修改DACL以防止每个人都在没有调试特权的情况下杀死进程

Question

我有一些编写的代码。我需要在没有用户Debug Privilege的情况下将Windows 10中的DACL（安全描述符）修改为prevent kill process。我该怎么办？我在互联网算法上学习，为此寻找了一些功能，但是进程仍然关闭，没有任何问题。我尝试了很多次调试，代码可以正常运行，但没有错误。

我该如何解决这个问题？对于下面的示例，i为拒绝的PROCESS_TERMINATE添加ACE。是正确的方法吗？

还建议我如何检查。我知道我将获得权限被拒绝的MessageBox，是吗？

我的代码（已更新）：

#include <iostream>
#include <Windows.h>
PSECURITY_DESCRIPTOR GetProcessSecurityDescriptor(HANDLE processHandle, DWORD &buffSizeNeeded);
void SecurityDescriptorModifier(HANDLE hProcess);

int main()
{
    DWORD pID;
    std::cin >> pID;

    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, false, pID);
    SecurityDescriptorModifier(processHandle);

    HANDLE pHandle = OpenProcess(PROCESS_TERMINATE, false, pID);

    return 0;
}



void SecurityDescriptorModifier(HANDLE hProcess)
{
    DWORD                 SIDLength = 0;
    PSID                 SID;
    PACL                 pACL;   
    PACL                 pNewAcl;
    BOOL                 bDaclExist;
    BOOL                 bDaclPresent;
    PSECURITY_DESCRIPTOR pSecurityDescriptor;
    PSECURITY_DESCRIPTOR pSecurityDescriptorNew;
    ACL_SIZE_INFORMATION aclSizeInfo;
    DWORD                 dwNewAclSize;
    ACCESS_ALLOWED_ACE*  pACE;
    PVOID                pTempAce;
    DWORD buffSizeNeeded = -1;


    // "everyone" group
    //CreateWellKnownSid(WinWorldSid, NULL, NULL, &SIDLength);
    // Allocate enough memory for the largest possible SID.
    SIDLength = SECURITY_MAX_SID_SIZE;
    if (!(SID = LocalAlloc(LMEM_FIXED, SIDLength)))
    {
        fprintf(stderr, "Could not allocate memory.\n");
        exit(1);
    }

    //SID = new byte[SECURITY_MAX_SID_SIZE];
    if (!CreateWellKnownSid(WinWorldSid, NULL, SID, &SIDLength))
    {
        fprintf(stderr,
            "CreateWellKnownSid Error %u",
            GetLastError());
        LocalFree(SID);
    }

    pSecurityDescriptor = GetProcessSecurityDescriptor(hProcess, buffSizeNeeded);

    BOOL executionResult = GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pACL, &bDaclExist);

    if(!executionResult)
    {
        fprintf(stderr, "GetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }

    pSecurityDescriptorNew = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buffSizeNeeded);

    if (pSecurityDescriptorNew == NULL)
        exit(1);
    else
        printf("Heap allocated for psdNew!\n");

    // Create a new security descriptor
    if (!InitializeSecurityDescriptor(pSecurityDescriptorNew, SECURITY_DESCRIPTOR_REVISION))
    {
        fprintf(stderr, "InitializeSecurityDescriptor() failed, error %d\n", GetLastError());
        exit(1);
    }

    // Obtain the DACL from the security descriptor
    if (!GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pACL, &bDaclExist))
    {
        fprintf(stderr, "GetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }

    // Initialize
    ZeroMemory(&aclSizeInfo, sizeof(ACL_SIZE_INFORMATION));
    aclSizeInfo.AclBytesInUse = sizeof(ACL);


    // Call only if NULL DACL
    if (pACL != NULL)
    {
        // Determine the size of the ACL information
        if (!GetAclInformation(pACL, (LPVOID)& aclSizeInfo, sizeof(ACL_SIZE_INFORMATION), AclSizeInformation))
        {
            fprintf(stderr, "GetAclInformation() failed, error %d\n", GetLastError());
            exit(1);
        }
    }

    // Compute the size of the new ACL
    dwNewAclSize = aclSizeInfo.AclBytesInUse + sizeof(ACCESS_DENIED_ACE) + GetLengthSid(SID) - sizeof(DWORD);

    // Allocate buffer for the new ACL
    pNewAcl = (PACL)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwNewAclSize);

    if (pNewAcl == NULL)
        exit(1);

    // Initialize the new ACL
    if (!InitializeAcl(pNewAcl, dwNewAclSize, ACL_REVISION))
    {

        fprintf(stderr, "InitializeAcl() failed, error %d\n", GetLastError());
        exit(1);
    }
        static const DWORD dwPoison = PROCESS_TERMINATE;

    BOOL bResult = AddAccessDeniedAce(pNewAcl, ACL_REVISION, dwPoison, SID);

    if (FALSE == bResult)
    {
        printf("AddAccessDenied Error %d\n", GetLastError());
    }


    // If DACL is present, copy it to a new DACL
    if (!bDaclPresent)
    {
        // Copy the ACEs to the new ACL.
        if (aclSizeInfo.AceCount)
        {
            for (int i = 0; i < aclSizeInfo.AceCount; i++)
            {
                // Get an ACE.
                if (!GetAce(pACL, i, &pTempAce))
                {
                    fprintf(stderr, "GetAce() failed, error %d\n", GetLastError());
                    exit(1);
                }
                else
                    fprintf(stderr, "GetAce working\n");


                // Add the ACE to the new ACL.
                if (!AddAce(pNewAcl, ACL_REVISION, MAXDWORD, pTempAce, ((PACE_HEADER)pTempAce)->AceSize))
                {
                    fprintf(stderr, "AddAce() failed, error %d\n", GetLastError());
                    exit(1);
                }
                else
                    fprintf(stderr, "AddAce() is working!\n");
            }

        }

    }


    if (!SetSecurityDescriptorDacl(pSecurityDescriptorNew, TRUE, pNewAcl, FALSE))
    {
        printf("SetSecurityDescriptorDacl() failed, error %d\n", GetLastError());
        exit(1);
    }
    else
        printf("SetSecurityDescriptorDacl() is working!\n");

    // Set the new security descriptor for the window station
    if (!SetKernelObjectSecurity(hProcess, DACL_SECURITY_INFORMATION, pSecurityDescriptorNew))
    {
        printf("SetUserObjectSecurity() failed, error %d\n", GetLastError());
        exit(1);
    }
    else
        printf("SetUserObjectSecurity() is working!\n");
}


PSECURITY_DESCRIPTOR GetProcessSecurityDescriptor(HANDLE processHandle, DWORD &buffSizeNeeded)
{
    PSECURITY_DESCRIPTOR pSD = new byte[0];
    SECURITY_INFORMATION si = DACL_SECURITY_INFORMATION;

    // To understand actual needed size for pSD
    // GetKernelObject, what diff?
    GetKernelObjectSecurity(processHandle, si, pSD, 0, &buffSizeNeeded);

    if (buffSizeNeeded <= 0)
    {
        fprintf(stderr, ":GetKernelObjectSecurity ERROR: %u\n", GetLastError());
        exit(1);
    }

    pSD = (PSECURITY_DESCRIPTOR)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buffSizeNeeded);

    if (pSD == NULL)
        exit(1);
    else
        printf("Heap allocated for psdNew!\n");

    //Allocate Memory & get DACL
    if (!GetKernelObjectSecurity(processHandle, si, pSD, buffSizeNeeded, &buffSizeNeeded))
    {
        fprintf(stderr, ":GetKernelObjectSecurity(With Alloc) ERROR: %u\n", GetLastError());
        exit(1);
    }

    return pSD;
}

Answer 1

[if (!bDaclPresent)更改为if (bDaclPresent)] >>