diff --git a/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.sln b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.sln new file mode 100644 index 0000000..c6cc471 --- /dev/null +++ b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.3.32804.467 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NTV_05_RtlAdjustPrivilege", "NTV_05_RtlAdjustPrivilege\NTV_05_RtlAdjustPrivilege.vcxproj", "{EEAA3DB2-5F86-4204-BE11-608B75C963D7}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Debug|x64.ActiveCfg = Debug|x64 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Debug|x64.Build.0 = Debug|x64 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Debug|x86.ActiveCfg = Debug|Win32 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Debug|x86.Build.0 = Debug|Win32 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Release|x64.ActiveCfg = Release|x64 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Release|x64.Build.0 = Release|x64 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Release|x86.ActiveCfg = Release|Win32 + {EEAA3DB2-5F86-4204-BE11-608B75C963D7}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {60B57A63-F501-4F26-9046-C2F9A24332CF} + EndGlobalSection +EndGlobal diff --git a/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.cpp b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.cpp new file mode 100644 index 0000000..47c3ac7 --- /dev/null +++ b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.cpp @@ -0,0 +1,35 @@ +// NTV_05_RtlAdjustPrivilege.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。 +// + +#include + +//准备函数指针 +typedef UINT(CALLBACK* typeRtlAdjustPrivilege)(ULONG, BOOL, BOOL, PINT); + +//从ntdll.dll中获取函数,封装API +UINT RtlAdjustPrivilege(ULONG Privilege, BOOL bEnablePrivilege, BOOL IsThreadPrivilege, PINT PreviousValue) +{ + HMODULE hDll = GetModuleHandle(L"ntdll.dll"); + if (hDll == NULL) + return false; + typeRtlAdjustPrivilege func_RtlAdjustPrivilege = (typeRtlAdjustPrivilege)GetProcAddress(hDll, "RtlAdjustPrivilege"); + return func_RtlAdjustPrivilege(Privilege, bEnablePrivilege, IsThreadPrivilege, PreviousValue); +} + +//API函数的调用(以获取SeShutdownPrivilege为例) +void NtGetShutdown() +{ + int nEn = 0; + LUID luidPriv; + LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &luidPriv); + RtlAdjustPrivilege(luidPriv.LowPart, TRUE, FALSE, &nEn); + return; +} + +//测试用主函数——尝试关闭计算机 +int main() +{ + NtGetShutdown(); + ExitWindowsEx(EWX_SHUTDOWN, 0); + return 0; +} \ No newline at end of file diff --git a/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj new file mode 100644 index 0000000..d6121a0 --- /dev/null +++ b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj @@ -0,0 +1,135 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {eeaa3db2-5f86-4204-be11-608b75c963d7} + NTV05RtlAdjustPrivilege + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.filters b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.filters new file mode 100644 index 0000000..6e5b551 --- /dev/null +++ b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + 源文件 + + + \ No newline at end of file diff --git a/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.user b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege/NTV_05_RtlAdjustPrivilege.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file