I have enabled the SeDubugPrivilege
but the GetModuleBaseName
not working, I have all the admin rights. I tried it on different pc it works fine. But in my pc i cannot get the desired output.
Here's my code:
void printError(){
wchar_t buf[256];
FormatMessageW(FORMAT_MESSAGE_FROM_SYSTEM|FORMAT_MESSAGE_IGNORE_INSERTS,
NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
buf, sizeof(buf), NULL);
wcout<<buf;
}
BOOL SetPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if ( !LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid ) ) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u\n", (unsigned int)GetLastError()
);
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if ( !AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES) NULL,
(PDWORD) NULL) )
{
printf("AdjustTokenPrivileges error: \n");
printError();
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printError();
printf("The token does not have the specified privilege. \n");
return FALSE;
}
return TRUE;
}
int main(){
Sleep(5000);
HWND currWindow = GetForegroundWindow();
int titleLength = GetWindowTextLengthW(currWindow)+1;
wchar_t s[titleLength];
GetWindowTextW(currWindow,s,titleLength);
wcout<<s<<endl;
unsigned long i = 0;
long unsigned *p = &i;
GetWindowThreadProcessId(currWindow,p);
cout<<*p<<endl;
HANDLE handleForCurrentProcess = OpenProcess(PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,FALSE,*p);
HANDLE accessToken;
OpenProcessToken(handleForCurrentProcess,TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY ,&accessToken);
SetPrivilege(accessToken,SE_DEBUG_NAME,TRUE);
wchar_t moduleName[500];
cout<<GetModuleBaseNameW(handleForCurrentProcess,NULL,moduleName,500);
wcout<<moduleName<<endl;
cout<<GetModuleFileNameExW(handleForCurrentProcess,NULL,moduleName,500);
wcout<<moduleName;
return 0;
}
This works fine in another pc. Also i have enabled the SeDebugPrivilege
in security policies.
EDIT
Here the updated code with error checking calls in main
int main(){
Sleep(3000);
HWND currWindow = GetForegroundWindow();
int titleLength = GetWindowTextLengthW(currWindow)+1;
wchar_t s[titleLength];
DWORD status = GetWindowTextW(currWindow,s,titleLength);
if(status == 0){
cout<<"Error in GetWindowTextW";
printLastError();
}
wcout<<"Title : "<<s<<endl;
unsigned long id = 0;
GetWindowThreadProcessId(currWindow,&id);
cout<<"Process Id : "<<id<<endl;
HANDLE handleForForegroundProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,id);
if(handleForForegroundProcess == NULL){
cout<<"Error in OpenProcess";
printLastError();
}
HANDLE accessToken;
BOOL processStatus = OpenProcessToken(handleForForegroundProcess,TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY ,&accessToken);
if(processStatus == 0){
cout<<"Error in OpenProcessToken";
printLastError();
}
SetPrivilege(accessToken,SE_DEBUG_NAME,TRUE);
wchar_t moduleName[500];
status = GetModuleBaseNameW(handleForForegroundProcess,NULL,moduleName,500);
if(status == 0){
cout<<"Error in GetModuleBaseNameW";
printLastError();
}
wcout<<"Module Name : "<<moduleName<<endl;
wchar_t modulePath[2000];
status = GetModuleFileNameExW(handleForForegroundProcess,NULL,modulePath,2000);
if(status == 0){
cout<<"Error in GetModuleFileNameExW";
printLastError();
}
wcout<<"Module path : "<<modulePath;
return 0;
}
Here's the output when the foreground window is Google Chrome
Title : Error Checking in C++ (Windows) - Google Chrome
Process Id : 14528
The token does not have the specified privilege.
Not all privileges or groups referenced are assigned to the caller.
Error in GetModuleBaseNameWOnly part of a ReadProcessMemory or WriteProcessMemory request was completed.
Module Name : -
Module path : C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
And here's the output when the foreground window is the process from which the code is runned i.e Code Blocks
Title : main.cpp - Code::Blocks 17.12
Process Id : 4008
The token does not have the specified privilege.
Not all privileges or groups referenced are assigned to the caller.
Module Name : codeblocks.exe
Module path : C:\Program Files (x86)\CodeBlocks\codeblocks.exe
I am not getting the modulename
for chrome.
Thanks.