Privileges for registry editting

[nohimn]

The RegLoadKey function requires that I set both SE_BACKUP_NAME and SE_RESTORE_NAME to enabled. I'm currently trying, but I keep getting an error:

Run-Time Check Failure #2 - Stack around the variable 'tkp' was corrupted.

The code:

#include <windows.h>

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
HANDLE hToken = NULL;
LUID rLuid;
LUID bLuid;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken);
TOKEN_PRIVILEGES tkp;

LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &tkp.Privileges[0].Luid);
LookupPrivilegeValue(NULL, SE_RESTORE_NAME, &tkp.Privileges[1].Luid);
tkp.PrivilegeCount = 2;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tkp.Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, 0);
CloseHandle(hToken);
RegLoadKey(HKEY_USERS, L"Test\\", L"C:\\Documents and Settings\\test\\NTUSER.DAT");
return 0;
}

I'm just digging into WinAPI, and I only picked up c++ last semester, so I'm willing to bet that this is a fairly elementary mistake. But I can't seem to find it. I did track that the error occurs when I try to set anything to tkp.Privileges[1], so it's probably an array issue, but I just can't figure out exactly how to go about fixing this. Anyone?

[weaknessforcats]

The PriviledgeCount member of TOKEN_PRIVILEGES has the number of elements in the array. I would check that before assuming [0] or [1].


Exactly how is this getting set?

[nohimn]

I'm setting that variable like so:

tkp.PrivilegeCount = 2;

declaring this before the LookupPrivilegeValue function doesn't change the issue. I found an article that essentially does what I'm trying to do in VB

http://support.microsoft.com/kb/297060

I can't see where I'm going wrong.

[grayMist]

the TOKEN_PRIVILEGES struct defines the Privileges as an ANY_SIZE array.
Which simply means that the array size is 1.

This allows the TOKEN_PRIVILEGES struct to be used to type cast an arbitrary sized buffer and access the Privilege member at any offset (the max being defined by the PrivilegeCount member)

If you simply access TOKEN_PRIVILEGES struct after a normal defination, the maximum Privileges can only be 1.

You can first do a GetTokenInformation() on the token handle returned by OpenProcessToken() with the TOKEN_INFORMATION_CLASS enum set to TokenPrivileges . This will return the actual privileges in the return buffer.
and then modify the returned TOKEN_PRIVILEGES using AdjustTokenPrivileges()

You may also skip the GetTokenInformation() altogether and directly go for AdjustTokenPrivileges(), but in that case use the PTOKEN_PRIVILEGES to typecast an adequately large buffer and then set the new privileges.

[nohimn]

Thanks grayMist! I basically used your last suggestion, and allocated a larger buffer to fit both items in the array. It seems to work without error now!:

#include <windows.h>

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
HANDLE hToken = NULL;
LUID rLuid;
LUID bLuid;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken);
int offset = FIELD_OFFSET(TOKEN_PRIVILEGES, Privileges[2]);
PTOKEN_PRIVILEGES tkp = (PTOKEN_PRIVILEGES) malloc(offset);




tkp->PrivilegeCount = 2;
tkp->Privileges[0];
LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &bLuid);
tkp->Privileges[0].Luid = bLuid;
tkp->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
LookupPrivilegeValue(NULL, SE_RESTORE_NAME, &rLuid);
tkp->Privileges[1].Luid = rLuid;
tkp->Privileges[1].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, tkp, 0, NULL, 0);
CloseHandle(hToken);
RegLoadKey(HKEY_USERS, L"Test\\", L"C:\\Documents and Settings\\test\\NTUSER.DAT");
return 0;
}