elevate_ti/
session.rs

1//! High-level elevation status checking and process relaunch orchestration.
2
3use windows::core::{PCWSTR, w};
4
5use crate::{
6    error::ElevateError,
7    security::{ExecutionContext, InteractiveDesktop, Token, TokenCommand},
8    strategy::{ElevationStrategy, TrustedInstallerStrategy},
9};
10
11const TRUSTED_INSTALLER_SID: PCWSTR =
12    w!("S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464");
13
14/// The elevation status of the current running process instance.
15#[derive(Debug, Clone, Copy, PartialEq, Eq)]
16pub enum ElevationStatus {
17    /// The process is running with genuine `TrustedInstaller` privileges.
18    Elevated,
19    /// The process requires elevation to obtain `TrustedInstaller` privileges.
20    RequiresElevation,
21}
22
23/// Check whether the current process holds the `TrustedInstaller` SID in its group tokens.
24pub fn status() -> Result<ElevationStatus, ElevateError> {
25    let token = Token::current()?;
26    if token.has_sid(TRUSTED_INSTALLER_SID)? {
27        Ok(ElevationStatus::Elevated)
28    } else {
29        Ok(ElevationStatus::RequiresElevation)
30    }
31}
32
33/// Create a [`TokenCommand`] targeting the caller's standard interactive desktop (`WinSta0\Default`).
34pub fn elevated_command() -> Result<TokenCommand, ElevateError> {
35    elevated_command_on(InteractiveDesktop::Default)
36}
37
38/// Create a [`TokenCommand`] targeting a specific interactive desktop.
39///
40/// Supports standard desktops (`Default`, `Winlogon`, `Screensaver`) as well
41/// as custom window stations created for sandboxes or virtual displays.
42///
43/// # Examples
44///
45/// Launching onto the secure Winlogon desktop (visible at lock screen / UAC prompts):
46/// ```no_run
47/// use elevate_ti::{elevated_command_on, InteractiveDesktop};
48///
49/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
50/// elevated_command_on(InteractiveDesktop::Winlogon)?
51///     .exe("%SystemRoot%\\System32\\cmd.exe")
52///     .spawn()?;
53/// # Ok(())
54/// # }
55/// ```
56///
57/// Launching onto a custom sandbox window station and desktop:
58/// ```no_run
59/// use elevate_ti::{elevated_command_on, InteractiveDesktop};
60///
61/// # fn main() -> Result<(), Box<dyn std::error::Error>> {
62/// elevated_command_on(InteractiveDesktop::custom("MySandboxStation\\IsolatedDesktop"))?
63///     .exe("%SystemRoot%\\System32\\cmd.exe")
64///     .spawn()?;
65/// # Ok(())
66/// # }
67/// ```
68pub fn elevated_command_on(desktop: InteractiveDesktop) -> Result<TokenCommand, ElevateError> {
69    let strategy = TrustedInstallerStrategy::new(
70        std::time::Duration::from_secs(30),
71        ExecutionContext::Interactive(desktop.clone()),
72    );
73    let token = strategy.acquire_primary_token()?;
74    Ok(TokenCommand::new(token, Some(desktop)))
75}
76
77/// Create a [`TokenCommand`] configured strictly for headless Session 0 execution.
78///
79/// Has no desktop binding, making it mathematically impossible to trigger desktop DACL collisions.
80pub fn headless_command() -> Result<TokenCommand, ElevateError> {
81    let strategy = TrustedInstallerStrategy::new(
82        std::time::Duration::from_secs(30),
83        ExecutionContext::Headless,
84    );
85    let token = strategy.acquire_primary_token()?;
86    Ok(TokenCommand::new(token, None))
87}
88
89/// Restart the current executable under `TrustedInstaller` identity in the active user desktop.
90pub fn relaunch() -> Result<(), ElevateError> {
91    elevated_command()?.current_exe()?.spawn()
92}
elevate_ti/session.rs

elevate_ti/
session.rs
