How does Process Explorer enumerate all process names from an XP Guest account?

Question

I'm attempting to enumerate all running process EXE names, and have stumbled when attempting this on the XP Guest account. I am able to enumerate all Process IDs using EnumProcesses, but when I attempt OpenProcess with PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, the function fails.

I fired up Process Explorer under the XP Guest account, and it was able to enumerate all process names (though as expected, most other information from processes outside the Guest user-space was not present).

So, my question is, how can I duplicate the Process Explorer magic to get the process names of services and other processes running outside the Guest account user-space?

Answer 1

I suppose that the Process Explorer use NtQuerySystemInformation with parameter SystemProcessInformation to get the list of processes. For the code example see my old answer . Additionally the function NtQueryInformationProcess will be used to get additional information.

By the way, if you start Process Explorer under Dependency Walker (menu "Profile" / "Start Profiling" or F7 ) then you will see all functions which Process Explorer really use from NTDLL.DLL. You can see that NtQuerySystemInformation and NtQueryInformationProcess will be really used.

Answer 2

NtQuerySystemInformation几乎没有记录，并且“在将来的Windows版本中可能会更改或不可用”， CreateToolhelp32Snapshot已得到充分记录，并应为您提供映像名称。

Answer 3

When a process starts, it is assigned a basic set of access privileges. Certain API calls require additional privileges to complete successfully. Specifically, OpenProcess can require the SeDebugPrivilege privilege in certain cases. You can find an example of how to modify your process token to enable additional privileges here: Enabling and Disabling Privileges in C++ .

Answer 4

GetProcessImageFileName only needs PROCESS_QUERY_LIMITED_INFORMATION starting with Vista, but on XP it does need PROCESS_QUERY_INFORMATION.

You shouldn't need, and definitely shouldn't be able to get from a guest account, PROCESS_VM_READ.