在看到ARK工具上的Process句柄权限数值觉得当时理解有点模糊,来写个Blog加深印象。
PROCESS_ALL_ACCESS 对应1FFFFF
低16位从低位到高位分别对应
0:PROCESS_TERMINATE 0x0001
1:PROCESS_CREATE_THREAD 0x0002
2:PROCESS_SET_SESSIONID 0x0004
3:PROCESS_VM_OPERATION 0x0008
----------------
4:PROCESS_VM_READ 0x0010
5:PROCESS_VM_WRITE 0x0020
6:PROCESS_DUP_HANDLE 0x0040
7:PROCESS_CREATE_PROCESS 0x0080
----------------
8:PROCESS_SET_QUOTA 0x0100
9:PROCESS_SET_INFORMATION 0x0200
10:PROCESS_QUERY_INFORMATION 0x0400
11:PROCESS_SUSPEND_RESUME 0x0800
----------------
12:PROCESS_QUERY_LIMITED_INFORMATION 0x1000
13:PROCESS_SET_LIMITED_INFORMATION 0x2000
14:UNKNOW 0x4000
15:UNKNOW 0x8000