in JetBrains.HabitatDetector/src/Impl/Windows/WindowsHelper.cs [102:144]
internal static unsafe ElevationData GetElevation(void* hProcess)
{
void* hToken;
if (Advapi32Dll.OpenProcessToken(hProcess, (uint)(TokenSpecificAccessRights.TOKEN_DUPLICATE | TokenSpecificAccessRights.TOKEN_QUERY), &hToken) == 0)
throw new Win32Exception();
try
{
TOKEN_ELEVATION te;
var teSize = (uint)sizeof(TOKEN_ELEVATION);
if (Advapi32Dll.GetTokenInformation(hToken, TOKEN_INFORMATION_CLASS.TokenElevation, &te, teSize, &teSize) == 0)
throw new Win32Exception();
TOKEN_ELEVATION_TYPE tet;
var tetSize = (uint)sizeof(TOKEN_ELEVATION_TYPE);
if (Advapi32Dll.GetTokenInformation(hToken, TOKEN_INFORMATION_CLASS.TokenElevationType, &tet, tetSize, &tetSize) == 0)
throw new Win32Exception();
void* hImpersonationToken;
if (Advapi32Dll.DuplicateToken(hToken, SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, &hImpersonationToken) == 0)
throw new Win32Exception();
try
{
return new(
IsBuildInGroupMember(hImpersonationToken, RID.DOMAIN_ALIAS_RID_ADMINS),
te.TokenIsElevated != 0,
tet switch
{
TOKEN_ELEVATION_TYPE.TokenElevationTypeDefault => JetWindowsTokenElevationType.Default,
TOKEN_ELEVATION_TYPE.TokenElevationTypeFull => JetWindowsTokenElevationType.Full,
TOKEN_ELEVATION_TYPE.TokenElevationTypeLimited => JetWindowsTokenElevationType.Limited,
_ => throw new ArgumentOutOfRangeException()
});
}
finally
{
Kernel32Dll.CloseHandle(hImpersonationToken);
}
}
finally
{
Kernel32Dll.CloseHandle(hToken);
}
}