c++ - 检查 Internet Explorer 保护模式

Question

我有几个问题:1) 据我所知，IEIsProtectedModeProcess 函数在 IE 扩展中使用有没有办法以编程方式知道 Internet Explorer 是否在 IE 之外以保护模式运行？

谢谢

Answer 1

这是一个值得尝试解决的有趣问题。我提到了 Writing Secure Code for Windows Vista来自微软出版社。

本质上，当 IE 处于保护模式时，它以“低”完整性级别运行。如果完整性级别大于低(如中或高)，则 IE 进程未在保护模式下运行。 Vista 上进程的默认完整性级别是“中”。这是一些代码，可以让您在给定进程的 pid 或进程句柄的情况下获得进程的完整性级别。如果您有 IWebBrowser2，则可以使用 GetWindowThreadProcessId 从 HWND 获取 pid .

DWORD GetProcessIntegrityLevel(HANDLE hProcess,
                                 wchar_t __out_ecount_z(cbIl) *wszIl,
                                 size_t cbIl) 
{
    if (!wszIl) return 0xffffffff;
    memset(wszIl,0,cbIl);
    DWORD err = 0;
    try {
        HANDLE hToken = NULL;
        if (!OpenProcessToken(hProcess, TOKEN_QUERY, &hToken))
            throw GetLastError();

        DWORD cbBuf = 0;
        if (GetTokenInformation(hToken,TokenIntegrityLevel,NULL,0,&cbBuf) != 0)
            throw GetLastError();
        TOKEN_MANDATORY_LABEL * pTml =
            reinterpret_cast<TOKEN_MANDATORY_LABEL*> (new char[cbBuf]);
        if (pTml &&
            GetTokenInformation(
            hToken,
            TokenIntegrityLevel,
            pTml,
            cbBuf,
            &cbBuf)) {
                CloseHandle(hToken);
                hToken = NULL;
                DWORD ridIl = *GetSidSubAuthority(pTml->Label.Sid, 0);
                if (ridIl < SECURITY_MANDATORY_LOW_RID)
                    wcscpy_s(wszIl,cbIl,L"?");
                else if (ridIl >= SECURITY_MANDATORY_LOW_RID &&
                    ridIl < SECURITY_MANDATORY_MEDIUM_RID)
                    wcscpy_s(wszIl,cbIl,L"Low");
                else if (ridIl >= SECURITY_MANDATORY_MEDIUM_RID &&
                    ridIl < SECURITY_MANDATORY_HIGH_RID)
                    wcscpy_s(wszIl,cbIl,L"Medium");
                else if (ridIl >= SECURITY_MANDATORY_HIGH_RID &&
                    ridIl < SECURITY_MANDATORY_SYSTEM_RID)
                    wcscpy_s(wszIl,cbIl,L"High");
                else if (ridIl >= SECURITY_MANDATORY_SYSTEM_RID)
                    wcscpy_s(wszIl,cbIl,L"System");
                if (ridIl > SECURITY_MANDATORY_LOW_RID &&
                    ridIl != SECURITY_MANDATORY_MEDIUM_RID &&
                    ridIl != SECURITY_MANDATORY_HIGH_RID &&
                    ridIl != SECURITY_MANDATORY_SYSTEM_RID)
                    wcscat_s(wszIl,cbIl,L"+");
                delete [] reinterpret_cast<char*>(pTml);
                pTml = NULL;
        } else {
            throw GetLastError();
        }
    } catch(DWORD dwErr) {
        err = dwErr;
        wprintf(L"Error %d",GetLastError());
    } catch(std::bad_alloc e) {
        err = ERROR_OUTOFMEMORY;
        wprintf(L"Error %d",err);
    }
    return err;
}



DWORD GetProcessIntegrityLevel(long pid,
                               wchar_t __out_ecount_z(cbIl) *wszIl,
                               size_t cbIl) 
{
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProcess != NULL)
        return GetProcessIntegrityLevel(hProcess, wszIl, cbIl);
    else 
        return -1;
}

DWORD GetProcessIntegrityLevel(wchar_t __out_ecount_z(cbIl) *wszIl,
                               size_t cbIl) 
{
    HANDLE currentProcess = GetCurrentProcess();
    return GetProcessIntegrityLevel(currentProcess, wszIl, cbIl);
}