C++ Process Checking

Question

I'm creating a task-manager type application in C++, and I'm currently using:

`

void MyFrame::ProcChecker(bool showmessage=false){
 HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
 PROCESSENTRY32 *processInfo = new PROCESSENTRY32;
 processInfo->dwSize = sizeof(PROCESSENTRY32);

 int index = 0;
 string procList = "";

 while(Process32Next(hSnapShot,processInfo) != false){
  HANDLE modSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, processInfo->th32ProcessID);

  MODULEENTRY32 *moduleInfo = new MODULEENTRY32;
  moduleInfo->dwSize = sizeof(MODULEENTRY32);

  index++;
  stringstream indexstr;
  indexstr << index;

  Module32First(modSnapShot,moduleInfo);

  procList = procList + indexstr.str() + ": " + wxString((string)processInfo->szExeFile) + "[" + wxString((string)moduleInfo->szExePath) + "]" + "\r\n";
 }

 if(showmessage){
  MessageBox(NULL,procList.c_str(),"Processes",false);
 }
}

`

The problem I'm coming across is that a lot of the processes have restricted access, and I think I need to somehow get higher privileges that the app currently has. I think it has something to do with me needing to create a kernel-mode driver. If someone could point me in the right direction it'd be greatly appreciated! :)

I'm just starting out in C++ so I understand that my current code is probably horrendous :P

Answer 1

In order to query information about processes that you don't directly have access to, you need to have SeDebugPrivilege*. If this is on Vista, you most likely are running as standard user and you don't have that privilege. You need to run your program as administrator (note that TaskManager has to run as admin to get information on all processes.)

If you are running as admin, the problem is most likely that SeDebugPrivilege is not enabled by default. This is because SeDebugPrivilege is a very dangerous privilege to have all the time. You can enable SeDebugPrivilege by calling the AdjustTokenPrivileges API. This KB article shows how - you can probably find other references on the web.

*SeDebugPrivilege, among other things, is an override to OpenProcess and OpenThread. Toolhelp has to call these functions internally to query information on processes and threads in the system. These functions will check the ACL on the object to see if you have access. A user typically only has been granted permission to processes that they've created. If the calling code has SeDebugPrivilege in its token, OpenProcess and OpenThread will succeed even if the code hasn't been granted access by the ACL.