Can't disable SeDebugPrivilege of my own process - c++

Question

I am trying to disable my own process's SE_DEBUG_NAME (SeDebugPrivilege) permissions to learn about adjusting tokens in processes.
Like I am doing with Process Hacker. I have an option to change this permissions to remote processes.
But for the beginning I want to be able to change my own process's token permissions.
I am running Visual Studio with Run As administrator and therefore my process has High integrity and SeDebugPrivilege is enabled.
I read here and took the code from here and made a little change, instead of enabling I changed it to disabling:
#include "stdafx.h"
#include <Windows.h>
#include <sddl.h>
#include <cstdio>
#include <tlhelp32.h>
#include <iostream>
#include <fstream>
using namespace std;
//#pragma comment(lib, "cmcfg32.lib")
BOOL SetPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if (!LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid)) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u\n", GetLastError());
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if (!AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,
(PDWORD)NULL))
{
printf("AdjustTokenPrivileges error: %u\n", GetLastError());
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printf("The token does not have the specified privilege. \n");
return FALSE;
}
return TRUE;
}
int main()
{
HANDLE hToken;
if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken))
{
if (GetLastError() == ERROR_NO_TOKEN)
{
if (!ImpersonateSelf(SecurityImpersonation))
return RTN_ERROR;
if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken)) {
//DisplayError("OpenThreadToken");
return RTN_ERROR;
}
}
else
return RTN_ERROR;
}
// disable SeDebugPrivilege
if (!SetPrivilege(hToken, SE_DEBUG_NAME, FALSE))
{
// DisplayError("SetPrivilege");
// close token handle
CloseHandle(hToken);
// indicate failure
return RTN_ERROR;
}
return 0;
}
I am running it on debug mode but I don't see any changes on the process's token. The SeDebugPrivilege is still enabled.
I don't receive any errors.
Any idea what can be the problem ?

Answer 1

I understood what was my problem.
I needed to use OpenProcessToken.
So I only needed to change the beginning of the main:
HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, GetCurrentProcessId());
if (hProc == NULL)
{
// error
}
HANDLE hToken;
if (!OpenProcessToken(hProc, TOKEN_ADJUST_PRIVILEGES, &hToken))
{
// error
}