Geek Answers Handbook

Process.GetProcessById allows "debug mode"

In one of my C # applications (.NET 2), I use an unmanaged mode (C) library that calls some OpenProcess()s. I recently added C # code where used Process.GetProcessById(). After this change, it OpenProcess()began to work even when applied to PIDs that were used for failure. After some investigation, I found that it was Process.GetProcessById()implicitly installing SeDebugPrivilegeinto the application (NOTE: the current user has administrator privileges). Since this behavior is not desirable in my particular application, I eventually regained normal privileges by calling Process.LeavDebugMode().

Since I cannot find any description of this, I have some doubts about the correctness of my program. Is it right to call Process.LeavDebugMode()to "configure" tasks Process.GetProcessById()? And, in short, does mine work Process.GetProcessById()as expected (for example, MSDN is documented), or does the behavior I observed hide some subtle errors in my application?

My OS is the 64-bit version of Windows 7 SP1 for embedded systems.

EDIT: additional information: the process runs in 32-bit mode (i.e. it runs the 32-bit version of the .NET engine). In addition, I added this .config file to make sure the version of .NET used is 2:

<configuration>
 <startup>
  <supportedRuntime version="v2.0.50727"/>
 </startup>
</configuration>

EDIT2: . #/WindowsForm ( MS;-)), , Process.GetProcessById() Process.LeaveDebugMode(). :

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;
using System.Reflection;
using System.Resources;
using System.Runtime.InteropServices;


namespace testproc
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            Process proc = Process.GetProcessById(Process.GetCurrentProcess().Id);
        }

        private void button2_Click(object sender, EventArgs e)
        {
            Process.LeaveDebugMode();
        }
    }
}

( VS), Process Explorer. "":

  • : SeDebugPrivilege.
  • 1 : SeDebugPrivilege!
  • 2 : SeDebugPrivilege
  • 1 : SeDebugPrivilege (uhm...)

, (, , Process.GetProcessById()). ?

+4
1

.NET, - , , - .

LeaveDebugMode() . , , , . ( , LeaveDebugMode(), , , API.)

0

More articles:


All Articles