Question

我有一个带有方法GetParentProcess（IntPtr handle）的结构，用于通过传递句柄返回父进程。

[StructLayout(LayoutKind.Sequential)]
public struct ParentProcessUtilities
{

    internal IntPtr Reserved1;
    internal IntPtr PebBaseAddress;
    internal IntPtr Reserved2_0;
    internal IntPtr Reserved2_1;
    internal IntPtr UniqueProcessId;
    internal IntPtr InheritedFromUniqueProcessId;

    [DllImport("ntdll.dll")]
    public static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessUtilities processInformation, int processInformationLength, out int returnLength);


    public static Process GetParentProcess()
    {
        return GetParentProcess(Process.GetCurrentProcess().Handle);
    }


    public Process GetParentProcess(int id)
    {
        Process process = Process.GetProcessById(id);
        return GetParentProcess(process.Handle);
    }


    public static Process GetParentProcess(IntPtr handle)
    {
        ParentProcessUtilities pbi = new ParentProcessUtilities();
        int returnLength;
        int status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
        if (status != 0)
            throw new Win32Exception(status);

        try
        {
            return Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32());
        }
        catch (ArgumentException)
        {

            return null;
        }
    }
}

一切正常，直到我进入进程“ smss.exe”。当我想成为该进程的父进程时，会抛出此异常

 Unexpected exception : System.ComponentModel.Win32Exception (0x80004005): Access is denied
   at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
   at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
   at System.Diagnostics.Process.OpenProcessHandle(Int32 access)
   at System.Diagnostics.Process.get_Handle()

我正在以管理员权限运行应用程序。感谢您的帮助

Answer 1

public class foo { private Map<String, Runnable> reflectivelyInitializedMap; @ExternalApi("makePublic") private MyObject bar = new MyObject() { private Runnable makePublic; } // I want to generate the following method: public void makePublic(){ reflectivelyInitializedMap.get("makePublic").run(); } }是会话管理器子系统，有关详细信息，请参见此Wikipedia article。这是Windows内核启动的第一个用户模式进程，它执行许多特权操作。因此，您的普通进程将无权管理此进程，因此“访问被拒绝”异常。

System.ComponentModel.Win32Exception（0x80004005）：访问被拒绝

1 个答案: