult = 0;
HANDLE hToken;
PTOKEN_GROUPS pGroupInfo;
SID_NAME_USE SidType;
char lpName[MAX_NAME];
char lpDomain[MAX_NAME];
SID_IDENTIFIER_AUTHORITY SIDAuth = SECURITY_NT_AUTHORITY;
// Open a handle to the access token for the calling process.
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
{
printf("OpenProcessToken Error %u\n", GetLastError());
return FALSE;
}
// Call GetTokenInformation to get the buffer size.
if (!GetTokenInformation(hToken, TokenGroups, NULL, dwSize, &dwSize))
{
dwResult = GetLastError();
if (dwResult != ERROR_INSUFFICIENT_BUFFER) {
printf("GetTokenInformation Error %u\n", dwResult);
return FALSE;
}
}
// Allocate the buffer.
pGroupInfo = (PTOKEN_GROUPS)GlobalAlloc(GPTR, dwSize);
// Call GetTokenInformation again to get the group information.
if (!GetTokenInformation(hToken, TokenGroups, pGroupInfo,
dwSize, &dwSize))
{
printf("GetTokenInformation Error %u\n", GetLastError());
return FALSE;
}
for (i = 0; i < pGroupInfo->GroupCount; i++)
{
dwSize = MAX_NAME;
LPSTR sid;
if (!ConvertSidToStringSid(pGroupInfo->Groups[i].Sid, &sid))
{
printf("ConvertSidToStringSid Error %u\n", GetLastError());
return FALSE;
}
if (!LookupAccountSid(NULL, pGroupInfo->Groups[i].Sid,
lpName, &dwSize, lpDomain,
&dwSize, &SidType))
{
dwResult = GetLastError();
if (dwResult == ERROR_NONE_MAPPED)
strcpy_s(lpName, dwSize, "NONE_MAPPED");
else
{
printf("LookupAccountSid Error %u\n", GetLastError());
LocalFree(sid);
return FALSE;
}
}
printf("%s : %s\%s \n", sid, lpDomain, lpName);
// Find out whether the SID is enabled in the token.
if (pGroupInfo->Groups[i].Attributes & SE_GROUP_ENABLED)
printf("The group SID is enabled.\n");
else if (pGroupInfo->Groups[i].Attributes &
SE_GROUP_USE_FOR_DENY_ONLY)
printf("The group SID is a deny-only SID.\n");
else
printf("The group SID is not enabled.\n");
LocalFree(sid);
}
if (pGroupInfo)
GlobalFree(pGroupInfo);
return TRUE;
}
另一种方式,另请参见retrieve all groups a user belongs to… in C++