.NET MAUI Windows端FilePicker管理员模式失效及进程启动问题

一、FilePicker.PickAsync在管理员调试模式下崩溃的原因 #

这是Windows**用户界面特权隔离（UIPI）**机制导致的：

• 以管理员权限运行的应用处于高权限安全上下文，而系统的文件选择对话框由普通权限的explorer.exe托管
• UIPI严格禁止高权限进程直接调用低权限进程提供的UI组件，这种跨权限交互会被系统直接终止进程，因此没有崩溃提示、断点也无法触发（终止操作来自系统内核，而非应用内部异常）

临时缓解方案：

• 将文件选择逻辑拆分为独立的普通权限辅助进程，通过IPC（如命名管道、Socket）与管理员权限的主进程通信
• 避免在管理员权限上下文直接调用系统UI对话框类API

二、无硬编码密码启动管理员进程并获取输出的实现 #

由于UseShellExecute=true和Verb="runas"无法满足输出捕获需求，可通过Windows原生API实现基于令牌的进程启动，无需硬编码密码，核心思路是借助系统UAC提示获取管理员令牌，再用该令牌启动进程并重定向输出：

实现步骤与代码示例 #

1. 声明所需的P/Invoke函数与结构体：

using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Runtime.InteropServices;

public static class ElevatedProcessHelper
{
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    private static extern bool CreateProcessWithTokenW(IntPtr hToken, uint dwLogonFlags, string lpApplicationName, string lpCommandLine, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);

    [DllImport("user32.dll")]
    private static extern bool GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, IntPtr lpTokenAttributes, SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, TOKEN_TYPE TokenType, out IntPtr phNewToken);

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CloseHandle(IntPtr hObject);

    [DllImport("user32.dll")]
    private static extern IntPtr GetShellWindow();

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, bool bInheritHandle, uint dwProcessId);

    private const uint TOKEN_QUERY = 0x0008;
    private const uint TOKEN_DUPLICATE = 0x0002;
    private const uint TOKEN_ASSIGN_PRIMARY = 0x0001;
    private const uint CREATE_NEW_CONSOLE = 0x00000010;
    private const uint LOGON_WITH_PROFILE = 0x00000001;

    public enum SECURITY_IMPERSONATION_LEVEL
    {
        SecurityAnonymous,
        SecurityIdentification,
        SecurityImpersonation,
        SecurityDelegation
    }

    public enum TOKEN_TYPE
    {
        TokenPrimary = 1,
        TokenImpersonation
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct STARTUPINFO
    {
        public int cb;
        public string lpReserved;
        public string lpDesktop;
        public string lpTitle;
        public int dwX;
        public int dwY;
        public int dwXSize;
        public int dwYSize;
        public int dwXCountChars;
        public int dwYCountChars;
        public int dwFillAttribute;
        public int dwFlags;
        public short wShowWindow;
        public short cbReserved2;
        public IntPtr lpReserved2;
        public IntPtr hStdInput;
        public IntPtr hStdOutput;
        public IntPtr hStdError;
    }

    [StructLayout(LayoutKind.Sequential)]
    private struct PROCESS_INFORMATION
    {
        public IntPtr hProcess;
        public IntPtr hThread;
        public uint dwProcessId;
        public uint dwThreadId;
    }

    [Flags]
    private enum ProcessAccessFlags : uint
    {
        QueryInformation = 0x0400,
        VmRead = 0x0010
    }

2. 实现启动管理员进程并支持输出重定向的方法：

public static Process StartElevatedProcessWithOutputRedirection(string executablePath, string arguments, out IntPtr stdOutRead, out IntPtr stdOutWrite)
    {
        // 创建匿名管道用于输出重定向
        CreatePipe(out stdOutRead, out stdOutWrite, IntPtr.Zero, 0);
        SetHandleInformation(stdOutRead, HANDLE_FLAGS.INHERIT, 0);

        // 获取Explorer进程的令牌（普通权限上下文，可通过UAC提升）
        IntPtr explorerHandle = GetShellWindow();
        GetWindowThreadProcessId(explorerHandle, out uint explorerProcessId);
        IntPtr explorerProcess = OpenProcess(ProcessAccessFlags.QueryInformation | ProcessAccessFlags.VmRead, false, explorerProcessId);
        OpenProcessToken(explorerProcess, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, out IntPtr token);

        // 复制并提升令牌为管理员级主令牌
        DuplicateTokenEx(token, TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_QUERY, IntPtr.Zero, SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, TOKEN_TYPE.TokenPrimary, out IntPtr elevatedToken);

        STARTUPINFO si = new STARTUPINFO();
        si.cb = Marshal.SizeOf(si);
        si.hStdOutput = stdOutWrite;
        si.hStdError = stdOutWrite;
        si.dwFlags = 0x00000100; // STARTF_USESTDHANDLES

        PROCESS_INFORMATION pi = new PROCESS_INFORMATION();

        bool success = CreateProcessWithTokenW(elevatedToken, LOGON_WITH_PROFILE, executablePath, arguments, CREATE_NEW_CONSOLE, IntPtr.Zero, null, ref si, out pi);

        // 释放资源
        CloseHandle(token);
        CloseHandle(elevatedToken);
        CloseHandle(explorerProcess);
        CloseHandle(pi.hThread);
        CloseHandle(stdOutWrite);

        if (!success)
        {
            CloseHandle(stdOutRead);
            throw new Win32Exception(Marshal.GetLastWin32Error());
        }

        return Process.GetProcessById((int)pi.dwProcessId);
    }

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool CreatePipe(out IntPtr hReadPipe, out IntPtr hWritePipe, IntPtr lpPipeAttributes, uint nSize);

    [DllImport("kernel32.dll", SetLastError = true)]
    private static extern bool SetHandleInformation(IntPtr hObject, HANDLE_FLAGS dwMask, HANDLE_FLAGS dwFlags);

    [Flags]
    private enum HANDLE_FLAGS : uint
    {
        INHERIT = 0x00000001
    }
}

3. 使用示例：

// 启动管理员进程并读取输出
IntPtr stdOutRead, stdOutWrite;
Process elevatedProcess = ElevatedProcessHelper.StartElevatedProcessWithOutputRedirection("cmd.exe", "/c dir C:\\Windows", out stdOutRead, out stdOutWrite);

// 从管道读取输出
using (var reader = new System.IO.StreamReader(new System.IO.FileStream(stdOutRead, System.IO.FileAccess.Read, 4096, false)))
{
    string output = reader.ReadToEnd();
    Console.WriteLine(output);
}

elevatedProcess.WaitForExit();
elevatedProcess.Close();

原理说明 #

• 通过获取系统explorer.exe的令牌（运行在当前用户的普通权限上下文），复制并提升为管理员级主令牌
• 借助CreateProcessWithTokenW函数使用该令牌启动目标进程，触发系统UAC提示（无需硬编码密码）
• 通过匿名管道重定向进程的标准输出/错误，实现输出捕获

内容的提问来源于stack exchange，提问作者Shantanu Shinde