OpenProcess() fails for some users with access denied

Question

I'm using Java JNA in order to access a process' memory on Windows. My code looks like this:

static WinNT.HANDLE openProcessHandle(int processId)
{
    val processAccessRights = PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_TERMINATE
            | PROCESS_NAME_NATIVE | PROCESS_SUSPEND_RESUME | PROCESS_QUERY_INFORMATION | PROCESS_QUERY_LIMITED_INFORMATION;
    val processHandle = Kernel32.INSTANCE.OpenProcess(processAccessRights, false, processId);
    if (processHandle == null)
    {
        val lastError = Native.getLastError();
        val formatMessageFromLastErrorCode = Kernel32Util.formatMessageFromLastErrorCode(lastError);
        val message = "OpenProcess() failed to open process id "
                + processId + ": " + formatMessageFromLastErrorCode;
        throw new IllegalStateException(message);
    }

    return processHandle;
}

I'm already not using PROCESS_ALL_ACCESS due to the problems it causes.

According to this answer, I also need to enable the debug privilege for my process. However, despite calling this code successfully (e.g. all return values indicate success) before OpenProcess(), some users still get the error message OpenProcess() failed to open process id xxxx: Access denied. My application is not running as administrator. Why does it work for me and most users without administrator rights but not all users? What exactly causes this inconsistency? I would prefer to understand and tackle this problem specifically rather than making all users run my software as administrator since my software generally doesn't need those extra rights.

*I'm already not using PROCESS_ALL_ACCESS* - you are using it in your pasted code. *My application is not running as administrator.* - so you and have not and can not got debug privilege. you can open some processes, which have SD that let you do this. and can not open some other. this is normal — RbMm, Jan 16 '21 at 20:49

Daniel Widdis · Accepted Answer · 2021-01-17T08:27:20.133

1

I authored the answer you cited in 2017, and learned last year that I had missed something key. I probably should edit that older answer to update it, but I'd forgotten about it. See this answer for a corrected version of the code that I'll be editing into the previous one you cited.

The API for AdjustTokenPrivileges() is somewhat broken in that it will give a false indication of success:

If the function succeeds, the return value is nonzero. To determine whether the function adjusted all of the specified privileges, call GetLastError, which returns one of ... ERROR_SUCCESS ... ERROR_NOT_ALL_ASSIGNED.

Given you are attempting to adjust the privileges with a non-admin user, you are not able to actually do so, and the other users will not be able to OpenProcess() for other users' processes. I don't think there is a workaround other than running your program with the necessary administrative power (SE_DEBUG_PRIVILEGE), which must be assigned by an administrator at some point.

It is likely you are still getting a misleading indication of success, but need to check GetLastError() to see if it actually worked.

edited Jan 17 '21 at 08:27

answered Jan 16 '21 at 23:18

Daniel Widdis

8,424
13
41
63

Interesting, thank you for this update. I called `GetLastError()` but on my machine the return value was still 0 (`ERROR_SUCCESS`). Would this return `ERROR_NOT_ALL_ASSIGNED` for users who run into the `OpenProcess()` failure? I guess I will go for running the software as administrator after all to mitigate this annoying issue since it does not behave consistently. I doubt anyone would try to open processes by other users in my context so this shouldn't be an issue either. – BullyWiiPlaza Jan 17 '21 at 00:21
`TOKEN_ADJUST_PRIVILEGES` - this is access right on open token handle. absolute unrelated here at all. we need have `SE_DEBUG_PRIVILEGE` in token – RbMm Jan 17 '21 at 08:14
@RbMm as always, thanks for the correction! – Daniel Widdis Jan 17 '21 at 08:27

OpenProcess() fails for some users with access denied

1 Answers1