|
|
 |
Author: Aaron Moore Date: May 5, 2008 13:41
For a little bit now I've been struggling with an issue involving
OpenProcess and CreateToolhelp32Snapshot. The issue revolves around a
single process returning ERROR_ACCESS_DENIED when I attempt to either call
CreateToolhelp32Snapshot on the process or OpenProcess. The target process
has Medium Integrity, is running in Session 1, is not protected, and is
being run as a standard user on Vista. My process that is attempting to
view the target process has all of the same permissions and is being run as
a standard user on Vista.
What I do not understand is that my process can call
CreateToolhelp32Snapshot on every other process of the same integrity level
on my test machine except one. My process has enabled debug permissions, so
that isn't an issue. It just doesn't seem to have permissions, but why? Is
there a way to design a process in windows Vista to prohibit
CreateToolhelp32Snapshot or OpenProcess from being called on it, even if
they normally could be called?
Note: If I run my process as an administrator, it is able to view the
target process fine. However, I obviously don't want to require my process
be run as an administrator just to view the modules loaded into other
processes.
|
|
|
|
|
|
|
|