c++ - 来自 C++ 服务的 CreateProcessAsUser 创建进程但没有控制台

Question

我正在开发使用 CreateProcessAsUser 函数的 C++ 服务。我已经在 Windows 7 上对此进行了测试，并且运行良好。但我现在正在测试我的 Windows 10 代码，它不想工作，但进程已创建并在任务管理器中可见，只是没有创建窗口/控制台。我现在正在尝试仅使用 cmd 而不使用任何参数的代码片段我将非常感谢任何形式的帮助

我可以通过任务管理器看到这一点，因此我的进程已创建。 task manager

    PROCESS_INFORMATION pi;
   STARTUPINFO si;
   BOOL bResult = FALSE;
   DWORD dwSessionId;
   HANDLE hUserToken;
    // Log the client on to the local computer.
   dwSessionId = WTSGetActiveConsoleSessionId();    
   WTSQueryUserToken(dwSessionId,&hUserToken);
   ZeroMemory(&si, sizeof(STARTUPINFO));
   si.cb= sizeof(STARTUPINFO);
   si.lpDesktop = L"winsta0\\default";
   ZeroMemory(&pi, sizeof(pi));    
   LPVOID pEnv =NULL;    
   if(CreateEnvironmentBlock(&pEnv,hUserToken,TRUE)){
   }
   else
      pEnv=NULL;    
   bResult = CreateProcessAsUser(
      hUserToken,                     // client's access token
      L"C:\\Windows\\System32\\cmd.exe",    // file to execute
      L"",                 // command line
      NULL,            // pointer to process SECURITY_ATTRIBUTES
      NULL,               // pointer to thread SECURITY_ATTRIBUTES
      FALSE,              // handles are not inheritable
      CREATE_UNICODE_ENVIRONMENT|HIGH_PRIORITY_CLASS,     // creation flags
      pEnv,               // pointer to new environment block
      NULL,               // name of current directory
      &si,               // pointer to STARTUPINFO structure
      &pi                // receives information about new process
   );    
   //Perform All the Close Handles tasks  
   DestroyEnvironmentBlock(pEnv);
   CloseHandle(pi.hThread);
   CloseHandle(pi.hProcess);
   CloseHandle(hUserToken);

Answer 1

#define LAA(se) {{se},SE_PRIVILEGE_ENABLED|SE_PRIVILEGE_ENABLED_BY_DEFAULT}

#define BEGIN_PRIVILEGES(tp, n) static const struct {ULONG PrivilegeCount;LUID_AND_ATTRIBUTES Privileges[n];} tp = {n,{
#define END_PRIVILEGES }};

ULONG adjustPrivileges()
{
    HANDLE hToken;

    ULONG err;
    if (OpenProcessToken(NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
    {
        BEGIN_PRIVILEGES(tp, 2)
            LAA(SE_ASSIGNPRIMARYTOKEN_PRIVILEGE),
            LAA(SE_INCREASE_QUOTA_PRIVILEGE),
        END_PRIVILEGES  

        AdjustTokenPrivileges(hToken, FALSE, (::PTOKEN_PRIVILEGES)&tp, 0, 0, 0);

        err = GetLastError();

        CloseHandle(hToken);
    }
    else
    {
        err = GetLastError();
    }

    return err;
}

ULONG cup()
{
    HANDLE hUserToken;

    DWORD dwSessionId = WTSGetActiveConsoleSessionId();

    if (dwSessionId == MAXDWORD)
    {
        return ERROR_GEN_FAILURE;
    }

    ULONG err = adjustPrivileges();

    if (err)
    {
        return err;
    }

    if (WTSQueryUserToken(dwSessionId,&hUserToken))
    {
        PVOID pEnv;

        if (CreateEnvironmentBlock(&pEnv,hUserToken,TRUE))
        {
            PROCESS_INFORMATION pi;
            STARTUPINFO si = { sizeof(STARTUPINFO) };
            si.lpDesktop = L"winsta0\\default";

            if (CreateProcessAsUser(
                hUserToken,                     // client's access token
                L"C:\\Windows\\System32\\cmd.exe",    // file to execute
                NULL,                 // command line
                NULL,            // pointer to process SECURITY_ATTRIBUTES
                NULL,               // pointer to thread SECURITY_ATTRIBUTES
                FALSE,              // handles are not inheritable
                CREATE_UNICODE_ENVIRONMENT|HIGH_PRIORITY_CLASS,  // creation flags
                pEnv,               // pointer to new environment block
                NULL,               // name of current directory
                &si,               // pointer to STARTUPINFO structure
                &pi                // receives information about new process
                ))
            {
                CloseHandle(pi.hThread);
                CloseHandle(pi.hProcess);
            }
            else
            {
                err = GetLastError();
            }

            DestroyEnvironmentBlock(pEnv);

        }
        else
        {
            err = GetLastError();
        }
        CloseHandle(hUserToken);
    }
    else
    {
        err = GetLastError();
    }
    return err;
}