title: Do I need to adjust token privileges in order to successfully call CreateRemoteThread?
body: <p>I'm developing a debugging facility for my application to help me diagnose deadlocks. The application runs on my client's machines and so I expect a wide range of operating systems, security policies etc.</p>
  
  <p>The technique I am using is to implement a function in the target application which generates stack traces for all threads, together with other diagnostics information. This is then written to a memory mapped file. I am also creating a utility application that is used to trigger the creation of the diagnostics report, and then read it from the memory mapped file.</p>
  
  <p>Because the target application is expected to be dead, the utility program can't send it a message to trigger the diagnostics collection. Instead I am using <code>CreateRemoteThread</code> so that I can be sure to get a live thread to do the work.</p>
  
  <p>Note that this is different from DLL injection methods which typically use <code>LoadLibrary</code> as the thread proc for <code>CreateRemoteThread</code>. My thread proc is an entry point in the target application. So, I don't need to call <code>WriteProcessMemory</code>.</p>
  
  <p>I've implemented this and in my test environments it works well. According to the documentation of <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms682437.aspx" rel="nofollow"><code>CreateRemoteThread</code></a>, I need a process handle with the following access rights:</p>
  
  <blockquote>
    <p><code>PROCESS_CREATE_THREAD</code>, <code>PROCESS_QUERY_INFORMATION</code>, <code>PROCESS_VM_OPERATION</code>, <code>PROCESS_VM_WRITE</code>, and <code>PROCESS_VM_READ</code></p>
  </blockquote>
  
  <p>So, I passed those flags when calling <code>OpenProcess</code>.</p>
  
  <p>Now, at last, to my question: what privileges do I need my token to have in order for the call to <code>OpenProcess</code> to succeed?</p>
  
  <p>In my test environment (Windows 7, UAC enabled, admin user), I have encountered no problems with just a default token. I have seen various sample code that acquires the <code>SE_DEBUG_NAME</code> privilege before calling <code>OpenProcess</code>. My guess is that is needed for <code>WriteProcessMemory</code> when doing DLL injection and that I don't need that privilege. Are there scenarios where I would need to adjust my token's privileges?</p>
  
  <p>I know precisely nothing about Windows security so I would really appreciate wise words from anyone that does!</p>