• QtService实现Qt后台服务程序其二_启动外部exe无窗口异常的解决

    ——接上篇——

    启动外部exe无窗口异常的解决，Qt5.9.2亲测通过

    1、背景

    Windows下服务直接启动窗口程序时，在任务管理器中可以看到窗口程序正在运行，但是桌面上并没有显示出窗口。

    这是因为在Windows XP、Windows Server 2003 或早期Windows 系统时代，当第一个用户登录系统后服务和应用程序是在同一个Session 中运行的，也就是Session 0。

    但是这种运行方式提高了系统安全风险，因为服务是通过提升了用户权限运行的，而应用程序往往是那些不具备管理员身份的普通用户运行的，其中的危险显而易见。

    所以从Vista 开始Session 0 中只包含系统服务，其他应用程序则通过分离的Session 运行，将服务与应用程序隔离提高系统的安全性。这样使得Session 0 与其他Session 之间无法进行交互，不能通过服务向桌面用户弹出信息窗口、UI 窗口等信息。

    这个时候如果想让我们的界面程序被服务启动就必须穿透Session 0 隔离。在实际开发过程中，可以通过Process Explorer检查服务或程序处于哪个Session，会不会遇到Session 0 隔离问题。

            下面就是穿透Session 0 隔离及服务启动窗口程序的步骤：

            1、使用OpenProcessToken函数来打开与服务进程相关联的访问令牌；

            2、使用DuplicateTokenEx函数创建一个新的访问令牌来复制一个已经存在的标记；

            3、使用SetTokenInformation函数把服务token的SessionId替换成当前活动的Session；

            4、使用CreateEnvironmentBlock函数创建进程环境块；

            5、使用CreateProcessAsUser函数在活动的Session下创建进程

    2、Demo说明

    加入WtsApi32.lib，Userenv.lib库等，解决QService启动外部进程没有GUI的问题

    .pro加入代码：

    1. #WtsApi32.lib，Userenv.lib库等，解决QService启动外部进程没有GUI的问题
    2. LIBS += \
    3.     #-L$$DESTDIR \
    4.     -lWtsApi32 \
    5.     -lAdvApi32 \
    6.     -lUserEnv

    加入ProcessLoader类

    processloader.h代码：

    1. #ifndef PROCESSLOADER_H
    2. #define PROCESSLOADER_H
    3.  
    4. #include 
    5.  
    6. //解决QService启动外部进程没有GUI的问题
    7.  
    8. class ProcessLoader
    9. {
    10. public:
    11.     ProcessLoader();
    12.     ~ProcessLoader();
    13.  
    14. public:
    15.  
    16. #ifdef Q_OS_WIN
    17.     static bool LaunchAppIntoDifferentSession(std::wstring command);//方式2
    18. #endif
    19.  
    20. };
    21.  
    22. #endif // PROCESSLOADER_H

    processloader.cpp代码：

    1. #include "processloader.h"
    2.  
    3. #ifdef Q_OS_WIN
    4.  
    5. #include 
    6. #include 
    7. #include 
    8. #include 
    9. #include 
    10.  
    11. #endif
    12.  
    13.  
    14. ProcessLoader::ProcessLoader()
    15. {}
    16.  
    17. ProcessLoader::~ProcessLoader()
    18. {}
    19.  
    20.  
    21. #ifdef Q_OS_WIN
    22.  
    23.  
    24. #include 
    25. bool ProcessLoader::LaunchAppIntoDifferentSession(std::wstring command)
    26. {
    27.     PROCESS_INFORMATION pi;
    28.     STARTUPINFO si;
    29.     BOOL bResult = FALSE;
    30.     DWORD dwSessionId,winlogonPid;
    31.     HANDLE hUserToken=INVALID_HANDLE_VALUE,hUserTokenDup=INVALID_HANDLE_VALUE,
    32.             hPToken=INVALID_HANDLE_VALUE,hProcess=INVALID_HANDLE_VALUE;
    33.     DWORD dwCreationFlags;
    34.  
    35.     int errorcode;//whl2023-10-18
    36.     LPVOID pEnv =NULL;
    37.     TCHAR commandLine[MAX_PATH];
    38.  
    39.     // Log the client on to the local computer.
    40.  
    41.     dwSessionId = WTSGetActiveConsoleSessionId();
    42.  
    43.     //
    44.     // Find the winlogon process
    45.  
    46.  
    47.     PROCESSENTRY32 procEntry;
    48.  
    49.     HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    50.     if (hSnap == INVALID_HANDLE_VALUE)
    51.     {
    52.         return false ;
    53.     }
    54.  
    55.     procEntry.dwSize = sizeof(PROCESSENTRY32);
    56.  
    57.     if (!Process32First(hSnap, &procEntry))
    58.     {
    59.         return false ;
    60.     }
    61.  
    62.     do
    63.     {
    64.         if (_wcsicmp(procEntry.szExeFile, L"winlogon.exe") == 0)
    65.         {
    66.             // We found a winlogon process...
    67.             // make sure it's running in the console session
    68.             DWORD winlogonSessId = 0;
    69.             if (ProcessIdToSessionId(procEntry.th32ProcessID, &winlogonSessId)
    70.                     && winlogonSessId == dwSessionId)
    71.             {
    72.                 winlogonPid = procEntry.th32ProcessID;
    73.                 break;
    74.             }
    75.         }
    76.  
    77.     } while (Process32Next(hSnap, &procEntry));
    78.  
    79.  
    80.  
    81.     WTSQueryUserToken(dwSessionId,&hUserToken);
    82.     dwCreationFlags = NORMAL_PRIORITY_CLASS|CREATE_NEW_CONSOLE;
    83.     ZeroMemory(&si, sizeof(STARTUPINFO));
    84.     si.cb= sizeof(STARTUPINFO);
    85.     si.lpDesktop = L"winsta0\\default";
    86.     ZeroMemory(&pi, sizeof(pi));
    87.     TOKEN_PRIVILEGES tp;
    88.     LUID luid;
    89.     hProcess = OpenProcess(MAXIMUM_ALLOWED,FALSE,winlogonPid);
    90.  
    91.     if(!::OpenProcessToken(hProcess,TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY
    92.                            |TOKEN_DUPLICATE|TOKEN_ASSIGN_PRIMARY|TOKEN_ADJUST_SESSIONID
    93.                            |TOKEN_READ|TOKEN_WRITE,&hPToken))
    94.     {
    95.         errorcode = GetLastError();
    96.         printf("Process token open Error: %u\n",GetLastError());
    97.         //goto ToFree;//whl2023-10-18
    98.     }
    99.  
    100.     if (!LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid))
    101.     {
    102.         printf("Lookup Privilege value Error: %u\n",GetLastError());
    103.         //goto ToFree;//whl2023-10-18
    104.     }
    105.     tp.PrivilegeCount =1;
    106.     tp.Privileges[0].Luid =luid;
    107.     tp.Privileges[0].Attributes =SE_PRIVILEGE_ENABLED;
    108.  
    109.     DuplicateTokenEx(hPToken,MAXIMUM_ALLOWED,NULL,
    110.                      SecurityIdentification,TokenPrimary,&hUserTokenDup);
    111.     errorcode = GetLastError();
    112.  
    113.     // Adjust Token privilege
    114.     SetTokenInformation(hUserTokenDup,
    115.                         TokenSessionId,(void*)dwSessionId,sizeof(DWORD));
    116.  
    117.     if (!AdjustTokenPrivileges(hUserTokenDup,FALSE,&tp,sizeof(TOKEN_PRIVILEGES),
    118.                                (PTOKEN_PRIVILEGES)NULL,NULL))
    119.     {
    120.         errorcode = GetLastError();
    121.         printf("Adjust Privilege value Error: %u\n",GetLastError());
    122.         //goto ToFree;//whl2023-10-18
    123.     }
    124.  
    125.     if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
    126.     {
    127.         printf("Token does not have the provilege\n");
    128.         //goto ToFree;//whl2023-10-18
    129.     }
    130.  
    131.  
    132.  
    133.     if(CreateEnvironmentBlock(&pEnv,hUserTokenDup,TRUE))
    134.     {
    135.         dwCreationFlags|=CREATE_UNICODE_ENVIRONMENT;
    136.     }
    137.     else
    138.         pEnv=NULL;
    139.  
    140.     // Launch the process in the client's logon session.
    141.  
    142.     _tcscpy_s(commandLine, MAX_PATH, command.c_str());
    143.  
    144.     bResult = CreateProcessAsUser(
    145.                 hUserTokenDup,                     // client's access token
    146.                 //_T("cmd.exe"),        // file to execute
    147.                 //NULL,                 // command line
    148.                 NULL,                   // file to execute
    149.                 (LPWSTR)(commandLine),  // command line
    150.                 NULL,            // pointer to process SECURITY_ATTRIBUTES
    151.                 NULL,               // pointer to thread SECURITY_ATTRIBUTES
    152.                 FALSE,              // handles are not inheritable
    153.                 dwCreationFlags,     // creation flags
    154.                 pEnv,               // pointer to new environment block
    155.                 NULL,               // name of current directory
    156.                 &si,               // pointer to STARTUPINFO structure
    157.                 &pi                // receives information about new process
    158.                 );
    159.     // End impersonation of client.
    160.  
    161.     // GetLastError Shud be 0
    162.  
    163.     errorcode = GetLastError();
    164.     bResult = true;
    165.     // Perform All the Close Handles tasks
    166. ToFree:
    167.     {
    168.         if(hProcess != INVALID_HANDLE_VALUE)
    169.         {
    170.             CloseHandle(hProcess);
    171.         }
    172.         if(hUserToken != INVALID_HANDLE_VALUE)
    173.         {
    174.             CloseHandle(hUserToken);
    175.         }
    176.         if(hUserTokenDup != INVALID_HANDLE_VALUE)
    177.         {
    178.             CloseHandle(hUserTokenDup);
    179.         }
    180.         if(hPToken != INVALID_HANDLE_VALUE)
    181.         {
    182.             CloseHandle(hPToken);
    183.         }
    184.     }
    185.     return bResult;
    186. }
    187.  
    188. #endif

    调用方式举例：

    1. //要启动的进程名
    2. #define PROCESS_NAME "EDU_CLIENT.exe"
    3. QString str_app_name = PROCESS_NAME;
    4. #ifdef Q_OS_WIN
    5.         std::wstring command = str_app_name.toStdWString();
    6.         if (ProcessLoader::LaunchAppIntoDifferentSession(command) == false) {
    7.             qDebug() << "Failed to launch " << command.c_str();
    8.         }
    9. #endif

    附：

    亲测无效方式1：

    1. bool ProcessLoader::ServerRunWndProcess(std::wstring command)
    2. {
    3.     TCHAR commandLine[MAX_PATH];
    4.     HANDLE hToken = NULL;
    5.     if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
    6.     {
    7.         return false;
    8.     }
    9.  
    10.     HANDLE hTokenDup = NULL;
    11.     bool bRet = DuplicateTokenEx(hToken, TOKEN_ALL_ACCESS, NULL, SecurityIdentification, TokenPrimary, &hTokenDup);
    12.     if (!bRet || hTokenDup == NULL)
    13.     {
    14.         CloseHandle(hToken);
    15.         return false;
    16.     }
    17.  
    18.     DWORD dwSessionId = WTSGetActiveConsoleSessionId();
    19.     //把服务hToken的SessionId替换成当前活动的Session(即替换到可与用户交互的winsta0下)
    20.     if (!SetTokenInformation(hTokenDup, TokenSessionId, &dwSessionId, sizeof(DWORD)))
    21.     {
    22.         DWORD nErr = GetLastError();
    23.         CloseHandle(hTokenDup);
    24.         CloseHandle(hToken);
    25.         return false;
    26.     }
    27.  
    28.     STARTUPINFO si;
    29.     ZeroMemory(&si, sizeof(STARTUPINFO));
    30.  
    31.     si.cb = sizeof(STARTUPINFO);
    32.     si.lpDesktop = _T("WinSta0\\Default");
    33.     si.wShowWindow = SW_SHOW;
    34.     si.dwFlags = STARTF_USESHOWWINDOW /*|STARTF_USESTDHANDLES*/;
    35.  
    36.     //创建进程环境块
    37.     LPVOID pEnv = NULL;
    38.     bRet = CreateEnvironmentBlock(&pEnv, hTokenDup, FALSE);
    39.     if (!bRet)
    40.     {
    41.         CloseHandle(hTokenDup);
    42.         CloseHandle(hToken);
    43.         return false;
    44.     }
    45.  
    46.     if (pEnv == NULL)
    47.     {
    48.         CloseHandle(hTokenDup);
    49.         CloseHandle(hToken);
    50.         return false;
    51.     }
    52.  
    53.     //在活动的Session下创建进程
    54.     PROCESS_INFORMATION processInfo;
    55.     ZeroMemory(&processInfo, sizeof(PROCESS_INFORMATION));
    56.     DWORD dwCreationFlag = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT;
    57.     _tcscpy_s(commandLine, MAX_PATH, command.c_str());
    58.     if (!CreateProcessAsUser(hTokenDup, NULL, (LPWSTR)(commandLine) , NULL, NULL, FALSE, dwCreationFlag, pEnv, NULL, &si, &processInfo))
    59.     {
    60.         DWORD nRet = GetLastError();
    61.         CloseHandle(hTokenDup);
    62.         CloseHandle(hToken);
    63.         return false;
    64.     }
    65.  
    66.     DestroyEnvironmentBlock(pEnv);
    67.     CloseHandle(hTokenDup);
    68.     CloseHandle(hToken);
    69.  
    70.     return true;
    71. }

    亲测无效方式2：

    1. bool ProcessLoader::loadWindowsApplication(std::wstring command)
    2. {
    3.     BOOL bResult = FALSE;
    4.  
    5.     DWORD dwSessionId = WTSGetActiveConsoleSessionId();
    6.     if (dwSessionId == 0xFFFFFFFF)
    7.     {
    8.         return false;
    9.     }
    10.  
    11.     HANDLE hUserToken = NULL;
    12.     if (WTSQueryUserToken(dwSessionId, &hUserToken) == FALSE)
    13.     {
    14.         DWORD error = GetLastError();
    15.         return false;
    16.     }
    17.  
    18.     HANDLE hTheToken = NULL;
    19.     if (DuplicateTokenEx(hUserToken, TOKEN_ASSIGN_PRIMARY | TOKEN_ALL_ACCESS, 0, SecurityImpersonation, TokenPrimary, &hTheToken) == TRUE)
    20.     {
    21.  
    22.         if (ImpersonateLoggedOnUser(hTheToken) == TRUE)
    23.         {
    24.             DWORD dwCreationFlags = HIGH_PRIORITY_CLASS | CREATE_NEW_CONSOLE;
    25.  
    26.             STARTUPINFO si = { sizeof(si) };
    27.             PROCESS_INFORMATION pi;
    28.             SECURITY_ATTRIBUTES Security1 = { sizeof(Security1) };
    29.             SECURITY_ATTRIBUTES Security2 = { sizeof(Security2) };
    30.  
    31.             LPVOID pEnv = NULL;
    32.             if (CreateEnvironmentBlock(&pEnv, hTheToken, TRUE) == TRUE)
    33.             {
    34.                 dwCreationFlags |= CREATE_UNICODE_ENVIRONMENT;
    35.             }
    36.  
    37.             TCHAR commandLine[MAX_PATH];
    38.             _tcscpy_s(commandLine, MAX_PATH, command.c_str());
    39.  
    40.             // Launch the process in the client's logon session.
    41.             bResult = CreateProcessAsUser(
    42.                 hTheToken,
    43.                 NULL,   // (LPWSTR)(path),
    44.                 (LPWSTR)(commandLine),
    45.                 &Security1,
    46.                 &Security2,
    47.                 FALSE,
    48.                 dwCreationFlags,
    49.                 pEnv,
    50.                 NULL,
    51.                 &si,
    52.                 &pi
    53.                 );
    54.  
    55.             RevertToSelf();
    56.  
    57.             if (pEnv)
    58.             {
    59.                 DestroyEnvironmentBlock(pEnv);
    60.             }
    61.         }
    62.         CloseHandle(hTheToken);
    63.     }
    64.     CloseHandle(hUserToken);
    65.  
    66.     return bResult==TRUE;
    67. }

  • 相关阅读:
    Unity之ShaderGraph如何实现飘动的红旗
    音视频学习 - Qt6.3.1版本下实现屏幕截图功能
    【Java 基础篇】Java List 使用指南：深入解析列表操作
    Mac苹果电脑分辨率修改管理 安装SwitchResX 完美解决
    人才测评系统在企业招聘中的应用
    Sql Server查数据库job任务
    史上最全英语语法
    【CSS】css常用复杂选择器都有哪些？看这一篇就够了_07
    【Kubernetes】Kubernetes 对象是什么？
    Jumpserver堡垒机使用与二次开发详解
  • 原文地址：https://blog.csdn.net/csdndenglu/article/details/133922483