'text'에 해당되는 글 62건
- 2025.01.10 How to change the parent process when calling CreateProcess API
- 2024.04.09 How to open Control Panel Items in the separate explorer.exe
- 2022.01.20 How to list installed programs using IShellAppManager
- 2019.03.15 URLDownloadToFile with IBindStatusCallback and IHTTPSecurity 1
- 2019.02.16 How to make a volatile registry using NSIS script
- 2016.11.10 How to remove project dependency in Visual Studio
- 2015.03.12 Show a list of include files in visual studio
- 2015.01.12 Debugging windows services
- 2014.07.14 C++ Cocurrency tutorial
- 2014.03.04 Run program with Restricted Privilege
How to change the parent process when calling CreateProcess API

Usually, the parent process is the process that creats the new process. But you can change this behavior by setting STARTUPINFOEX.lpAttributeList.
HANDLE hParentProcess{ nullptr };
LPPROC_THREAD_ATTRIBUTE_LIST attrList{ nullptr };
// Initialize LPPROC_THREAD_ATTRIBUTE_LIST
hParentProcess = OpenProcess(PROCESS_CREATE_PROCESS, FALSE, parentProcessId);
SIZE_T attrListSize = 0;
InitializeProcThreadAttributeList(nullptr, 1, 0, &attrListSize);
attrList = (LPPROC_THREAD_ATTRIBUTE_LIST)malloc(attrListSize);
InitializeProcThreadAttributeList(attrList, 1, 0, &attrListSize);
UpdateProcThreadAttribute(attrList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &hParentProcess,
sizeof(hParentProcess), nullptr, nullptr);
// Set LPPROC_THREAD_ATTRIBUTE_LIST to the STARTUPINFOEX
STARTUPINFOEX si = { sizeof(si) };
si.StartupInfo.cb = sizeof(si);
si.lpAttributeList = attrList;
PROCESS_INFORMATION pi = { 0 };
CreateProcess(nullptr, argv[1], nullptr, nullptr, FALSE, EXTENDED_STARTUPINFO_PRESENT, nullptr, nullptr, &si.StartupInfo, &pi);
How to open Control Panel Items in the separate explorer.exe

If you want to open 'This PC\All Control Panel Items\Programs and Features'
First you need to convert each items to GUID
- This PC -> 20d04fe0-3aea-1069-a2d8-08002b30309d
- All Control Panel Items -> 21ec2020-3aea-1069-a2dd-08002b30309d
- Programs and Features -> 7b81be6a-ce2b-4676-a29e-eb907a5126c5
Then launch exporer.exe with /separate paramter
For example:
C:\Windows\explorer.exe /separate, ::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{21ec2020-3aea-1069-a2dd-08002b30309d}\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}
Then the above process will be terminated and the below process shows up with ' Programs and Features'
C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
If you want to launch explorer.exe as your descendant process, there is a way
- Run: C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
- This process is your descendant process and it is invisible.
- Run: C:\Windows\explorer.exe /separate, ::{20d04fe0-3aea-1069-a2d8-08002b30309d}\::{21ec2020-3aea-1069-a2dd-08002b30309d}\::{7b81be6a-ce2b-4676-a29e-eb907a5126c5}
- This process will be terminated and 'Programs and Features' will be showed in the previous explorer.exe.
- But if there is one more explorer.exe /factory, there is no gurantee which one shows 'Programs and Features'.
How to list installed programs using IShellAppManager

// appwiz.cpl is COM server related to (UnInstall or Change a program)
#include <shappmgr.h>
#include <iostream>
#import <appwiz.cpl>
// If this import gets into trobule, you could solve the problem by using #import directives
/*
#import <appwiz.cpl> rename("tag_inner_PROPVARIANT", "_tag_inner_PROPVARIANT") \
inject_statement("typedef struct _LARGE_INTEGER2 { LONGLONG QuadPart; } LARGE_INTEGER2;") \
inject_statement("typedef struct _ULARGE_INTEGER2 { ULONGLONG QuadPart;} ULARGE_INTEGER2;") \
rename("_LARGE_INTEGER", " _LARGE_INTEGER2") \
rename("_ULARGE_INTEGER", "_ULARGE_INTEGER2")
*/
int main()
{
::CoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
class __declspec(uuid("{352EC2B7-8B9A-11D1-B8AE-006008059382}")) AppWiz;
static const CLSID CLSID_AppWiz = __uuidof(AppWiz);
SHAPPMGRPLib::IShellAppManagerPtr spShellAppManaager;
HRESULT hr = spShellAppManaager.CreateInstance(CLSID_AppWiz, NULL, CLSCTX_INPROC_SERVER);
SHAPPMGRPLib::IEnumInstalledAppsPtr spEnumInstalledApps;
hr = spShellAppManaager->EnumInstalledApps(&spEnumInstalledApps);
SHAPPMGRPLib::IInstalledAppPtr spInstalledApp;
SHAPPMGRPLib::IInstalledApp* pInstalledApp;
while (S_OK == (hr = spEnumInstalledApps->Next(&pInstalledApp))) {
spInstalledApp = pInstalledApp;
SHAPPMGRPLib::_AppInfoData data = { 0 };
data.cbSize = sizeof(SHAPPMGRPLib::_AppInfoData);
data.dwMask = AIM_DISPLAYNAME | AIM_VERSION | AIM_PUBLISHER | AIM_INSTALLDATE;
hr = spInstalledApp->GetAppInfo(&data);
// You have to check the validation of the data before using it.
std::wcout << "Name: " << data.pszDisplayName << " ver: " << data.pszVersion
<< " publisher: " << data.pszPublisher << " installedOn: " << data.pszInstallDate << std::endl;
}
::CoUninitialize();
return 0;
}
URLDownloadToFile with IBindStatusCallback and IHTTPSecurity

The last parameter of URLDownloadToFile and URLDownloadToCacheFile API is the pointer of IBindStatusCallback.
This paramter is optional, so you can just set NULL; however, in my experience, you have to implement IBindStatusCallback in many cases.
class CBindStatusCallback : public IBindStatusCallback , public IHttpSecurity ///// IUnknown methods STDMETHOD_(ULONG,Release)() STDMETHOD(QueryInterface)(
|
- Implement IUnknown interface
- AddRef, Relase Method
- You can implement this function according to official rule, but there is trick.
- You can make this object local variable, then you don't need to worry about it's lifetime.
- return non-zero value: it means this object will not be destroyed.
- QueryInterface Method
- Implement IBindStatusCallback interface
- You don't need to implement every method; you can actually write 'return E_NOTIMPL' in almost cases.
- GetBindInfo method has crucial role.
- You can set a code page.
- If there is non English character in URL, it can be an issue depending on the OS language setting.
- Also, You can set several options.
- Implement IHttpSecurity interface
- You can download files even though the sever has some security problems such as a self-signed certificate.
HRESULT CBindStatusCallback::QueryInterface( if( IID_IUnknown == riid ) reinterpret_cast<IUnknown*>(*ppvObject)->AddRef(); } |
HRESULT CBindStatusCallback::GetBindInfo( *grfBINDF = BINDF_ASYNCHRONOUS; DWORD cbSize = pbindinfo->cbSize; return S_OK; } |
///// IWindowForBindingUI
|
How to make a volatile registry using NSIS script

There is no native way to make a volatile registry key in NSIS, so we have to call WINAPI directly.
!define REG_OPTION_VOLATILE 1 Function MakeVolatileKey System::Call 'advapi32::RegCreateKeyEx(i ${HKEY_LOCAL_MACHINE}, t "Software\volatile", i0, i0, i ${REG_OPTION_VOLATILE}, i ${GENERIC_WRITE}, i0, *i.r1, *i)i.r0' |
But, there is one thing we have to consider on 64bit Windows.
If we add a code 'SetRegView 64' in order to avoid registry redirection, two registry keys are made:
1. HKEY_LOCAL_MACHINE\SOFTWARE\Volatile (by WriteRegDWORD)
2, HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\volatile (by RegCreateKeyEx)
SetRegView can not affect native registry APIs; then we should apply a KEY_WOW64_64KEY option to RegCreateKeyEx API.
!include WinCore.nsh !define REG_OPTION_VOLATILE 1
${If} ${RunningX64} |
How to remove project dependency in Visual Studio

Issue : When removing a dependency of a project, I got a message "The dependency was added by the project system and cannot be removed
Solution
- Right click project, select Properties.
- Select Framework and References under Common Properties
- Select the references thats not needed.
- Click on Remove Reference.
Show a list of include files in visual studio

Configuration Properties -> C/C++ -> Advanced -> Show includes (YES)
Confirm what header file is included
ex) error C2039: 'int8_t' : is not a member of '`global namespace''
using psexec
psexec –sd –i 0 "c:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /noauth /anyuser /silent
How to debug Windows services with Windbg
c++ Concurrency tutorial
http://baptiste-wicht.com/categories/c11-concurrency-tutorial.html
1. Using PsExec
http://technet.microsoft.com/ko-kr/sysinternals/bb897553.aspx
PsExec -d
2. using CreateRestrictedToken, CreateProcessAsUser
HANDLE hProcessToken = NULL;
::OpenProcessToken( GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY | TOKEN_ADJUST_SESSIONID | TOKEN_READ | TOKEN_WRITE, &hProcessToken ); HANDLE hRestrictedToken = NULL; ::CreateRestrictedToken(hProcessToken, DISABLE_MAX_PRIVILEGE, 0, 0, 0, 0, 0, 0, &hRestrictedToken ); //Create startup info STARTUPINFO si = {0}; PROCESS_INFORMATION pi = {0}; si.lpDesktop = L"winsta0\\default"; si.cb = sizeof( si ); // Get the current executables name TCHAR exePath[MAX_PATH+1] = {0}; GetModuleFileName(NULL, exePath, MAX_PATH); // Start the new (non-elevated) restricted process
if( !CreateProcessAsUser(hRestrictedToken, L"c:\\windows\\notepad.exe", NULL, NULL, NULL, TRUE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi)) { CloseHandle(hRestrictedToken); return; } |
3 using SaferCreateLevel CreateProcessAsUser
|
SAFER_LEVEL_HANDLE hLevel = NULL;
if (!SaferCreateLevel(SAFER_SCOPEID_MACHINE, SAFER_LEVELID_NORMALUSER, SAFER_LEVEL_OPEN, &hLevel, NULL)) { return false; } HANDLE hRestrictedToken = NULL; if (!SaferComputeTokenFromLevel(hLevel, NULL, &hRestrictedToken, 0, NULL)) { SaferCloseLevel(hLevel); return false; } SaferCloseLevel(hLevel); //Create startup info STARTUPINFO si = {0}; PROCESS_INFORMATION pi = {0}; si.lpDesktop = L"winsta0\\default"; si.cb = sizeof( si ); // Get the current executables name TCHAR exePath[MAX_PATH+1] = {0}; GetModuleFileName(NULL, exePath, MAX_PATH); // Start the new (non-elevated) restricted process if( !CreateProcessAsUser(hRestrictedToken, exePath, NULL, NULL, NULL, TRUE, NORMAL_PRIORITY_CLASS, NULL, NULL, &si, &pi)) { CloseHandle(hRestrictedToken); return false; } CloseHandle(hRestrictedToken); CloseHandle(pi.hThread); CloseHandle(pi.hProcess); return true; |