Category

Development Platform
Home > SourceCode/Document > Windows Develop > View Code
SecurityTool.cpp
Package: Agent.rar　[view]
Upload User: canhn88
Upload Date: 2014-12-28
Package Size: 2438k
Code Size: 3k
Category:

Windows Develop

Development Platform:

C/C++

SecurityTool.cpp：Code Content
  2. //SecurityTool.cpp: implementation of the CSecurityTool class.
  4. #include "SecurityTool.h"
  5. #include <tlhelp32.h>
  6. #include <wtsapi32.h>
  8. #pragma comment(lib, "Wtsapi32.lib")
  10. //load dlls tardily.
  11. #pragma comment(lib, "delayimp.lib")
  12. #pragma comment(linker, "/DELAYLOAD:"wtsapi32.dll"")
  14. #define MIN(a,b) ((a)>(b)?(a):(b))
  16. //current domain-name.
  17. char CSecurityTool::domain[MAX_USERID_SIZE]="";
  19. CSecurityTool::CSecurityTool(){
  20. memset(CSecurityTool::domain, 0x0, sizeof(domain));
  21. }
  23. CSecurityTool::~CSecurityTool(){}
  25. //get current process' user-name.
  26. BOOL CSecurityTool::GetCurrProcessUser(char *buffer, const int buffersize)
  27. {
  28. DWORD dwsize = buffersize;
  29. memset(buffer, 0x0, buffersize);
  30. return GetUserName(buffer, &dwsize);
  31. }
  33. //get user-name of current logoned on WinXP os.
  34. BOOL CSecurityTool::GetLogUserXP(char *buffer, const int buffersize)
  35. {
  36. memset(buffer, 0x0, buffersize);
  37. return GetLogUser2K(buffer, buffersize);
  38. }
  40. //get user-name of current logoned on Win2000 os.
  41. BOOL CSecurityTool::GetLogUser2K(char *buffer, const int buffersize)
  42. {
  43. HANDLE hsnapshot = NULL;
  44. memset(buffer, 0x0, buffersize);
  45.     __try
  46. {
  47. //get a snapshot of the processes in the system.
  48.         hsnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  49.         if(hsnapshot == NULL) {
  50. __leave;
  51. }
  52.         PROCESSENTRY32 pe32;
  53.         pe32.dwSize = sizeof(pe32);
  55.         //find the shell process.
  56.         BOOL hprocess = Process32First(hsnapshot, &pe32);
  57.         while(hprocess) {
  58. if (stricmp(pe32.szExeFile, "explorer.exe") == 0) {
  59. if(GetProcessUser(pe32.th32ProcessID, buffer, buffersize)) {
  60. return TRUE;
  61. }
  62. break;
  63. }
  64. hprocess = Process32Next(hsnapshot, &pe32);
  65. }
  66. }
  67.     __finally
  68. {
  69. //cleanup the snapshot.
  70. if(hsnapshot != NULL) {
  71. CloseHandle(hsnapshot);
  72. }
  73.     }
  74. return FALSE;
  75. }
  77. //get specialed process' user-name.
  78. BOOL CSecurityTool::GetProcessUser(const int dwProcessID,
  79.    char *szUserName, 
  80.    const int nNameLen)
  81. {
  82. BOOL fResult  = FALSE;
  83.     HANDLE hProc  = NULL;
  84. HANDLE hToken = NULL;
  85. DWORD  dwNeedLen = 0;
  86. TOKEN_USER *pTokenUser = NULL;
  88. __try
  89. {
  90.         // Open the process with PROCESS_QUERY_INFORMATION access
  91.         hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessID);
  92.         if (hProc == NULL) {
  93. __leave;
  94. }
  95.         fResult = OpenProcessToken(hProc, TOKEN_QUERY, &hToken);
  96.         if(!fResult) {
  97. __leave;
  98. }
  99. fResult = GetTokenInformation(hToken,TokenUser, NULL, 0, &dwNeedLen);
  100. if (dwNeedLen > 0) {
  101. pTokenUser = (TOKEN_USER*)new BYTE[dwNeedLen];
  102. fResult = GetTokenInformation(hToken,TokenUser, pTokenUser, dwNeedLen, &dwNeedLen);
  103. if (!fResult) {
  104. __leave;
  105. }
  106. }
  107. else {
  108. __leave;
  109. }
  110. SID_NAME_USE sn;
  111. char szDomainName[MAX_PATH];
  112. DWORD dwDmLen = sizeof(szDomainName)/sizeof(szDomainName[0]);
  113. fResult = LookupAccountSid(NULL, pTokenUser->User.Sid, szUserName, 
  114. (LPDWORD)&nNameLen, szDomainName, &dwDmLen, &sn);
  116. if(fResult) {
  117. memset(CSecurityTool::domain, 0x0, sizeof(domain));
  118. strncpy(CSecurityTool::domain, szDomainName, 
  119. MIN(dwDmLen, sizeof(CSecurityTool::domain)));
  120. }
  121. }
  122. __finally
  123. {
  124. if (hProc)
  125. ::CloseHandle(hProc);
  126. if (hToken)
  127. ::CloseHandle(hToken);
  128. if (pTokenUser)
  129. delete[] (char*)pTokenUser;
  131. return fResult;
  132. }
  133. }