Detect Debug Privileges on a process (Windows, C)

Question

in a previous question I asked how to overcome the fact that in certain users the debug privileges were not there. Now, since I can't set something that doesn't exist, how would I check if a user has debug privileges?

I know I have to use LookupPrivilegeValue(), I just can't figure where to read on the returned value that would indicate whether a particular privilege is there or not.

Code is appreciated.

Thanks

Answer 1

From http://msdn.microsoft.com/en-us/library/aa446619%28VS.85%29.aspx

BOOL SetPrivilege(
    HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
    ) 
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if ( !LookupPrivilegeValue( 
      NULL,            // lookup privilege on local system
      lpszPrivilege,   // privilege to lookup 
      &luid ) )        // receives LUID of privilege
    {
     printf("LookupPrivilegeValue error: %u\n", GetLastError() ); 
     return FALSE; 
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if (bEnablePrivilege)
     tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
     tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if ( !AdjustTokenPrivileges(
        hToken, 
        FALSE, 
        &tp, 
        sizeof(TOKEN_PRIVILEGES), 
        (PTOKEN_PRIVILEGES) NULL, 
        (PDWORD) NULL) )
    { 
       printf("AdjustTokenPrivileges error: %u\n", GetLastError() ); 
       return FALSE; 
    } 

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
       printf("The token does not have the specified privilege. \n");
       return FALSE;
    } 

    return TRUE;
}

if the function returns ERROR_NOT_ALL_ASSIGNED when requesting to set debug privileges then the token is not there.