// ss.cpp: 主项目文件。
#include <windows.h>
#include <tlhelp32.h>
#include <aclapi.h>
#include <Psapi.h>
#pragma comment(lib,"Psapi.lib")


int ProcessExit(LPCTSTR szProcName,int x)
{
    PROCESSENTRY32    pe; 
    DWORD    dwRet;
    BOOL    bFound = FALSE;
    HANDLE hProcess;
    char fileName[1024] = {0};
    HANDLE hSP = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSP)
    {
        pe.dwSize = sizeof(pe);

        for (dwRet = Process32First(hSP, &pe); 
            dwRet;
            dwRet = Process32Next(hSP, &pe))
        {
            if(x){
                if (lstrcmpi( szProcName, pe.szExeFile) == 0)
                {
                    bFound = TRUE;
                    break;
                }
            }
            else
            {
                hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,pe.th32ProcessID);
                if(hProcess)
                {
                    Sleep(1);
                    GetModuleFileNameEx(hProcess,NULL, (LPSTR)fileName,sizeof(fileName));
                    Sleep(1);
                    if (lstrcmpi( szProcName, fileName) == 0)
                    {
                        bFound = TRUE;
                        break;
                    }
                }
                CloseHandle(hProcess);
            }
        }
        CloseHandle(hSP);    
    }
    return bFound;
}
BOOL EnableDebugPriv( LPCTSTR szPrivilege )
{

    HANDLE hToken;
    LUID sedebugnameValue;
    TOKEN_PRIVILEGES tkp;

    if ( !OpenProcessToken( GetCurrentProcess(),
        TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
        &hToken ) )
    {
        return FALSE;
    }
    if ( !LookupPrivilegeValue( NULL, szPrivilege, &sedebugnameValue ) )
    {
        CloseHandle( hToken );
        return FALSE;
    }

    tkp.PrivilegeCount = 1;
    tkp.Privileges[0].Luid = sedebugnameValue;
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    if ( !AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
    {
        CloseHandle( hToken );
        return FALSE;
    }

    return TRUE;
}


DWORD GetProcessId( LPCTSTR szProcName )
{
    PROCESSENTRY32 pe;  
    DWORD dwPid;
    DWORD dwRet;
    BOOL bFound = FALSE;

    //
    // 通过 TOOHLP32 函数枚举进程
    //

    HANDLE hSP = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
    if ( hSP )
    {
        pe.dwSize = sizeof( pe );

        for ( dwRet = Process32First( hSP, &pe );
            dwRet;
            dwRet = Process32Next( hSP, &pe ) )
        {
            if ( lstrcmpi(szProcName, pe.szExeFile) == 0 )
            {
                dwPid = pe.th32ProcessID;
                bFound = TRUE;
                break;
            }
        }

        CloseHandle( hSP );

        if ( bFound == TRUE )
        {
            return dwPid;
        }
    }

    return NULL;
}


BOOL MySystem( LPTSTR szProcessName )
{
    HANDLE hProcess;
    HANDLE hToken, hNewToken;
    DWORD dwPid;

    PACL pOldDAcl = NULL;
    PACL pNewDAcl = NULL;
    BOOL bDAcl;
    BOOL bDefDAcl;
    DWORD dwRet;

    PACL pSacl = NULL;
    PSID pSidOwner = NULL;
    PSID pSidPrimary = NULL;
    DWORD dwAclSize = 0;
    DWORD dwSaclSize = 0;
    DWORD dwSidOwnLen = 0;
    DWORD dwSidPrimLen = 0;

    DWORD dwSDLen;
    EXPLICIT_ACCESS ea;
    PSECURITY_DESCRIPTOR pOrigSd = NULL;
    PSECURITY_DESCRIPTOR pNewSd = NULL;

    STARTUPINFO si;
    PROCESS_INFORMATION pi;

    BOOL bError;

    if (!EnableDebugPriv("SeDebugPrivilege"))
    {
        bError = TRUE;
        goto Cleanup;
    }

    if ( ( dwPid = GetProcessId("WINLOGON.EXE") ) == NULL )
    {
        bError = TRUE;
        goto Cleanup;
    }

    hProcess = OpenProcess( MAXIMUM_ALLOWED, FALSE, dwPid );
    if ( hProcess == NULL )
    {
        bError = TRUE;
        goto Cleanup;
    }

    if ( !OpenProcessToken( hProcess, READ_CONTROL | WRITE_DAC, &hToken ) )
    {
        bError = TRUE;
        goto Cleanup;
    }

    ZeroMemory( &ea, sizeof( EXPLICIT_ACCESS ) );
    BuildExplicitAccessWithName( &ea,
        "Everyone",
        TOKEN_ALL_ACCESS,
        GRANT_ACCESS,
        0 );

    if ( !GetKernelObjectSecurity( hToken,
        DACL_SECURITY_INFORMATION,
        pOrigSd,
        0,
        &dwSDLen ) )
    {

        if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )
        {
            pOrigSd = ( PSECURITY_DESCRIPTOR ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwSDLen );
            if ( pOrigSd == NULL )
            {
                bError = TRUE;
                goto Cleanup;
            }

            if ( !GetKernelObjectSecurity( hToken,
                DACL_SECURITY_INFORMATION,
                pOrigSd,
                dwSDLen,
                &dwSDLen ) )
            {
                bError = TRUE;
                goto Cleanup;
            }
        }
        else
        {
            bError = TRUE;
            goto Cleanup;
        }
    }

    if ( !GetSecurityDescriptorDacl( pOrigSd, &bDAcl, &pOldDAcl, &bDefDAcl ) )
    {
        bError = TRUE;
        goto Cleanup;
    }


    dwRet = SetEntriesInAcl( 1, &ea, pOldDAcl, &pNewDAcl ); 
    if ( dwRet != ERROR_SUCCESS )
    {
        pNewDAcl = NULL;

        bError = TRUE;
        goto Cleanup;
    } 

    if ( !MakeAbsoluteSD( pOrigSd,
        pNewSd,
        &dwSDLen,
        pOldDAcl,
        &dwAclSize,
        pSacl,
        &dwSaclSize,
        pSidOwner,
        &dwSidOwnLen,
        pSidPrimary,
        &dwSidPrimLen ) )
    {

        if ( GetLastError() == ERROR_INSUFFICIENT_BUFFER )
        {
            pOldDAcl = ( PACL ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwAclSize );
            pSacl = ( PACL ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwSaclSize );
            pSidOwner = ( PSID ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwSidOwnLen );
            pSidPrimary = ( PSID ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwSidPrimLen );
            pNewSd = ( PSECURITY_DESCRIPTOR ) HeapAlloc( GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                dwSDLen );

            if ( pOldDAcl == NULL ||
                pSacl == NULL ||
                pSidOwner == NULL ||
                pSidPrimary == NULL ||
                pNewSd == NULL )
            {
                bError = TRUE;
                goto Cleanup;
            }

            if ( !MakeAbsoluteSD( pOrigSd,
                pNewSd,
                &dwSDLen,
                pOldDAcl,
                &dwAclSize,
                pSacl,
                &dwSaclSize,
                pSidOwner,
                &dwSidOwnLen,
                pSidPrimary,
                &dwSidPrimLen ) )
            {
                bError = TRUE;
                goto Cleanup;
            }
        }
        else
        {
            bError = TRUE;
            goto Cleanup;
        }
    }

    if ( !SetSecurityDescriptorDacl( pNewSd, bDAcl, pNewDAcl, bDefDAcl ) )
    {
        bError = TRUE;
        goto Cleanup;
    }

    if ( !SetKernelObjectSecurity( hToken, DACL_SECURITY_INFORMATION, pNewSd ) )
    {
        bError = TRUE;
        goto Cleanup;
    }

    if ( !OpenProcessToken( hProcess, TOKEN_ALL_ACCESS, &hToken ) )
    {
        bError = TRUE;
        goto Cleanup;
    }

    if ( !DuplicateTokenEx( hToken,
        TOKEN_ALL_ACCESS,
        NULL,
        SecurityImpersonation,
        TokenPrimary,
        &hNewToken ) )
    {
        bError = TRUE;
        goto Cleanup;
    }


    ZeroMemory( &si, sizeof( STARTUPINFO ) );
    si.cb = sizeof( STARTUPINFO );

    ImpersonateLoggedOnUser( hNewToken );

    if ( !CreateProcessAsUser( hNewToken,
        NULL,
        szProcessName,
        NULL,
        NULL,
        FALSE,
        NULL, //NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE,
        NULL,
        NULL,
        &si,
        &pi ) )
    {
        bError = TRUE;
        goto Cleanup;
    }

    bError = FALSE;

Cleanup:
    if ( pOrigSd )
    {
        HeapFree( GetProcessHeap(), 0, pOrigSd );
    }
    if ( pNewSd )
    {
        HeapFree( GetProcessHeap(), 0, pNewSd );
    }
    if ( pSidPrimary )
    {
        HeapFree( GetProcessHeap(), 0, pSidPrimary );
    }
    if ( pSidOwner )
    {
        HeapFree( GetProcessHeap(), 0, pSidOwner );
    }
    if ( pSacl )
    {
        HeapFree( GetProcessHeap(), 0, pSacl );
    }
    if ( pOldDAcl )
    {
        HeapFree( GetProcessHeap(), 0, pOldDAcl );
    }

    CloseHandle( pi.hProcess );
    CloseHandle( pi.hThread );
    CloseHandle( hToken );
    CloseHandle( hNewToken );
    CloseHandle( hProcess );

    if ( bError )
    {
        return FALSE;
    }

    return TRUE;
}
int main(int argc, char* argv[])
{
    MySystem("cmd.exe");
    return 0;
}

麻烦大家帮我看下这代码  这是原版源码

我用的是VC2010    使用的Unicode字符集   最后我把字符都转过来了  但是在调用MySystem函数的时候 一直没有实现功能  麻烦打击帮帮忙