title: Open process with debug privileges and read/write memory
body: <h1>Short version:</h1>
  
  <p>I'm trying to open a process handle with debug privileges and define a pointer which points to an object in the memory of the debuggee.</p>
  
  <h1>Long version</h1>
  
  <p>I'm a computer science university student in my final year of graduation and got tasked to build an application which should be used for educational purposes for the next generation of students.</p>
  
  <p>Why am I here asking for help, you might ask? Well, the target platform is Windows and I have unfortunately no knowledge of the WinAPI whatsoever... </p>
  
  <p>Okay, here is the basic requirement:</p>
  
  <ul>
  <li><strong>Programming language</strong>: C++</li>
  <li><strong>Platform</strong>: Windows (7 Professional)</li>
  <li><strong>Used IDE</strong>: Visual Studio 2012</li>
  <li>No additional libraries if they aren't essential to ease the development</li>
  </ul>
  
  <h3>What will the application be used for?</h3>
  
  <p>Using this application the students shall learn to handle addresses, in this case static ones: the debuggee process will have some static pointers, which lead to other pointers themself to form a multi-dimensional pointer.
  The students have to find these base addresses using some debugging techniques (which is not part of my work!) and try to find the values at the end of these pointers.</p>
  
  <p>My application will be used by the tutors to randomly change the values and/or structures in the debuggee process.</p>
  
  <p>Some search did yield the first answer: using <code>ReadProcessMemory</code> and <code>WriteProcessMemory</code> one can easily change values in the memory of another process without any need to get debug privileges.</p>
  
  <p>What my tutors want, however, is to have the ability to define pointers (let's say unsigned int) which should point into the memory space of the debuggee process, effectively holding the base addresses I wrote about earlier.
  They really want this and I couldn't even talk this out of them so I'm stuck to do this at the end...</p>
  
  <h3>And what exactly should work?</h3>
  
  <p>Well, I'd have accomplished my task if the following (pseudo) code works:</p>
  
  <pre><code>grantThisProcessDebugPrivileges();
  openAnotherProcessWhileItsRunning("targetProcess.exe");
  
  unsigned int * targetValue = (unsigned int*) 0xDE123F00;
  // or even
  myCustomClass * targetClass = (myCustomClass*) 0xDE123F00;
  </code></pre>
  
  <p>where the address 0xDE123F00 lies in the memory space of targetProcess.exe.</p>
  
  <p>I know this is possible, else there wouldn't be debuggers which could show this information.</p>
  
  <h3>What I did so far (or tried...)</h3>
  
  <p>Okay, the thing is: I'm really confused whether I have to activate debug privileges for my application <strong>prior</strong> opening the target process, doing it <strong>after</strong> opening or rather giving the target process these privileges.</p>
  
  <p>So I found an example in MSDN and tried to implement it:</p>
  
  <pre><code>    BOOL SetPrivilege(
      HANDLE hToken,          // token handle
      LPCTSTR Privilege,      // Privilege to enable/disable
      BOOL bEnablePrivilege   // TRUE to enable.  FALSE to disable
      )
  {
      TOKEN_PRIVILEGES tp;
      LUID luid;
      TOKEN_PRIVILEGES tpPrevious;
      DWORD cbPrevious=sizeof(TOKEN_PRIVILEGES);
  
      if(!LookupPrivilegeValue( NULL, Privilege, &amp;luid )) return FALSE;
  
      // 
      // first pass.  get current privilege setting
      // 
      tp.PrivilegeCount           = 1;
      tp.Privileges[0].Luid       = luid;
      tp.Privileges[0].Attributes = 0;
  
      AdjustTokenPrivileges(
              hToken,
              FALSE,
              &amp;tp,
              sizeof(TOKEN_PRIVILEGES),
              &amp;tpPrevious,
              &amp;cbPrevious
              );
  
      if (GetLastError() != ERROR_SUCCESS) return FALSE;
  
      // 
      // second pass.  set privilege based on previous setting
      // 
      tpPrevious.PrivilegeCount       = 1;
      tpPrevious.Privileges[0].Luid   = luid;
  
      if(bEnablePrivilege) {
          tpPrevious.Privileges[0].Attributes |= (SE_PRIVILEGE_ENABLED);
      }
      else {
          tpPrevious.Privileges[0].Attributes ^= (SE_PRIVILEGE_ENABLED &amp;
              tpPrevious.Privileges[0].Attributes);
      }
  
      AdjustTokenPrivileges(
              hToken,
              FALSE,
              &amp;tpPrevious,
              cbPrevious,
              NULL,
              NULL
              );
  
      if (GetLastError() != ERROR_SUCCESS) return FALSE;
  
      return TRUE;
  };
  </code></pre>
  
  <p>And in my main:</p>
  
  <pre><code>HANDLE mainToken;
  
  // I really don't know what this block of code does :&lt;
  if(!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &amp;mainToken))
  {
      if (GetLastError() == ERROR_NO_TOKEN)
      {
          if (!ImpersonateSelf(SecurityImpersonation))
          return 1;
  
          if(!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &amp;mainToken)){
              cout &lt;&lt; GetLastError();
          return 1;
          }
       }
      else
          return 1;
  }
  
  if (!SetPrivilege(mainToken, SE_DEBUG_NAME, true))
  {
      CloseHandle(mainToken);
      cout &lt;&lt; "Couldn't set DEBUG MODE: " &lt;&lt; GetLastError() &lt;&lt; endl;
      return 1;
  };
  
  unsigned int processID = getPID("targetProcess.exe");
  HANDLE hproc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
  
  if (hproc == NULL)
  {
      cout &lt;&lt; "Couldn't open the process" &lt;&lt; endl;
      return 1;
  };
  
      unsigned int * theValue = (unsigned int*) 0xDE123F;
  </code></pre>
  
  <p>Okay, this code runs without any errors, SetPrivilege returns TRUE so I guess it really did set <code>SE_DEBUG_NAME</code>, which I think is the flag I need to set.</p>
  
  <p>But after - for example - outputting the dereferenced value of <code>theValue</code>, the application crashes with an access violation message, which shows that my approach didn't work. I did especially pay attention to start the VisualStudio Debugger with admin rights (SetPrivilege failed otherwise).</p>
  
  <p>I am really clueless here, the fact that I don't know whether setting <code>SE_DEBUG_NAME</code> is the right approach adds to my overall confusion.</p>
  
  <p>I hope you can help me out :)
  My hands are tied concerning the specific requests of the application , if you have ideas to achieve my goal using an entire dfferent approach, you're free to enlight me, but I won't be able to present it to my superiors so it will only add to my knowledge :D</p>