出于安全原因，我的应用程序的 UI 模块以 high 运行mandatory integrity level .它里面的一切都很好，除了一件事。为了与旧版本兼容，我需要能够让用户向 UI 模块发出命令行调用。

目前这个机制是这样工作的:

1. Windows 资源管理器的快捷方式调用我的模块，这样说:

   path-to-module\module.exe -op="a, s, r"
   

2. 当 module.exe进程解析此命令行，然后使用 FindWindow 定位 UI 模块的运行拷贝(或自身的另一个拷贝)通过其独特的类名。然后它发送一个 registered message使用 PostMessage API。

3. 然后运行的 UI 模块(具有 high 完整性级别)在收到消息时进行相应处理。

问题是因为UI模块的运行拷贝有high完整性级别，它无法接收来自较低完整性级别的消息，或者当它由 Windows 资源管理器运行以解析快捷方式命令时的模块拷贝，这使得它以 medium 运行。完整性级别。

为了解决这个问题，我找到了这个 UIAccess标记( see here ，然后向下滚动到显示“UI 自动化应用程序的 UIAccess”的位置。)

所以我的假设是，如果我设置这个标志并对我的 UI 模块进行代码签名:

它将能够绕过我上面描述的 UIPI 限制。

它运行得很好:

但我看到的是 PostMessage当我从运行 medium 的模块调用它时，我上面描述的算法中的 API 仍然失败并显示 ERROR_ACCESS_DENIED完整性级别。

我错过了什么？

最佳答案

您描述的内容包含在 Win32 API 文档中:

PostMessage function

If the function fails, the return value is zero. To get extended error information, call GetLastError. GetLastError returns ERROR_NOT_ENOUGH_QUOTA when the limit is hit.

When a message is blocked by UIPI the last error, retrieved with GetLastError, is set to 5 (access denied).

UIPI 在哪里 User Interface Privilege Isolation :

What is User Interface Privilege Isolation (UIPI)

This is also known as UI Privilege Level Isolation (UIPI).

As part of the secure initiatuve in Vista, applications with UI will run in three different levels of privilege. Application windows can interact with others windows of the same or lower levels, but cannot interact with applications at higher level/permission.

Lower privilege modes can send messages to higher privileged applications only if explicitly allowed by the higher privilege application with a message calling ChangeWindowMessageFilter(). Also lower privileged applications can only read a HWND owned by a higher privileged application.

Internet Explorer is an example process that runs at the lowest privilege level.

Reference Links:
http://msdn2.microsoft.com/en-us/library/ms632675.aspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnlong/html/AccProtVista.asp

UIPI prevents lower privilege processes from accessing higher privilege processes by blocking the following behavior.

A lower privilege process cannot:

– Perform a window handle validation of higher process privilege.
– SendMessage or PostMessage to higher privilege application windows. These application programming interfaces (APIs) return success but silently drop the window message.
– Use thread hooks to attach to a higher privilege process.
– Use Journal hooks to monitor a higher privilege process.
– Perform dynamic link library (DLL)–injection to a higher privilege process.

With UIPI enabled, the following shared USER resources are still shared between processes at different privilege levels.

– Desktop window, which actually owns the screen surface
– Desktop heap read-only shared memory
– Global atom table
– Clipboard

正如文档所说，更高权限的应用程序需要使用ChangeWindowMessageFilter()允许来自较低权限应用程序的特定窗口消息:

Adds or removes a message from the User Interface Privilege Isolation (UIPI)message filter.

在 Windows 7 及更高版本上，使用 ChangeWindowMessageFilterEx()相反:

Modifies the User Interface Privilege Isolation (UIPI) message filter for a specified window.

因此，在您的情况下，在您的更高特权进程调用 RegisterWindowMessage() 以获取已注册的消息 ID 之后，它需要将该 ID 传递给 ChangeWindowMessageFilter/Ex() 以便从低权限进程接收该消息。

关于c++ - 跨进程 PostMessage、UIPI 限制和 UIAccess=”true”，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/40122964/