I have seen a lot of requests on getting token information from a .NET application so I went on to create a API that can be used .In order to understand this custom API you would need to read on whats a 'Token'
"According to Microsoft an access token is an object that describes the security context of a process or a thread"
Refer MSDN for a more detailed description : http://msdn.microsoft.com/en-us/library/aa374909(VS.85).aspx
This API uses Pinvoke , hence make sure you import the required dll's and structures. A handle to the process that needs to be queried is passed.
resultDTO is a DTO object.
Source Code:
/*File Details
Company Name : NathCorp
File Name : GetTokenInfo.cs
Created on : 12.31.2007
Author : Ganesh
*/
#region Headers
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.Security.Principal;
#endregion
namespace nath.API
{
/// <summary>
/// Class used to get Process Token.
/// </summary>
class TokenAPI
{
#region Constants
//Constant values used for function GetTokenInformation.
const UInt32 TOKEN_QUERY = 0x0008;
public const uint ERROR_SUCCESS = 0;
public const uint ERROR_INSUFFICIENT_BUFFER = 122;
public const uint TokenIntegrityLevel = 25;
const long SECURITY_MANDATORY_UNTRUSTED_RID = (0x00000000L);
const long SECURITY_MANDATORY_LOW_RID = (0x00001000L);
const long SECURITY_MANDATORY_MEDIUM_RID = (0x00002000L);
const long SECURITY_MANDATORY_HIGH_RID = (0x00003000L);
const long SECURITY_MANDATORY_SYSTEM_RID = (0x00004000L);
const long SECURITY_MANDATORY_PROTECTED_PROCESS_RID = (0x00005000L);
#endregion
#region Structures
enum TOKEN_INFORMATION_CLASS
{
TokenUser = 1,
TokenGroups,
TokenPrivileges,
TokenOwner,
TokenPrimaryGroup,
TokenDefaultDacl,
TokenSource,
TokenType,
TokenImpersonationLevel,
TokenStatistics,
TokenRestrictedSids,
TokenSessionId,
TokenGroupsAndPrivileges,
TokenSessionReference,
TokenSandBoxInert,
TokenAuditPolicy,
TokenOrigin,
TokenElevationType,
TokenLinkedToken,
TokenElevation,
TokenHasRestrictions,
TokenAccessInformation,
TokenVirtualizationAllowed,
TokenVirtualizationEnabled,
TokenIntegrityLevel,
TokenUIAccess,
TokenMandatoryPolicy,
TokenLogonSid,
MaxTokenInfoClass
}
enum TOKEN_VIRTUALIZATION_ENABLED
{
buff
}
[StructLayout(LayoutKind.Sequential)]
public struct TOKEN_MANDATORY_LABEL
{
public SID_AND_ATTRIBUTES Label;
}
[StructLayout(LayoutKind.Sequential)]
public struct SID_AND_ATTRIBUTES
{
public IntPtr Sid;
public int Attributes;
}
#endregion
#region Dll Import Functions
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool GetTokenInformation(IntPtr TokenHandle,
TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation,
uint TokenInformationLength, out uint ReturnLength);
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool OpenProcessToken(IntPtr ProcessHandle, UInt32
DesiredAccess, out IntPtr TokenHandle);
[DllImport("kernel32.dll")]
public static extern IntPtr LocalAlloc(uint uFlags, UIntPtr uBytes);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern IntPtr GetSidSubAuthority(IntPtr pSid, UInt32 nSubAuthority);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern IntPtr GetSidSubAuthorityCount(IntPtr pSid);
#endregion
//Constructor
public TokenAPI() { }
/// <summary>
/// Function that Queries a process to check if its Virtualized.
/// </summary>
/// <param name="handle">A Handle to the Process</param>
/// <returns>resultDTO</returns>
public resultDTO QueryProcess(IntPtr handle)
{
IntPtr hToken;
uint dwSize2;
uint dwLengthNeeded;
uint dwError = ERROR_SUCCESS;
TOKEN_MANDATORY_LABEL pTIL;
int IntegrityLevel = 0;
TOKEN_VIRTUALIZATION_ENABLED tokenVirtualized;
IntPtr pVirtualized = Marshal.AllocHGlobal(sizeof(TOKEN_VIRTUALIZATION_ENABLED));
OpenProcessToken(handle, TOKEN_QUERY, out hToken);
GetTokenInformation(hToken, TOKEN_INFORMATION_CLASS.TokenVirtualizationEnabled, pVirtualized, sizeof(TOKEN_VIRTUALIZATION_ENABLED), out dwSize2);
tokenVirtualized = (TOKEN_VIRTUALIZATION_ENABLED)Marshal.ReadInt32(pVirtualized);
Marshal.FreeHGlobal(pVirtualized);
if (TokenConstants.Virtualized == Convert.ToString(tokenVirtualized))
{
result.virtualized = true;
}
else
{
result.virtualized = false;
}
if (!GetTokenInformation(hToken, (TOKEN_INFORMATION_CLASS)TokenIntegrityLevel, IntPtr.Zero, 0, out dwLengthNeeded))
{
dwError = (uint)Marshal.GetLastWin32Error();
if (dwError == ERROR_INSUFFICIENT_BUFFER)
{
IntPtr StructPtr = Marshal.AllocHGlobal((int)dwLengthNeeded);
try
{
if (GetTokenInformation(hToken, (TOKEN_INFORMATION_CLASS)TokenIntegrityLevel, StructPtr, dwLengthNeeded, out dwLengthNeeded))
{
pTIL = (TOKEN_MANDATORY_LABEL)Marshal.PtrToStructure(StructPtr, typeof(TOKEN_MANDATORY_LABEL));
IntPtr SubAuthorityCount = GetSidSubAuthorityCount (pTIL.Label.Sid);
int count = Marshal.ReadInt32(SubAuthorityCount);
uint AuthCount = (uint)count - 1;
IntPtr IntegrityLevelPtr = GetSidSubAuthority(pTIL.Label.Sid, AuthCount);
IntegrityLevel = Marshal.ReadInt32(IntegrityLevelPtr);
}
if (IntegrityLevel < SECURITY_MANDATORY_MEDIUM_RID)
{
result.integrity = "Low";
}
else if (IntegrityLevel >= SECURITY_MANDATORY_MEDIUM_RID && IntegrityLevel < SECURITY_MANDATORY_HIGH_RID)
{
result.integrity = "Medium";
}
else if (IntegrityLevel >= SECURITY_MANDATORY_HIGH_RID)
{
result.integrity = "High";
}
}
catch
{
}
finally
{
Marshal.FreeHGlobal(StructPtr);
}
}
}
return result;
}
}
}
|