JOBOBJECT_END_OF_JOB_TIME_INFORMATION结构体

  1. typedef struct _JOBOBJECT_END_OF_JOB_TIME_INFORMATION {
  2. DWORD EndOfJobTimeAction;
  3. } JOBOBJECT_END_OF_JOB_TIME_INFORMATION, PJOBOBJECT_END_OF_JOB_TIME_INFORMATION;
  • JOB_OBJECT_TERMINATE_AT_END_OF_JOB:

如果这个值被赋予EndOfJobTimeAction，那么当Job的用户时间耗尽的时候，Job中的进程自动终止。

  • JOB_OBJECT_POST_AT_END_OF_JOB：

如果这个值被赋予EndOfJobTimeAction，那么当Job的用户时间耗尽的时候，Job中的作业有可能会继续运行。如果这个作业没有和小端口做联系的话，那么作业中的进程依然终止。

JOBOBJECT_SECURITY_LIMIT_INFORMATION

  1. typedef struct _JOBOBJECT_SECURITY_LIMIT_INFORMATION {
  2. DWORD             SecurityLimitFlags;//表示结构体中，其他几个成员变量中，那个成员变量起作用。
  3. HANDLE            JobToken;
  4. PTOKEN_GROUPS     SidsToDisable;
  5. PTOKEN_PRIVILEGES PrivilegesToDelete;
  6. PTOKEN_GROUPS     RestrictedSids;
  7. } JOBOBJECT_SECURITY_LIMIT_INFORMATION, *PJOBOBJECT_SECURITY_LIMIT_INFORMATION;
  • SecurityLimitFlags: JOB_OBJECT_SECURITY_FILTER_TOKENS

    表示SidsToDisable、PrivilegesToDelete、RestrictedSids三个变量中，至少有一个不是NULL JOB_OBJECT_SECURITY_NO_ADMIN 作业中的进程，不能使用管理员令牌

    JOB_OBJECT_SECURITY_ONLY_TOKEN 强制作业中的进程，使用结构体中JobToken参数给定的令牌。

    JOB_OBJECT_SECURITY_RESTRICTED_TOKEN 作业中的进程使用的令牌，必须有CreateRestrictedToken函数创建，否则就不行！

windows中的权限

  • SID 就相当于身份证号

  • token 令牌，令牌上面，有你的身份证号，当然也有可能有其他身份证号，还有，你能干那些事。特权。

  • Privilege 特权。

  • SecurityDescriptor 安全描述符？

job通知的接收

  1. #include<Windows.h>
  2. #include<tchar.h>
  4. BOOL WatchJob(HANDLE hJob, LPTHREAD_START_ROUTINE Proc);
  5. DWORD WINAPI ThreadProc(LPVOID lParam);
  6. /*
  8. int _tmain()
  9. {
  10.     HANDLE hJob = CreateJobObject(NULL, L"ydm");
  12.     STARTUPINFO si;
  13.     PROCESS_INFORMATION pi;
  15.     ZeroMemory(&si, sizeof(si));
  16.     si.cb = sizeof(si);
  17.     ZeroMemory(&pi, sizeof(pi));
  19.     CreateProcess(L"C:\\Users\\Administrator\\Desktop\\TSTCON32.EXE", NULL, NULL,
  20.         NULL, FALSE, 0, NULL, NULL, &si, &pi);
  22.     BOOL re=AssignProcessToJobObject(hJob, pi.hProcess);
  24.     //........
  26.     //设置了一些限制。
  28.     //我现在要查看我的作业中施加了那些限制？
  30.     JOBOBJECT_EXTENDED_LIMIT_INFORMATION info = { 0 };
  32.     re=QueryInformationJobObject(hJob, JobObjectExtendedLimitInformation, &info,sizeof(info),NULL);
  34.     return 0;
  35. }
  37. int _tmain()
  38. {
  39.     HANDLE hJob = CreateJobObject(NULL, L"ydm");
  42.     STARTUPINFO si;
  43.     PROCESS_INFORMATION pi;
  45.     ZeroMemory(&si, sizeof(si));
  46.     si.cb = sizeof(si);
  47.     ZeroMemory(&pi, sizeof(pi));
  49.     CreateProcess(L"C:\\Users\\Administrator\\Desktop\\TSTCON32.EXE", NULL, NULL,
  50.         NULL, FALSE, 0, NULL, NULL, &si, &pi);
  52.     BOOL re = AssignProcessToJobObject(hJob, pi.hProcess);
  54.     //........
  56.     //设置了一些限制。
  60.     //我现在要查看我的作业中施加了那些限制？
  62.     JOBOBJECT_EXTENDED_LIMIT_INFORMATION info = { 0 };
  65.     re = QueryInformationJobObject(hJob, JobObjectExtendedLimitInformation, &info, sizeof(info), NULL);
  69.     return 0;
  70. }

完成端口：监听某个可以进行Overlapped操作的内核对象上的事件。
我们可以监视到的作业中的事件：

JOB_OBJECT_MSG_ABNORMAL_EXIT_PROCESS Indicates that a process associated with the job exited with an exit code that indicates an abnormal exit (see the list following this table).The value of lpOverlapped is the identifier of the exiting process.

JOB_OBJECT_MSG_ACTIVE_PROCESS_LIMIT Indicates that the active process limit has been exceeded. The value of lpOverlapped is NULL.

JOB_OBJECT_MSG_ACTIVE_PROCESS_ZERO Indicates that the active process count has been decremented to 0. For example, if the job currently has two active processes, the system sends this message after they both terminate. The value of lpOverlapped is NULL.

JOB_OBJECT_MSG_END_OF_JOB_TIME Indicates that the JOB_OBJECT_POST_AT_END_OF_JOB option is in effect and the end-of-job time limit has been reached. Upon posting this message, the time limit is canceled and the job’s processes can continue to run. The value of lpOverlapped is NULL.

JOB_OBJECT_MSG_END_OF_PROCESS_TIME Indicates that a process has exceeded a per-process time limit. The system sends this message after the process termination has been requested. The value of lpOverlapped is the identifier of the process that exceeded its limit.

JOB_OBJECT_MSG_EXIT_PROCESS Indicates that a process associated with the job has exited. The value of lpOverlapped is the identifier of the exiting process.

JOB_OBJECT_MSG_JOB_MEMORY_LIMIT Indicates that a process associated with the job caused the job to exceed the job-wide memory limit (if one is in effect). The value of lpOverlapped specifies the identifier of the process that has attempted to exceed the limit. The system does not send this message if the process has not yet reported its process identifier.

JOB_OBJECT_MSG_NEW_PROCESS Indicates that a process has been added to the job. Processes added to a job at the time a completion port is associated are also reported. The value of lpOverlapped is the identifier of the process added to the job.

JOB_OBJECT_MSG_PROCESS_MEMORY_LIMIT Indicates that a process associated with the job has exceeded its memory limit (if one is in effect). The value of lpOverlapped is the identifier of the process that has exceeded its limit. The system does not send this message if the process has not yet reported its process identifier.

JOBOBJECT_EXTENDED_LIMIT_INFORMATION

  1. typedef struct _JOBOBJECT_EXTENDED_LIMIT_INFORMATION {
  2. JOBOBJECT_BASIC_LIMIT_INFORMATION BasicLimitInformation;
  3. IO_COUNTERS                       IoInfo;
  4. SIZE_T                            ProcessMemoryLimit;
  5. SIZE_T                            JobMemoryLimit;
  6. SIZE_T                            PeakProcessMemoryUsed;
  7. SIZE_T                            PeakJobMemoryUsed;
  8. } JOBOBJECT_EXTENDED_LIMIT_INFORMATION, *PJOBOBJECT_EXTENDED_LIMIT_INFORMATION;

这个比较简单，大家看一下都明白了！

LimitFlags这个变量来说明，我们要设置哪一个变量的值。

JOBOBJECT_BASIC_UI_RESTRICTIONS

  1. typedef struct _JOBOBJECT_BASIC_UI_RESTRICTIONS {
  2. DWORD UIRestrictionsClass;
  3. } JOBOBJECT_BASIC_UI_RESTRICTIONS, *PJOBOBJECT_BASIC_UI_RESTRICTIONS;

这个变量赋予不同的值，会产生不同的限制。
用户界面的限制类。该成员可以是以下值中的一个或多个

参数 解释 中文解释
JOB_OBJECT_UILIMIT_DESKTOP


0x00000040 | Prevents processes associated with the job from creating desktops and switching desktops using the CreateDesktop and SwitchDesktop functions. | 防止与作业关联的进程使用 CreateDesktop 和 SwitchDesktop 函数创建桌面和切换桌面。 | | JOB_OBJECT_UILIMIT_DISPLAYSETTINGS
0x00000010 | Prevents processes associated with the job from calling the ChangeDisplaySettings function. | 防止与作业关联的进程调用 ChangeDisplaySettings 函数。 | | JOB_OBJECT_UILIMIT_EXITWINDOWS
0x00000080 | Prevents processes associated with the job from calling the ExitWindows or ExitWindowsEx function. | 防止与作业关联的进程调用 ExitWindows 或 ExitWindowsEx 函数。 | | JOB_OBJECT_UILIMIT_GLOBALATOMS
0x00000020 | Prevents processes associated with the job from accessing global atoms. When this flag is used, each job has its own atom table. | 防止与作业关联的进程访问全局原子。使用此标志时，每个作业都有自己的原子表。 | | JOB_OBJECT_UILIMIT_HANDLES
0x00000001 | Prevents processes associated with the job from using USER handles owned by processes not associated with the same job. | 防止与作业关联的进程使用不与同一作业关联的进程拥有的 USER 句柄。 | | JOB_OBJECT_UILIMIT_READCLIPBOARD
0x00000002 | Prevents processes associated with the job from reading data from the clipboard. | 防止与作业关联的进程从剪贴板读取数据。 | | JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS
0x00000008 | Prevents processes associated with the job from changing system parameters by using the SystemParametersInfo function. | 使用 SystemParametersInfo 函数防止与作业关联的进程更改系统参数。 | | JOB_OBJECT_UILIMIT_WRITECLIPBOARD
0x00000004 | Prevents processes associated with the job from writing data to the clipboard. | 防止与作业关联的进程将数据写入剪贴板。 |

创建一个桌面

  1. int _tmain()
  2. {
  3.     HANDLE hJob = CreateJobObject(NULL, L"ydm");
  5.     JOBOBJECT_BASIC_UI_RESTRICTIONS info = { 0 };
  6.     info.UIRestrictionsClass = JOB_OBJECT_UILIMIT_DESKTOP;
  8.     AssignProcessToJobObject(hJob, GetCurrentProcess());
  9.     SetInformationJobObject(hJob, JobObjectBasicUIRestrictions, &info, sizeof(info));
  12.     HDESK hDesk = CreateDesktop(L"hello", NULL, NULL, 0, GENERIC_ALL, NULL);
  14.     HDESK hDesk_old = GetThreadDesktop(GetCurrentThreadId());
  16.     SwitchDesktop(hDesk);
  17.     SetThreadDesktop(hDesk);
  19.     MessageBox(NULL, L"abc", L"abc", 0);
  21.     SwitchDesktop(hDesk_old);
  23.     CloseDesktop(hDesk);
  25.     _gettchar();
  26.     return 0;
  27. }

遍历系统句柄，并施加限制条件

代码中施加限制条件后，就不能遍历系统句柄，去掉施加条件就可以变量系统句柄
SetInformationJobObject(hJob, JobObjectBasicUIRestrictions, &info, sizeof(info));

  1. BOOL CALLBACK EnumWindowsProc(
  2.     __in  HWND hwnd,
  3.     __in  LPARAM lParam
  4.     )
  5. {
  6.     _tprintf(L"%d\n", hwnd);
  7.     return TRUE;
  9. }
  14. int _tmain()
  15. {
  16.     HANDLE hJob = CreateJobObject(NULL, L"ydm");
  18.     JOBOBJECT_BASIC_UI_RESTRICTIONS info = { 0 };
  19.     info.UIRestrictionsClass = JOB_OBJECT_UILIMIT_HANDLES;
  21.     AssignProcessToJobObject(hJob, GetCurrentProcess());
  22.     //施加限制条件后，就不能遍历系统句柄，去掉施加条件就可以变量系统句柄
  23.     SetInformationJobObject(hJob, JobObjectBasicUIRestrictions, &info, sizeof(info));
  25.     EnumWindows(EnumWindowsProc, 10);
  27.     _gettchar();
  28.     return 0;
  29. }