Access Tokens

Introduction

Each process has a security context associated with it, embodied by an Access Token. This Access Token encapsulates information about the process's security privileges, including the user account under which the process operates and the access rights granted to the process.

In short, an access token, is a security context under which a process and it's threads a run under. In respect the windows API, depending on which function you use typically determines what type of token you are using.

CreateProcess: This function is used to create a process in user mode. This process runs under the security context of the executing user.

EPROCESS: Once CreateProcess is called, it is passed to EPROCESS which is run in kernel mode. This structure holds information to manage the running process.

KPROCESS: Within EPROCESS resides another struct called KPROCESS. It holds information for the lower layer kernel. Thread scheduling stuff.

OpenProcess()

If you've ever used OpenProcess before you've probably noticed the dwDesiredAccess flag. This is an access right that is checked against the security descriptor of the running process. If the caller has SeDebugPrivilege enabled, the requested access is granted. Regardless of the context of the security descriptor.

OpenProcessToken()