查明应用程序是否需要管理员权限 [英] Find out whether an application needs administrator privileges

问题描述

Windows 7 使用自动机制来检测应用程序是否需要提升的管理员权限.或者应用程序本身有一个清单.

有没有办法以编程方式确定指定的应用程序是否需要提升的管理员权限?我不想启动它来发现它.

谢谢;).

解决方案

实际上只有一种方法可以告诉 Windows 程序需要提升，那就是通过清单文件.清单文件可以嵌入到程序集 (exe/dll) 中，也可以位于名为 .exe.manifest 的单独文件中.这确实是唯一的方法，也可能是您可以安全检查的唯一方法.正式.

Windows 还包含一个用于应用程序兼容性的巨大数据库.如果 Microsoft 测试了一个应用程序并发现它在操作系统升级时中断，他们有时会在数据库中创建一个条目来基本上破解该应用程序.有时他们会谎报当前的操作系统版本，有时他们会自动以管理员身份运行，有时他们会做很多其他事情.您可以使用应用程序兼容性工具包查看数据库.不知道官方有没有通过代码查询数据库的方式.这篇博文讨论了博主制作但显然从未发布的工具.>

最后一个自动提升机制是尝试确定该应用程序是否为安装程序的算法.根据 MSDN 检查这些属性:

<块引用>

• 文件名包括安装"、设置"、更新"等关键字.
• 以下版本控制资源字段中的关键字:供应商、公司名称、产品名称、文件描述、原始文件名、内部名称和导出名称.
• 嵌入在可执行文件中的并行清单中的关键字.
• 在可执行文件中链接的特定 StringTable 条目中的关键字.
• 可执行文件中链接的 RC 数据中的关键属性.
• 可执行文件中的目标字节序列.

关键字和字节序列来源于common从各种安装程序技术中观察到的特征.

最后，应用可以以普通用户身份运行，但生成需要提升权限的子进程.我不知道是否真的有任何方法可以真正检测到反编译应用程序本身的不足.

Windows 7 uses an automatic mechanism to detect whether an application needs elevated administrator privileges. Or the application itself has a manifest.

Is there a way to find out programmatically whether a specified application needs elevated administrator privileges or not? I don't want to start it to find it out.

Thank you ;).

解决方案

There's really just one way to tell Windows that a program needs to be elevated and that's through the manifest file. Manifest files can either be embedded within an assembly (exe/dll) or can live in a separate file named <YOUR_APP>.exe.manifest. That's really the only way and probably the only way that you can safely check. Officially.

Windows also contains a giant database that's used for application compatibility. If Microsoft has tested an app and found that it breaks when an OS upgrade happens they sometimes creates an entry in the database to essentially hack the app. Sometimes they lie about the current OS version, sometimes they automatically run as administrator, sometimes they do a bunch of other things. You can view the database using the Application Compatibility Toolkit. I don't know if there's an official way to query the database via code. This blog post talks about a tool that the blogger made but apparently never release.

The last automatic elevation mechanism is algorithm that tries to determine if that app is an installer. According to MSDN these attributes are checked:

• Filename includes keywords like "install," "setup," "update," etc.
• Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.
• Keywords in the side-by-side manifest embedded in the executable.
• Keywords in specific StringTable entries linked in the executable.
• Key attributes in the RC data linked in the executable.
• Targeted sequences of bytes within the executable.

The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies.

Lastly, an app can run as a normal user but spawn a child process that requires elevated privileges. I don't know if there's really any way to actually detect that short of decompiling the app itself.

这篇关于查明应用程序是否需要管理员权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！