It might be useful for some scripts to have the parent process's ID (say, a different program was invoking this tool to do something to itself). Getting that information is hugely inconvenient without WMI, which is hugely inconvenient to use in native code. So parentpid became a predefined slot as well. pid (the current process's ID) was added to match.
The addition of parentpid allows for scripts like this one, which enables SeRestorePrivilege on its calling process:
call kernel32.dll!OpenProcess /return native /into prochandle (int 0x400, int 0, slotdata parentpid); newslot native token; call advapi32.dll!OpenProcessToken /return int (slotdata prochandle, int 0x20, slotptr token); newslot block luid = int 0, int 0; call advapi32.dll!LookupPrivilegeValueW /return int (nullptr, lpwstr "SeRestorePrivilege", slotptr luid); newslot block privs = int 1, slotdata luid, int 2; call advapi32.dll!AdjustTokenPrivileges /return int (slotdata token, int 0, slotptr privs, slotsize privs as int, nullptr, nullptr)
No comments:
Post a Comment