[System] Process Token Library

unit LibProcessToken;

interface

uses
  Windows, SysUtils, WinNT, WinBase, Sddl, WTSApi32, TlHelp32,
  LibSystemConst, LibProcessInfo;
  
function GetProcessHandle(Filename: String): THandle;           // CloseHandle로 해제할것, Filename은 경로 미포함
function GetProcessToken(ProcessHandle: THandle): THandle;	// CloseHandle로 해제할것
function GetCurrentProcessToken: THandle;                       // CloseHandle로 해제할것
function GetConsoleToken: THandle;                      	// CloseHandle로 해제할것
function GetLinkedToken(SourceToken: THandle): THandle;		// CloseHandle로 해제할것
function DuplicateToken(SourceToken: THandle): THandle;		// CloseHandle로 해제할것
function GetIntegrityLevel(Token: THandle): DWORD;
function GetElevationType(Token: THandle) : DWORD;

[System] System Const Library

[System] Process Information Library

function GetTokenInfo(Token: THandle; TokenInfoClass: TOKEN_INFORMATION_CLASS; DataLen: PDWORD = nil): Pointer;	// LocalFree(DWORD(xxx))로 해제할것
var
  Len: DWORD;
begin
  Len := 0;
  GetTokenInformation(Token, DWORD(TokenInfoClass), nil, 0, Len);
  if Len > 0 then begin
     RESULT := Pointer(LocalAlloc(0, Len));
     if GetTokenInformation(Token, DWORD(TokenInfoClass), RESULT, Len, Len) then begin
        if Assigned(DataLen) then DataLen^ := Len;
        end
     else begin
        LocalFree(DWORD(RESULT));
        RESULT := nil;
        end;
     end
  else begin
     RESULT := nil;
     end;
end;

function GetIntegrityLevel(Token: THandle): DWORD;
var
  pTIL: PTOKEN_MANDATORY_LABEL;
  C: DWORD;
begin
  RESULT := 0;
  pTIL := GetTokenInfo(Token, TokenIntegrityLevel);
  if Assigned(pTIL) then begin
     try
       C := GetSidSubAuthorityCount(pTIL^._Label.Sid)^;
       if C > 0 then  RESULT := GetSidSubAuthority(pTIL^._Label.Sid, C-1)^;
       finally
       LocalFree(DWORD(pTIL));
       end;
    end;
end;

function GetElevationType(Token: THandle) : DWORD;
var
  pTYPE: PDWORD;
begin
  RESULT := 0;
  pTYPE := GetTokenInfo(Token, TokenElevationType);
  if Assigned(pTYPE) then begin
     RESULT := pTYPE^;
     LocalFree(DWORD(pTYPE));
    end;
end;

type
  PSearchProcUserStruct = ^TSearchProcUserStruct;
  TSearchProcUserStruct = record
        FileName_UpperCase	: PChar;
	ActiveSessionID		: DWORD;
	ProcessID		: DWORD;
	end;

function __SearchProc(ProcessInfo: PProcessEntry32; UserPara: Pointer) : BOOL; stdcall;
var
  SessID : DWORD;
  PT : PSearchProcUserStruct;
begin
  PT := PSearchProcUserStruct(UserPara);

  RESULT := (UpperCase(ExtractFileName(ProcessInfo^.szExeFile)) = String(PT^.FileName_UpperCase))
  	and ProcessIdToSessionId(ProcessInfo^.th32ProcessID, SessID)
        and (SessID = PT^.ActiveSessionID);

  if RESULT then PT^.ProcessID := ProcessInfo^.th32ProcessID;
  // RESULT = TRUE 면 ENUM 종료
end;

function GetProcessHandle(Filename: String): THandle;
var
  SearchParam: TSearchProcUserStruct;
begin
  Filename := UpperCase(Filename);

  SearchParam.ActiveSessionID 	:= WTSGetActiveConsoleSessionId();
  SearchParam.ProcessID    	:= 0;
  SearchParam.FileName_UpperCase:= PChar(Filename);

  if Enum_ProcessList(__SearchProc, @SearchParam) and
     (SearchParam.ProcessID <> 0)
     then RESULT := OpenProcess(MAXIMUM_ALLOWED, FALSE, SearchParam.ProcessID)
     else RESULT := 0;
end;


function GetProcessToken(ProcessHandle: THandle): THandle;
begin
  try
     if not OpenProcessToken(ProcessHandle, TOKEN_ALL_ACCESS, RESULT) then begin
        RESULT := 0;
        Exit;
        end;
     except
     RESULT := 0
     end;
end;

function GetCurrentProcessToken: THandle;
begin
  RESULT := GetProcessToken(OpenProcess(PROCESS_QUERY_INFORMATION, TRUE, GetCurrentProcessID()));
end;

function GetConsoleToken: THandle;
var
  SessID : DWORD;
begin
  try
     SessID := WTSGetActiveConsoleSessionId();
     if SessID = $FFFFFFFF then begin
        RESULT := 0;
        Exit;
        end;

     if not WTSQueryUserToken(SessID, RESULT) then begin
        RESULT := 0;
        Exit;
        end;
     except
     RESULT := 0
     end;
end;

function GetLinkedToken(SourceToken: THandle): THandle;
var
  pLINK: PTOKEN_LINKED_TOKEN;
begin
  RESULT := 0;
  pLINK := GetTokenInfo(SourceToken, TokenLinkedToken);
  if Assigned(pLINK) then begin
     RESULT := pLINK^.LinkedToken;
     LocalFree(DWORD(pLINK));
    end;
end;

function DuplicateToken(SourceToken: THandle): THandle;
begin
  if not DuplicateTokenEx(	SourceToken,
                                MAXIMUM_ALLOWED,
                                nil,
                                SecurityIdentification, //SecurityImpersonation,
                                TokenPrimary,
                                RESULT) then begin
     RESULT := 0;
     end;
end;