Session 0 Isolation (II)

public static void CreateProcess(string app, string path)
{
bool result;
IntPtr hToken = ().Token;
IntPtr hDupedToken = ;

PROCESS_INFORMATION pi = new PROCESS_INFORMATION();
SECURITY_ATTRIBUTES sa = new SECURITY_ATTRIBUTES();
= (sa);

STARTUPINFO si = new STARTUPINFO();
= (si);

int dwSessionID = WTSGetActiveConsoleSessionId();
result = WTSQueryUserToken(dwSessionID, out hToken);

if (!result)
{
ShowMessageBox("WTSQueryUserToken failed", "AlertService Message");
}

result = DuplicateTokenEx(
hToken,
GENERIC_ALL_ACCESS,
ref sa,
(int)SECURITY_IMPERSONATION_LEVEL.SecurityIdentification,
(int)TOKEN_TYPE.TokenPrimary,
ref hDupedToken
);

if (!result)
{
ShowMessageBox("DuplicateTokenEx failed" ,"AlertService Message");
}

IntPtr lpEnvironment = ;
result = CreateEnvironmentBlock(out lpEnvironment, hDupedToken, false);

if (!result)
{
ShowMessageBox("CreateEnvironmentBlock failed", "AlertService Message");
}

result = CreateProcessAsUser(
hDupedToken,
app,
,
ref sa, ref sa,
false, 0, ,
path, ref si, ref pi);

if (!result)
{
int error = Marshal.GetLastWin32Error();
string message = ("CreateProcessAsUser Error: {0}", error);
ShowMessageBox(message, "AlertService Message");
}

if ( != )
CloseHandle();
if ( != )
CloseHandle();
if (hDupedToken != )
CloseHandle(hDupedToken);
}

[StructLayout()]
public struct STARTUPINFO
{
public Int32 cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public Int32 dwX;
public Int32 dwY;
public Int32 dwXSize;
public Int32 dwXCountChars;
public Int32 dwYCountChars;
public Int32 dwFillAttribute;
public Int32 dwFlags;
public Int16 wShowWindow;
public Int16 cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}

[StructLayout()]
public struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public Int32 dwProcessID;
public Int32 dwThreadID;
}

[StructLayout()]
public struct SECURITY_ATTRIBUTES
{
public Int32 Length;
public IntPtr lpSecurityDescriptor;
public bool bInheritHandle;
}

public enum SECURITY_IMPERSONATION_LEVEL
{
SecurityAnonymous,
SecurityIdentification,
SecurityImpersonation,
SecurityDelegation
}

public enum TOKEN_TYPE
{
TokenPrimary = 1,
TokenImpersonation
}

public const int GENERIC_ALL_ACCESS = 0x10000000;

[DllImport("", SetLastError = true,
CharSet = , CallingConvention = )]
public static extern bool CloseHandle(IntPtr handle);

[DllImport("", SetLastError = true,
CharSet = , CallingConvention = )]
public static extern bool CreateProcessAsUser(
IntPtr hToken,
string lpApplicationName,
string lpCommandLine,
ref SECURITY_ATTRIBUTES lpProcessAttributes,
ref SECURITY_ATTRIBUTES lpThreadAttributes,
bool bInheritHandle,
Int32 dwCreationFlags,
IntPtr lpEnvrionment,
string lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
ref PROCESS_INFORMATION lpProcessInformation);

[DllImport("", SetLastError = true)]
public static extern bool DuplicateTokenEx(
IntPtr hExistingToken,
Int32 dwDesiredAccess,
ref SECURITY_ATTRIBUTES lpThreadAttributes,
Int32 ImpersonationLevel,
Int32 dwTokenType,
ref IntPtr phNewToken);

[DllImport("", SetLastError=true)]
public static extern bool WTSQueryUserToken(
Int32 sessionId,
out IntPtr Token);

[DllImport("", SetLastError = true)]
static extern bool CreateEnvironmentBlock(
out IntPtr lpEnvironment,
IntPtr hToken,
bool bInherit);