Cheat Engine

[Dark Byte]

Just asking if someone already dealt with this.
I have a process that has been launched by a user with limited rights (e.g. Deny on all disk access)
How can I inject a thread with the same privileges as the injector? Or at least file access to one particular file

Thread creation and api calls work fine , just file access is mostly access denied

Some ideas,
lpThreadAttributes in createRemoteThread
ImpersonateLoggedOnUser
SetThreadToken
Other acl crap

So yeah, just wondering if someone has already done this

Also, the process can not be restarted

edit2: I know I can just force load the file I wish into the target process, but i'm trying to do it in a 'legit' way this time

[atom0s]

Perhaps call RtlAdjustPrivilege and see if you can modify the privileges of your thread.
Not sure if the system has any security checks in place to prevent a limited user from doing this though, never had to launch anything like this.

An idea to bypass ACL would be to use RtlAdjustPrivilege and try using the SeTakeOwnershipPrivilege option as the first param.
After that, using RtlAdjustPrivilege with SeBackupPrivilege should let you access files.

[Dark Byte]

Ok, some more checking. This process is running at Untrusted Mandatory Level
Perhaps I can change that from a admin level