JEDI Windows API » Process http://blog.delphi-jedi.net Joint Endeavor of Delphi Innovators of Windows Programming Wed, 19 Oct 2011 18:52:10 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Restrict access to process http://blog.delphi-jedi.net/2008/11/08/restrict-access-to-process/ http://blog.delphi-jedi.net/2008/11/08/restrict-access-to-process/#comments Sat, 08 Nov 2008 21:58:11 +0000 Christian Wimmer http://blog.delphi-jedi.net/?p=271 The following code is really simple. It restricts access to the current process. In this way no other process can open the process handle and for example terminate this process.

uses
  JwaWindows,
  JwsclSecureObjects,
  JwsclDescriptor,
  JwsclToken,
  JwsclTypes,
  JwsclAcl,
  JwsclKnownSid;

var
  SD : TJwSecurityDescriptor;
  hProcess : TJwProcessHandle;
begin
  JwInitWellKnownSIDs;

  hProcess := OpenProcess(READ_CONTROL or WRITE_DAC, false, GetCurrentProcessId());
  if hProcess <> 0 then
  try
    SD := TJwSecureGeneralObject.GetSecurityInfo(hProcess,SE_KERNEL_OBJECT, [siDaclSecurityInformation]);
    try
      SD.DACL.Clear;
      SD.DACL.Add(TJwDiscretionaryAccessControlEntryAllow.Create(nil, [], GENERIC_ALL, JwLocalSystemSID));

      //allow read access to the current user
      SD.DACL.Add(TJwDiscretionaryAccessControlEntryAllow.Create(nil, [], GENERIC_READ, JwSecurityProcessUserSID));

      TJwSecureGeneralObject.SetSecurityInfo(hProcess, SE_KERNEL_OBJECT, [siDaclSecurityInformation], SD);
    finally
      SD.Free;
    end;
  finally
    CloseHandle(hProcess);
  end;
end;

However there are some problems:

  1. This code does not prevent the user from reverting the process DACL to the original state. An owner of the process can always change the DACL even if she is not listed in it. So the code just prevents a beginner from closing the application forcefully.
  2. Any user with the DEBUG privilege can open the process with full access using OpenProcess. The taskmanager uses this way to terminate a process – if TaskManager is started with administrative rights.

The only way to prevent a restricted user from terminating the application is to run the process with a foreign account (e.g. CreateProcessAsUser) and make sure that the user is not listed in the DACL. However if this user gets the DEBUG privilege the game is over.

]]> http://blog.delphi-jedi.net/2008/11/08/restrict-access-to-process/feed/ 6 CreateProcess in full glory http://blog.delphi-jedi.net/2008/04/11/createprocess-in-full-glory/ http://blog.delphi-jedi.net/2008/04/11/createprocess-in-full-glory/#comments Fri, 11 Apr 2008 11:11:40 +0000 Christian Wimmer http://blog.delphi-jedi.net/?p=114 CreateProcess is a little tricky to use. Thus I write the full example code here so you don’t have to worry.

uses SysUtils, JwaWindows, JwsclStrings;

procedure StartApp(const App, Parameters, CurDir : TJwString);
var
  StartupInfo: {$IFDEF UNICODE}TStartupInfoW{$ELSE}TStartupInfoA{$ENDIF};
  ProcInfo : TProcessInformation;
  pEnv : Pointer;

  pCurDir,
  pCmdLine : TJwPChar;
begin
  ZeroMemory(@StartupInfo, sizeof(StartupInfo));
  StartupInfo.cb          := SizeOf(StartupInfo);
  StartupInfo.lpDesktop   := ‘winsta0\default’;

  CreateEnvironmentBlock(@pEnv, 0, true);

  try
    if Length(Parameters) > 0 then
      pCmdLine := TJwPChar(‘"’+App+‘" ‘ + Parameters)
    else
      pCmdLine := TJwPChar(‘"’+App+‘" ‘);

    pCurDir := Nil;
    if Length(CurDir) > 0 then
      pCurDir := TJwPChar(CurDir);

   if not
{$IFDEF UNICODE}CreateProcessW{$ELSE}CreateProcessA{$ENDIF}(
    TJwPChar(App),//__in_opt     LPCTSTR lpApplicationName,
    pCmdLine, //__inout_opt  LPTSTR lpCommandLine,
    nil,//__in_opt     LPSECURITY_ATTRIBUTES lpProcessAttributes,
    nil,//__in_opt     LPSECURITY_ATTRIBUTES lpThreadAttributes,
    true,//__in         BOOL bInheritHandles,
    CREATE_NEW_CONSOLE or CREATE_UNICODE_ENVIRONMENT,//__in         DWORD dwCreationFlags,
    pEnv,//__in_opt     LPVOID lpEnvironment,
    pCurDir,//__in_opt     LPCTSTR lpCurrentDirectory,
    StartupInfo,//__in         LPSTARTUPINFO lpStartupInfo,
    ProcInfo,//__out        LPPROCESS_INFORMATION lpProcessInformation
  ) then
   raiseLastOsError;
  finally
    DestroyEnvironmentBlock(pEnv);
  end;
  CloseHandle(ProcInfo.hProcess);
  CloseHandle(ProcInfo.hThread);
…

Here some explanations:

  • What is a TJwString and TJwPchar?
    These types are declared in the JWSCL unit JwsclStrings and define a String or WideString and its C counterparts PChar or PWideChar. It depends on the compiler directive UNICODE whether they become the ansi or unicode version. Define UNICODE in your project options and rebuilt your project to use the unicode version.
    The same reason applies to this line.

    {$IFDEF UNICODE}CreateProcessW{$ELSE}CreateProcessA{$ENDIF}

    Here we use either the unicode or ansicode version of CreateProcess.

  • ZeroMemory(@StartupInfo, sizeof(StartupInfo));

    Is it really necessary to fill this block with zeroes?
    Yes, it is. CreateProcess uses values that are not zero as input and thus may fail if the values are incorrect.

  • StartupInfo.cb          := SizeOf(StartupInfo);

    What is the member cb for?
    The size member of this structures defines which version is used. In future if new members are added, CreateProcess can determine which version (with or without the new members) is used and thus ignore the new member’s values (they aren’t there anyway).

  • StartupInfo.lpDesktop   := ‘winsta0\default’;

    What does this line do?
    The lpDesktop member defines on which windowstation (here: “winsta0″) and desktop (here: “default”) the new application is shown. The value “winsta0\default” is a default value and should be sufficient for 99% of all cases. However Windows versions older than Vista come with a bug that does not show the application on “winsta0\defaul” if not specified. This bug only occurs in some rare occasions and is fixed in Vista and Server 2008.

  • What is CreateEnvironmentBlock for?
    CreateEnvironmentBlock creates all the command variables for the user you can see when you type “set” into command prompt (cmd.exe).
  • Why do you repeat the applications path in the command line parameters?
    pCmdLine := TJwPChar(‘"’+App+‘" ‘ + Parameters);

    It is standard in C world to repeat the application path as the first (zero based) parameter. So we have to add the app name in front of the remaining parameters. Otherwise the first parameter would be recognized as the application path and thus be ignored. In this case ParamStr(0) returns application path though but ParamStr(1) returns the second parameter. Example: pCmdLine = ’1 2 3′; In this example ParamStr(0) would be the path to exe. ParamStr(1) would be “2″ and not “1″ because “1″ is considered as the path to exe. ParamStr(0) uses GetModuleFileName as an exception.

    pCmdLine := TJwPChar(‘"’+App+‘" ‘);

    If no additional parameters are specified we just add the application name as the first parameter.

  • Why do we use a P(Wide)Char (TJwPChar resolves to this depending on compiler directive UNICODE) and set it to nil if Parameters or CurDir are empty?
    The reason is CreateProcess. If those pointers aren’t nil, the function consider them as input and does not ignore them. So if you empty the input parameters, CreateProcess considers an empty current directory string as input and tries to use it. Of course the operation fails and thus CreateProcess returns an error.
  • Does CloseHandle kill the newly created process?
    No, it does not. CreateProcess returns two handles so you could control the process or thread. However closing an application needs more action than just closing a handle. The handle however should be closed because it consumes memory in your process. So if you don’t need them, close it.
]]> http://blog.delphi-jedi.net/2008/04/11/createprocess-in-full-glory/feed/ 5 How to get the threads of a process? http://blog.delphi-jedi.net/2008/03/19/how-to-get-the-threads-of-a-process/ http://blog.delphi-jedi.net/2008/03/19/how-to-get-the-threads-of-a-process/#comments Wed, 19 Mar 2008 15:00:25 +0000 Christian Wimmer http://blog.delphi-jedi.net/2008/03/19/how-to-get-the-threads-of-a-process/ Yesterday, I described how to get the process of a window. Today I show you how to obtain the threads of a process.

There are two ways to retrieve all the threads of a foreign process.

  1. Use the Tool Help Library. There is also a sample about enumerating threads. So I am not going to to show you code in Delphi. The sample is simple enough to understand and convert.
    But these functions are necessary.

    The Tool Help Library declarations are defined in JwaTLHelp32.pas or JwaWindows.pas

  2. Use Performance Data Helper as described in a CodeProject article.
    The PDH declarations are defined in JwaPdh.pas, JwaPdhMsg.pas or JwaWindows.pas

Tell me how you liked this blog entry by adding a comment.

]]> http://blog.delphi-jedi.net/2008/03/19/how-to-get-the-threads-of-a-process/feed/ 0 How to use VCL and SetThreadDesktop http://blog.delphi-jedi.net/2008/03/19/how-to-use-vcl-and-setthreaddesktop/ http://blog.delphi-jedi.net/2008/03/19/how-to-use-vcl-and-setthreaddesktop/#comments Wed, 19 Mar 2008 09:00:49 +0000 Christian Wimmer http://blog.delphi-jedi.net/2008/03/19/how-to-use-vcl-and-setthreaddesktop/ It is impossible to use SetThreadDesktop and the VCL at the same time because a thread can only show windows on one desktop at a time. However VCL is not written for the use with multiple threads, so there is no way to show Delphi forms of same process on two different desktops. SetThreadDesktop describes this issue as followed.

The SetThreadDesktop function will fail if the calling thread has any windows or hooks on its current desktop (unless the hDesktop parameter is a handle to the current desktop).

Though there is a workaround to make VCL work with SetThreadDesktop and SwitchDesktop. The Application variable defined in unit Forms must be freed and then renewed. Here is the correct order :

  1. Close all your forms so the Application is going to quit.
  2. Free the Application instance in your DPR file.
    Application.Run;
    Application.Free;
  3. Then call SetThreadDesktop and SwitchDesktop
  4. Recreate the application object – now on the new desktop:
    Application := TApplication.Create(nil);
    Application.Initialize;
  5. Call all the usual stuff that has to be done to show your forms

…follow the same way as described to get back to the original desktop and forms (in this order!). However this has to be done in the main project file (DPR) (except you’re going to source it out) because you cannot just free Application in the event method of a button click. You have to shutdown your application (not your process) and continue right after :

Application.Free;

In this way the process does not shut down and you can use VCL on one desktop at a time.

A second possibility is to use VCL on one desktop and NonVCL on the other. However in this way you have to create a new thread and use your own message loop (located in the new thread). Then you can call SetThreadDesktop in this thread and show the NonVCL windows.

A third possibility is to execute another or the same application with CreateProcess. This function allows you to specify the target desktop name for the new process in lpDesktop of the TProcessInformation structure.

uses JwaWindows;

var
  StartupInfo: TStartupInfo;
  ProcInfo : TProcessInformation;
begin
  StartupInfo.cb          := SizeOf(StartupInfo);
  StartupInfo.lpDesktop   := ‘winsta0\default’;

  CreateProcess(
    ‘appname.exe’,//__in_opt     LPCTSTR lpApplicationName,
    nil,//__inout_opt  LPTSTR lpCommandLine,
    nil,//__in_opt     LPSECURITY_ATTRIBUTES lpProcessAttributes,
    nil,//__in_opt     LPSECURITY_ATTRIBUTES lpThreadAttributes,
    true,//__in         BOOL bInheritHandles,
    CREATE_NEW_CONSOLE,//__in         DWORD dwCreationFlags,
    nil,//__in_opt     LPVOID lpEnvironment,
    nil,//__in_opt     LPCTSTR lpCurrentDirectory,
    StartInfo,//__in         LPSTARTUPINFO lpStartupInfo,
    ProcInfo,//__out        LPPROCESS_INFORMATION lpProcessInformation
  );
  CloseHandle(ProcInfo.hProcess);
  CloseHandle(ProcInfo.hThread);
…

JWSCL
Did you know that there is already a desktop class that provides all necessary function to administer desktops? Yes, there is! It is called TJwSecurityDesktop and resides in unit JwsclDesktops.
Tell me how you liked this blog entry by adding a comment.

]]> http://blog.delphi-jedi.net/2008/03/19/how-to-use-vcl-and-setthreaddesktop/feed/ 0 How to get the process of a window? http://blog.delphi-jedi.net/2008/03/18/how-to-get-the-process-of-a-window/ http://blog.delphi-jedi.net/2008/03/18/how-to-get-the-process-of-a-window/#comments Tue, 18 Mar 2008 18:00:35 +0000 Christian Wimmer http://blog.delphi-jedi.net/2008/03/18/how-to-get-the-process-of-a-window/ This answer is very easy – just use GetWindowThreadProcessId

JWA declares it as followed:

function GetWindowThreadProcessId(hWnd: HWND; lpdwProcessId: LPDWORD): DWORD; stdcall;

The function returns an identifier (not a handle) and also may set lpdwProcessId to the identifier (again not a handle!) if it is not nil. Be aware that identifiers aren’t handles, so you must not close them by using CloseHandle. Identifiers are only numbers that makes an object distinguishable from other objects of the same type.

uses JwaWindows;

var ProcessID,
 ThreadID  : DWORD;
 WndHandle : HWND;

begin
  WndHandle := FindWindow(…);
  ThreadID := GetWindowThreadProcessId(WndHandle, @ProcessID);
…

Tell me how you liked this blog entry by adding a comment.

]]> http://blog.delphi-jedi.net/2008/03/18/how-to-get-the-process-of-a-window/feed/ 1 You cannot make your application undestroyable. http://blog.delphi-jedi.net/2008/03/17/you-cant-make-your-application-undestroyable/ http://blog.delphi-jedi.net/2008/03/17/you-cant-make-your-application-undestroyable/#comments Mon, 17 Mar 2008 22:24:57 +0000 Christian Wimmer http://blog.delphi-jedi.net/2008/03/17/you-cant-make-your-application-undestroyable/ The people from Microsoft decided that the user has to be in full control over the computer. So there is no assured way to make a program user resistant. She can always use TerminateProcess to forcibly kill the process.

uses JwaWindows;

function KillProcess(const ProcessID : DWord): Boolean;
var
  hProcess: HANDLE;
begin
  hProcess := OpenProcess(PROCESS_TERMINATE,  False, ProcessID);
  Result := TerminateProcess(hProcess, 0);
end;

Because nobody reads the remarks section of TerminateProcess, I cite it here.

The TerminateProcess function is used to unconditionally cause a process to exit. The state of global data maintained by dynamic-link libraries (DLLs) may be compromised if TerminateProcess is used rather than ExitProcess.

TerminateProcess initiates termination and returns immediately. This stops execution of all threads within the process and requests cancellation of all pending I/O. The terminated process cannot exit until all pending I/O has been completed or canceled.

And remind this little sentence.

A process cannot prevent itself from being terminated.

However there are some reasons not to make your application undestroyable.

  1. The users don’t want it.
  2. The work does not pay off. The user is going to close the app anyway.
  3. Some people complain about apps that do not close when Windows is shutting down.
  4. It’s also said that there were laptops which didn’t shutdown. The users put them into their bags and didn’t realize that the machine overheated eventually.
  5. Vista closes your application in the end you have no veto.

Tell me how you liked this blog entry by adding a comment.

]]> http://blog.delphi-jedi.net/2008/03/17/you-cant-make-your-application-undestroyable/feed/ 2 The case of the unexplained… http://blog.delphi-jedi.net/2008/03/16/the-case-of-the-unexplained/ http://blog.delphi-jedi.net/2008/03/16/the-case-of-the-unexplained/#comments Sun, 16 Mar 2008 17:51:24 +0000 Christian Wimmer http://blog.delphi-jedi.net/2008/03/16/the-case-of-the-unexplained/ As you maybe already have noted, I use the ProcessExplorer of Mark Russinovich a lot. It is a very powerful tool, that can help you finding out what’s going on in your Windows system…

  • Processes
  • Threads
  • Properties
  • Handles
  • Kernel
  • Bluescreens (WinDbg)
  • and many more

If you are interested in getting an introduction into the great application, you should watch this video. Mark presents his tool with many examples from his own experiences.

http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=722

]]> http://blog.delphi-jedi.net/2008/03/16/the-case-of-the-unexplained/feed/ 0