阅读:863回复:0
如何在内核下获得操作系统当前登陆用户名
搜了下网页,有这个方法
BOOLEAN GetUserName(PSECURITY_SUBJECT_CONTEXT securitySubjectContext, PUNICODE_STRING userName) { PACCESS_TOKEN token; LUID luid; PSecurityUserData userInformation = NULL; NTSTATUS status; //初始化userName userName->Length = 0; userName->MaximumLength = 0; userName->Buffer = NULL; //取token token = SeQuerySubjectContextToken(securitySubjectContext); //根据token查询用户的LUID status = SeQueryAuthenticationIdToken(token, &luid); if (!NT_SUCCESS(status)) { KdPrint(("GetUserName(): SeQueryAuthenticationIdToken fail\n")); return FALSE; } //特殊情况,SYSTEM用户 if(luid.LowPart==SYSTEMACCOUNT_LOW && luid.HighPart==SYSTEMACCOUNT_HIGH) { userName->Length = 12; userName->MaximumLength = 12; userName->Buffer = ExAllocatePool(NonPagedPool, userName->MaximumLength); if (userName->Buffer==NULL) { KdPrint(("GetUserName(): ExAllocatePool fail\n")); return FALSE; } RtlCopyMemory(userName->Buffer, SYSTEMUSER, userName->MaximumLength); return TRUE; } //根据用户的luid取用户名 status = GetSecurityUserInfo(&luid, UNDERSTANDS_LONG_NAMES, &userInformation); if (!NT_SUCCESS(status)) { KdPrint(("GetUserName(): GetSecurityUserInfo fail\n")); return FALSE; } userName->Length = 0; userName->MaximumLength = userInformation->UserName.Length; userName->Buffer = ExAllocatePool(NonPagedPool, userName->MaximumLength); if (userName->Buffer==NULL) { KdPrint(("GetUserName(): ExAllocatePool fail\n")); return FALSE; } RtlCopyUnicodeString(userName, &userInformation->UserName); LsaFreeReturnBuffer(userInformation); return TRUE; } 试了下,死机!! :( xp sp2 |
|