Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
On the MSDN page about Process.EnterDebugMode it says:
Some operating system processes run in a special mode. Attempting to
read properties of or attach to these processes is not possible unless
you have called EnterDebugMode on the component.
What is the special mode that is referred to here?
The “special mode” is simply adding SeDebugPrivilege. As Raymond Chen points out, If you grant somebody SeDebugPrivilege, you gave away the farm.
A user with SeDebugPrivilege can connect to any process and debug it. When you debug a process you can inject code into it. So from a security point of view, the user is basically an administrator.