Windows PE结构中判断进程是否需管理员权限的方法

Great question! Let's break this down clearly:

First off, neither the PIMAGE_DOS_HEADER nor PIMAGE_NT_HEADERS structures contain any direct field that tells you if a PE requires administrator privileges (the security shield icon you mentioned). That requirement is stored elsewhere in the PE file's resources, not in these core header structures.

Here's how to check without using Windows APIs, by manually parsing the PE structure: #

• Start with the PIMAGE_DOS_HEADER and use its e_lfanew field to jump to the PIMAGE_NT_HEADERS structure.
• From PIMAGE_NT_HEADERS->OptionalHeader.DataDirectory, access the entry at index IMAGE_DIRECTORY_ENTRY_RESOURCE (this is index 2) to get the relative virtual address (RVA) and size of the resource directory.
• Traverse the resource directory hierarchy to find the resource type RT_MANIFEST (which has a numeric value of 24). This is where the application manifest is embedded.
• Locate the raw data of this manifest resource, then parse its XML content. Look for the <requestedExecutionLevel> node:

  <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
  

  If this node exists and the level attribute is set to requireAdministrator, the PE will require administrator privileges to run, and will show the security shield icon.

A quick note: Some PE files might not have an embedded manifest. In those cases, Windows uses compatibility heuristics to determine privilege requirements, but only an explicit manifest with requireAdministrator will guarantee the security shield and mandatory admin prompt.

内容的提问来源于stack exchange，提问作者bob willis