Run as Trusted Installer context menu

[HarrySpoofer]

This a a context menu extension for MS-Windows which allows you to run any program as the "Trusted Installer" with more privileges than the Administrator or System.
You can use it to run Windows Explorer or `regedit.exe` ...or any other program.

INSTALLATION:
Run the attached install.bat file
... or copy the `RunAsTI.exe` to your `Windows\System32` directory and merge the `RunAsTI.reg` file into the Windows Registry.

BUILD:
Open the `RunAsTI.sln` file in Visual Studio 2019, right-click on the Solution 'RunAsTI' in the Solution Explorer and select "Build Solution".
A new `RunAsTI.exe` will be generated in the `x64\Release\` or `x64\Debug\` directory.

TO USE:
Right-click on any program in Windows Explorer and select "Run as Trusted Installer". You must be the Administrator in order to become the Trusted Installer.
You can see how it looks like on the following screenshot:
https://imgur.com/a/xOOO63t

Full source and the compiled .exe file are attached and at the link below:
https://gofile.io/d/QK20BZ

[wx69wx2023]

thanks for share, the link is down (https://file.io/X2yKt7tgv93x)

[sendersu]

@HarrySpoofer
thanks for nice piece of work!

If you don't mind I"d provide some small feedback:

1) I'd do case insensitive comparison inside the GetProcessIdByName() routine
-> if (pe.szExeFile == processName)

2) compiler is unhappy on setting signed int to unsided dword;
warning C4245: 'initializing': conversion from 'int' to 'DWORD', signed/unsigned mismatch

do you know if Windows has got some define for wrong pid values?
eg smth like INVALID_HANDLE_VALUE

3) be honest, did you leave an Easter Egg in one routine?

kudos!

[Kerlingen]

The code is pretty much identical to the https://github.com/lilkui/runasti repository.

The only difference is that somebody refactored everything to camel case (e.g. "get_process_id_by_name(const string process_name)" becomes "GetProcessIdByName(wstring processName)").

The code in the repository already has some of the bugs fixed!

[niculaita]

what about these https://mega.nz/file/S0h30aTa#ca0vJpwlP5qQZmyOcMmhiPrHEkZIpTdrlgmtPpZd4JQ ?

[sendersu]

I"m having "NT AUTHORITY\SYSTEM"
instead of "Trusted Installer"

https://prnt.sc/7fjfqwv-P5GQ

is that expected?

[HarrySpoofer]

Originally Posted by sendersu

@HarrySpoofer
thanks for nice piece of work!

If you don't mind I"d provide some small feedback:

1) I'd do case insensitive comparison inside the GetProcessIdByName() routine
-> if (pe.szExeFile == processName)

2) compiler is unhappy on setting signed int to unsided dword;
warning C4245: 'initializing': conversion from 'int' to 'DWORD', signed/unsigned mismatch

do you know if Windows has got some define for wrong pid values?
eg smth like INVALID_HANDLE_VALUE

3) be honest, did you leave an Easter Egg in one routine?

kudos!

Thank for the feedback.
I made the changes you suggested and updated the attachment and the link.

BTW: I did not put an Easter egg in it, I added new icons, though.

[HarrySpoofer]

That is correct.

to verify that you have the `Trusted Installer` privileges, execute this at the command line:

whoami /groups

...and look for a membership in the `NT SERVICE\TrustedInstaller` group:

On my system the output looks like this:

C:\Profiles\Admin>whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID                                                            Attributes
====================================== ================ ============================================================== ===============================================================
Mandatory Label\System Mandatory Level Label            S-1-16-16384
Everyone                               Well-known group S-1-1-0                                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545                                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                   Well-known group S-1-5-6                                                        Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                          Well-known group S-1-2-1                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11                                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15                                                       Mandatory group, Enabled by default, Enabled group
NT SERVICE\TrustedInstaller            Well-known group S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 Enabled by default, Enabled group, Group owner
LOCAL                                  Well-known group S-1-2-0                                                        Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Administrators                 Alias            S-1-5-32-544                                                   Mandatory group, Enabled by default, Enabled group

Originally Posted by sendersu

I"m having "NT AUTHORITY\SYSTEM"
instead of "Trusted Installer"

https://prnt.sc/7fjfqwv-P5GQ

is that expected?

[sendersu]

Originally Posted by HarrySpoofer

Thank for the feedback.
I made the changes you suggested and updated the attachment and the link.

BTW: I did not put an Easter egg in it, I added new icons, though.

I was under impression this line is it -

>> wctomb_s(&mbCharLen, &buff[0], 42, wc);

[sendersu]

one more question:
it is really require d to enable this priv lvl?

>EnablePrivilege(SE_DEBUG_NAME);

[sendersu]

one more feedback:

is it OK to delegate memory zero-ing to compiler?

eg instead of calling WinAPI ZeroMemory()

just do

STARTUPINFOW startupInfo = { 0 };

[HarrySpoofer]

Originally Posted by sendersu

I was under impression this line is it -
>> wctomb_s(&mbCharLen, &buff[0], 42, wc);

Well it is the answer to the ultimate question of life, the universe, and everything but I should have put MB_LEN_MAX in there.

Originally Posted by sendersu

one more feedback:
is it OK to delegate memory zero-ing to compiler?

Yes, it is a matter of habit

Originally Posted by sendersu

one more question:
it is really require d to enable this priv lvl?
>EnablePrivilege(SE_DEBUG_NAME);

Yes, this is the reason why you need to be an `Administrator` to become the `Trusted Installer`

[sendersu]

I"ve ran the PVS Tool against the tool,
I"d like to note -very well done!

some minor suggestions: https://prnt.sc/vQpQVeHUiyV0

eg:
DWORD GetProcessIdByName(wstring processName)
->
DWORD GetProcessIdByName(const wstring& processName)

and similar ones

2) there are some potential set of handle leaks (not closed)

3) I've commented out this enablement:
//EnablePrivilege(SE_DEBUG_NAME);
and the tool still works?!

4) imagine that some end user is having localized Windows OS, eg chinese or japanese or some arabic, etc
how about supporting these users as well?

IMHO in this case the routine
std::string GetLastErrorAsString()

need to be unicode (wide string) aware

[niculaita]

Originally Posted by sendersu

I"ve ran the PVS Tool against the tool,
I"d like to note -very well done!

some minor suggestions: https://prnt.sc/vQpQVeHUiyV0

eg:
DWORD GetProcessIdByName(wstring processName)
->
DWORD GetProcessIdByName(const wstring& processName)

and similar ones

2) there are some potential set of handle leaks (not closed)

3) I've commented out this enablement:
//EnablePrivilege(SE_DEBUG_NAME);
and the tool still works?!

4) imagine that some end user is having localized Windows OS, eg chinese or japanese or some arabic, etc
how about supporting these users as well?

IMHO in this case the routine
std::string GetLastErrorAsString()

need to be unicode (wide string) aware

please post upload your compilation cause first one does not work well on my pc with win 11 pro 23h2

[sendersu]

what is the issue you are observing?
I"ve tested the tool on both Win7 & Win11 (24H2), no issues seen so far so good.
https://ibb.co/w6MdnDt

my updates are included over here https://workupload.com/file/dyMPqZYgZqM

fixed handles leak,
introduced one macro that simplifies reading of the code (IMHO)

PS the only thing left that I thinking about - support of std::wstring for exceptions throwing, but it turned out std::exception does not like wstring, so not that easy