OpenProcess仅在Visual Studio中正常执行，CMD运行失败问题求助

现象 #

• 代码在Visual Studio中编译运行时，可成功获取SysMain服务的PID并打开进程句柄，无任何报错
• 以管理员身份打开CMD运行编译后的程序时，能正常获取PID，但OpenProcess调用失败，输出[!] OpenProcess(): FAILED

原代码 #

int FindSysmainSvc()
{
    SC_HANDLE scm = OpenSCManager(nullptr, nullptr, SC_MANAGER_CONNECT);
    if (!scm) {
        std::cerr << "Failed to open service control manager: " << GetLastError() << std::endl;
        return -1;
    }

    SC_HANDLE service = OpenService(scm, L"SysMain", SERVICE_QUERY_STATUS);
    if (!service) {
        std::cerr << "Failed to open service: " << GetLastError() << std::endl;
        CloseServiceHandle(scm);
        return -1;
    }

    SERVICE_STATUS_PROCESS status;
    DWORD bytesNeeded;
    if (!QueryServiceStatusEx(service, SC_STATUS_PROCESS_INFO, reinterpret_cast<LPBYTE>(&status), sizeof(status), &bytesNeeded)) {
        std::cerr << "Failed to query service status: " << GetLastError() << std::endl;
        CloseServiceHandle(service);
        CloseServiceHandle(scm);
        return -1;
    }

    DWORD processId = status.dwProcessId;

    CloseServiceHandle(service);
    CloseServiceHandle(scm);

    return processId;
}

int main() {
    int pid = FindSysmainSvc();

    if (pid == -1) {
        std::cout << "[!] Failed to find pid\n";
        return -1;
    }

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
    if (hProcess == nullptr) {
        std::cout << "[!] OpenProcess(): FAILED";
        return -1;
    }

    CloseHandle(hProcess);
    return 0;
}

问题原因 #

1. 权限过度申请：PROCESS_ALL_ACCESS是最高级别的进程权限，即使是管理员账号，也无法对系统保护进程（比如SysMain对应的svchost.exe实例）获取该权限。Visual Studio调试时，进程继承了调试器的特权，因此能成功获取权限，但普通CMD下的管理员进程没有这种特权。
2. 缺少错误信息：原代码未打印OpenProcess失败对应的GetLastError()结果，无法直接定位具体权限缺失类型。

修复方案 #

1. 使用最小必要权限：根据实际需求替换PROCESS_ALL_ACCESS，比如仅需查询进程信息时，使用PROCESS_QUERY_INFORMATION | PROCESS_VM_READ。
2. 添加错误日志：打印OpenProcess失败的错误码，便于后续排查。
3. 可选：启用调试特权：如果确实需要更高权限，可以通过调整进程令牌启用调试特权，但这需要额外的代码实现。

修改后的代码示例 #

#include <windows.h>
#include <iostream>

int FindSysmainSvc()
{
    SC_HANDLE scm = OpenSCManager(nullptr, nullptr, SC_MANAGER_CONNECT);
    if (!scm) {
        std::cerr << "Failed to open service control manager: " << GetLastError() << std::endl;
        return -1;
    }

    SC_HANDLE service = OpenService(scm, L"SysMain", SERVICE_QUERY_STATUS);
    if (!service) {
        std::cerr << "Failed to open service: " << GetLastError() << std::endl;
        CloseServiceHandle(scm);
        return -1;
    }

    SERVICE_STATUS_PROCESS status;
    DWORD bytesNeeded;
    if (!QueryServiceStatusEx(service, SC_STATUS_PROCESS_INFO, reinterpret_cast<LPBYTE>(&status), sizeof(status), &bytesNeeded)) {
        std::cerr << "Failed to query service status: " << GetLastError() << std::endl;
        CloseServiceHandle(service);
        CloseServiceHandle(scm);
        return -1;
    }

    DWORD processId = status.dwProcessId;

    CloseServiceHandle(service);
    CloseServiceHandle(scm);

    return processId;
}

// 可选：启用调试特权
BOOL EnableDebugPrivilege()
{
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
        return FALSE;

    LUID luid;
    if (!LookupPrivilegeValue(nullptr, SE_DEBUG_NAME, &luid))
    {
        CloseHandle(hToken);
        return FALSE;
    }

    TOKEN_PRIVILEGES tp;
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    BOOL result = AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), nullptr, nullptr);
    CloseHandle(hToken);
    return result;
}

int main() {
    // 可选：启用调试特权，如果需要更高权限
    // EnableDebugPrivilege();

    int pid = FindSysmainSvc();

    if (pid == -1) {
        std::cout << "[!] Failed to find pid\n";
        return -1;
    }

    // 使用最小必要权限替换PROCESS_ALL_ACCESS
    DWORD desiredAccess = PROCESS_QUERY_INFORMATION | PROCESS_VM_READ;
    HANDLE hProcess = OpenProcess(desiredAccess, false, pid);
    if (hProcess == nullptr) {
        std::cout << "[!] OpenProcess(): FAILED, Error Code: " << GetLastError() << std::endl;
        return -1;
    }

    std::cout << "[+] Successfully opened process handle" << std::endl;
    CloseHandle(hProcess);
    return 0;
}

内容的提问来源于stack exchange，提问作者qxseb