c++ - CreateProcessAsUser - 使用不同的父进程创建进程？

Question

我在 MSDN 上读到 UAC 的实现: http://technet.microsoft.com/en-us/magazine/2007.06.uac.aspx

偶然发现这条有趣的线:

Although AIS is technically the parent of the elevated process, AIS uses new support in the CreateProcessAsUser API that sets the process’s parent process ID to that of the process that originally launched it (see Figure 13).

这是 CreateProcessAsUser 的 MSDN 页面:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms682429(v=vs.85).aspx

BOOL WINAPI CreateProcessAsUser(
  _In_opt_     HANDLE hToken,
  _In_opt_     LPCTSTR lpApplicationName,
  _Inout_opt_  LPTSTR lpCommandLine,
  _In_opt_     LPSECURITY_ATTRIBUTES lpProcessAttributes,
  _In_opt_     LPSECURITY_ATTRIBUTES lpThreadAttributes,
  _In_         BOOL bInheritHandles,
  _In_         DWORD dwCreationFlags,
  _In_opt_     LPVOID lpEnvironment,
  _In_opt_     LPCTSTR lpCurrentDirectory,
  _In_         LPSTARTUPINFO lpStartupInfo,
  _Out_        LPPROCESS_INFORMATION lpProcessInformation
);

exert 说我们可以创建一个进程并通过使用 API 中的选项设置不同的父进程。我不确定该怎么做？我需要深入研究 token 吗？

Answer 1

此功能记录在 InitializeProcThreadAttributeList 的 MSDN 条目中和 UpdateProcThreadAttribute功能。

特别是查看 PROC_THREAD_ATTRIBUTE_PARENT_PROCESS 属性:

The lpValue parameter is a pointer to a handle to a process to use instead of the calling process as the parent for the process being created. The process to use must have the PROCESS_CREATE_PROCESS access right.