Additional helpful pseudo-handles: The process token, the thread token, and the...
source link: https://devblogs.microsoft.com/oldnewthing/20210105-00/?p=104667
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Additional helpful pseudo-handles: The process token, the thread token, and the effective token
Raymond
January 5th, 2021
In addition to the pseudo-handles produced by GetCurrentProcess() and GetCurrentThread(), there are also pseudo-handles for tokens.
GetCurrentProcessTokenOpenProcessToken(GetCurrentProcess())GetCurrentThreadTokenOpenThreadToken(GetCurrentThread())GetCurrentThreadEffectiveTokenOpenThreadToken(GetCurrentThread()) +OpenProcessToken(GetCurrentProcess())These pseudo-handles are handy because they can be obtained quickly and don’t need to be closed. You usually use them for quick one-shot queries.
The thread effective token is particularly useful because getting the thread effective token is normally a bit of a hassle. You first try to get the thread token, to see if the thread is impersonating. If that fails, then you fall back to the process token. This is an annoying bit of boilerplate that can be avoided by going straight to GetCurrentThreadEffectiveToken().
Well look at an example next time.
Bonus chatter: These token pseudo-handles are even more pseudo than your regular pseudo-handles. They basically work only for GetTokenInformation. You can’t use them with DuplicateHandle, for example.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK