Giving my process the SeDebugPrivilege

[K? Pŕo?ćtiόnŹ]

.data?

    ThisProcessToken dd ?
    ThisProcessTokPriv TOKEN_PRIVILEGES <>

.code

        invoke GetCurrentProcess
        invoke OpenProcessToken,eax,TOKEN_ALL_ACCESS,addr ThisProcessToken
        .if eax==0
            invoke MessageBox,0,CTXT("Could not retrieve process token."),CTXT("Error"),MB_ICONERROR
            invoke SendMessage,hWin,WM_CLOSE,0,0
        .endif
        invoke LookupPrivilegeValue,0,CTXT("SeDebugPrivilege"),addr ThisProcessTokPriv.Privileges.Luid
        .if eax==0
            invoke MessageBox,0,CTXT("Could not get local debug value."),CTXT("Error"),MB_ICONERROR
            invoke SendMessage,hWin,WM_CLOSE,0,0
        .endif
        mov ThisProcessTokPriv.PrivilegeCount, 1
           mov ThisProcessTokPriv.Privileges.Attributes, SE_PRIVILEGE_ENABLED
           invoke AdjustTokenPrivileges, ThisProcessToken,0, ADDR ThisProcessTokPriv, NULL, NULL, NULL
           .if eax!=0
               invoke MessageBox,0,CTXT("Could not adjust token privileges."),CTXT("Error"),MB_ICONERROR
            invoke SendMessage,hWin,WM_CLOSE,0,0
           .endif

It gives me the error that it couldnt adjust the token privileges. I had it working for a while and it just started giving me that error. I rebooted my computer twice and tried it each time but it still gives me the error.

[hypn]

here's my code (worked last time I used it):

.const
szDebugName 		db 'SeDebugPrivilege',0

.data?
stTkp				TOKEN_PRIVILEGES <>
hToken				dd ?

and my function:

GetDebugPriv proc

	invoke GetCurrentProcess
	invoke OpenProcessToken,eax,TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,addr hToken
	invoke LookupPrivilegeValue,NULL,offset szDebugName,addr stTkp.Privileges[0].Luid
	mov stTkp.PrivilegeCount,1
	mov stTkp.Privileges[0].Attributes,SE_PRIVILEGE_ENABLED
	invoke AdjustTokenPrivileges,hToken,FALSE,addr stTkp,NULL,NULL,NULL
	invoke CloseHandle,hToken
	ret

GetDebugPriv endp

perhaps it's the [0] you're missing, before the ".Luid"?

invoke LookupPrivilegeValue,0,CTXT("SeDebugPrivilege"),ad dr ThisProcessTokPriv.Privileges.Luid

VS

invoke LookupPrivilegeValue,NULL,offset szDebugName,addr stTkp.Privileges[0].Luid

otherwise our code's pretty much the same...

[K? Pŕo?ćtiόnŹ]

Wtf-uzzle. The only difference I see is the access mask and the [0]'s. Yours works for me so Im going to make those changes and see if it works then.

[K? Pŕo?ćtiόnŹ]

Well, I made those changes and I still get that error. Damn.

EDIT: Well I feel rather silly, I went back and looked at the docs for AdjustTokenPrivileges, and it seems that if the return value is 0 then it failed, not non zero >_>;

Problem solved, thanks for your help hypn.

[Suteki]

lol those pesky 0's and non 0's ;/

[hypn]

hahah, cool - glad you got it sorted

[Dyndrilliac]

Don't mean to necro-post, but I was cleaning out my documents folders and found something relevant to this thread, and I wanted to add a thread pointer to the guide's index for this topic.

bool SetDebugPrivileges() {

	LUID Luid;
	TOKEN_PRIVILEGES tpToken;
	HANDLE hToken;

	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) {
		return false;
	}

	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid)) {
		CloseHandle (hToken);
		return false;
	}

	tpToken.PrivilegeCount = 1;
	tpToken.Privileges[0].Luid = Luid;
	tpToken.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	if (!AdjustTokenPrivileges(hToken, false, &tpToken, NULL, NULL, NULL)) {
		CloseHandle(hToken);
		return false;
	}

	CloseHandle(hToken);
	return true;

}

[ZoiD]

Dyndrilliac you have to close hToken even if return value is 'true' since the handle was opened inside that function.

Not being snide ;p My code shared same issue.

BOOL EnableDebugPrivledges( void )
{
	HANDLE	hToken;
	LUID	Luid;
	TOKEN_PRIVILEGES tpToken;
	BOOL bRet = FALSE;

	// enable the SeDebugPrivilege
	if( 0 != OpenProcessToken( GetCurrentProcess( ) ,TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) && 
		0 != LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &Luid ) )
	{
		tpToken.PrivilegeCount			= 1;
		tpToken.Privileges[ 0 ].Luid		= Luid;
		tpToken.Privileges[ 0 ].Attributes	= SE_PRIVILEGE_ENABLED;
		bRet = 0 != AdjustTokenPrivileges( hToken, FALSE, &tpToken, NULL, NULL, NULL );

		CloseHandle( hToken );
	}

	return bRet;
}

In my ver, If LookupPrivilegeValue fails it will just jmp over and not close the handle.

[Dyndrilliac]

Fixed Thanks for pointing that out, it was incredibly old code and I didn't look it over thoroughly before posting it.