RtlSetProcessIsCritical将进程设置为系统严重状态(防止进程被结束)

最新推荐文章于 2023-08-21 14:09:23 发布

125096

最新推荐文章于 2023-08-21 14:09:23 发布

阅读量3.8k

点赞数

分类专栏： windows编程

本文链接：https://blog.csdn.net/qq125096885/article/details/53572223

版权

windows编程专栏收录该内容

107 篇文章 3 订阅

订阅专栏

#include <stdio.h>
#include <windows.h>

bool EnableDebugPrivilege();

typedef NTSTATUS(__cdecl *fnRtlSetProcessIsCritical)(IN  BOOLEAN  NewValue, OUT PBOOLEAN OldValue OPTIONAL, IN  BOOLEAN  CheckFlag);
fnRtlSetProcessIsCritical pRtlSetProcessIsCritical;


int main(void)
{

	EnableDebugPrivilege();

	HMODULE  hNtdll = GetModuleHandle(TEXT("ntdll.dll"));
	if (hNtdll)
	{
		pRtlSetProcessIsCritical = (fnRtlSetProcessIsCritical)GetProcAddress(hNtdll, "RtlSetProcessIsCritical");
		if (pRtlSetProcessIsCritical)
		{
			pRtlSetProcessIsCritical(TRUE, NULL, FALSE);
		}
	}


	getchar();
	getchar();
	if (pRtlSetProcessIsCritical)
	{
		pRtlSetProcessIsCritical(FALSE, NULL, FALSE);
	}
	getchar();
	getchar();
	return 0;
}


bool EnableDebugPrivilege()
{
	HANDLE hToken;
	LUID sedebugnameValue;
	TOKEN_PRIVILEGES tkp;
	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
	{
		return   false;
	}
	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
	{
		CloseHandle(hToken);
		return false;
	}
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = sedebugnameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
	{
		CloseHandle(hToken);
		return false;
	}
	return true;
}