NTSYSCALLAPI NTSTATUS NTAPI ZwAdjustPrivilegesToken	(	
    _In_ HANDLE 	TokenHandle,
	_In_ BOOLEAN 	DisableAllPrivileges,
	_In_opt_ PTOKEN_PRIVILEGES 	NewState,
	_In_ ULONG 	BufferLength,
	_Out_writes_bytes_to_opt_(BufferLength,*ReturnLength) PTOKEN_PRIVILEGES PreviousState,
	_Out_ _When_(PreviousState==NULL, _Out_opt_) PULONG 	ReturnLength 
)

BOOL SetTokenInformation(
  [in] HANDLE                  TokenHandle,			//token句柄
  [in] TOKEN_INFORMATION_CLASS TokenInformationClass,	//指定下个参数的结构
  [in] LPVOID                  TokenInformation,		//指向包含访问令牌中设置的信息和缓冲区指针
  [in] DWORD                   TokenInformationLength	//指定TokenInformation指向缓冲区的长度
);

typedef struct _SID {
  BYTE                     Revision;			//修订版本，必定是1
  BYTE                     SubAuthorityCount;	//官网上的介绍是指定SubAuthority 数组中的元素数，最大值为15，但是实测15以内有些数字可以有些数字不行
  SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
#if ...
  DWORD                    *SubAuthority[];		//标识符机构值
#else
  DWORD                    SubAuthority[ANYSIZE_ARRAY];		//子机构值
#endif
} SID, *PISID;

SID integrityLevelSid = {};
integrityLevelSid.Revision = SID_REVISION;
integrityLevelSid.SubAuthorityCount = 1;
integrityLevelSid.IdentifierAuthority.Value[5] = 16;
integrityLevelSid.SubAuthority[0] = integrityLevel;

typedef struct _TOKEN_MANDATORY_LABEL {
  SID_AND_ATTRIBUTES Label;
} TOKEN_MANDATORY_LABEL, *PTOKEN_MANDATORY_LABEL;

typedef struct _SID_AND_ATTRIBUTES {
#if ...
  PISID Sid;			//指向SID的指针
#else
  PSID  Sid;
#endif
  DWORD Attributes;		//指向SID的属性
} SID_AND_ATTRIBUTES, *PSID_AND_ATTRIBUTES;

#include<Windows.h>
#include<stdio.h>
#include<tlhelp32.h>

typedef  NTSTATUS(WINAPI* typedef_ZwAdjustPrivilegesToken)(
	HANDLE 	TokenHandle,
	BOOLEAN 	DisableAllPrivileges,
	PTOKEN_PRIVILEGES 	NewState,
	ULONG 	BufferLength,
	_Out_writes_bytes_to_opt_(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
	_Out_ _When_(PreviousState == NULL, _Out_opt_) PULONG 	ReturnLength
	);


int FindProcessId(LPCTSTR ProcessName) {
	PROCESSENTRY32 PE = { 0 };
	PE.dwSize = sizeof(PE);
	HANDLE ProcessIDALL = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (Process32First(ProcessIDALL, &PE)) {
		do {
			if (lstrcmpi(ProcessName, PE.szExeFile) == 0) {
				return PE.th32ProcessID;
			}
		} while (Process32Next(ProcessIDALL, &PE));
	}

	return 0;
}

BOOL DisablePrivilege(HANDLE token) {
	typedef_ZwAdjustPrivilegesToken ZwAdjustPrivilegesToken = (typedef_ZwAdjustPrivilegesToken)GetProcAddress(LoadLibraryA("ntdll.dll"), "ZwAdjustPrivilegesToken");
	if (ZwAdjustPrivilegesToken == NULL) {
		printf("Can not found ZwAdjustPrivilegesToken");
		return -1;
	}
	
	for (int i = 0; i <= 0x24; i++) {
		TOKEN_PRIVILEGES tp = {};
		LUID luid = {};
		luid.HighPart = 0;
		luid.LowPart = i;
		tp.PrivilegeCount = 1;
		tp.Privileges[0].Luid = luid;
		tp.Privileges[0].Attributes = SE_PRIVILEGE_REMOVED;
		ZwAdjustPrivilegesToken(token, 0, &tp, sizeof(tp), NULL, NULL);
	}
	
	return TRUE;

}


int main() {
	int pid = FindProcessId(L"HipsDaemon.exe");
	printf("pid: %d\n", pid);
	HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);

	HANDLE token;
	int ret = OpenProcessToken(process, TOKEN_ALL_ACCESS, &token);

	DisablePrivilege(token);

	DWORD integrityLevel = SECURITY_MANDATORY_UNTRUSTED_RID;
	SID sid = {};
	sid.Revision = SID_REVISION;
	sid.SubAuthorityCount = 1;
	sid.IdentifierAuthority.Value[5] = 16;
	sid.SubAuthority[0] = integrityLevel;

	TOKEN_MANDATORY_LABEL tml = {};
	tml.Label.Attributes = SE_GROUP_INTEGRITY;		//SE_GROUP_INTEGRITY-是强制完整性的SIDhttps://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-token_groups
	tml.Label.Sid = &sid;
	BOOL Rret = SetTokenInformation(token, TokenIntegrityLevel, &tml, sizeof(TOKEN_MANDATORY_LABEL));
    //TokenIntegrityLevel	缓冲区接收一个TOKEN_MANDATORY_LABEL结构，该结构指定令牌的完整性级别https://docs.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_information_class
	printf("%d", Rret);
	CloseHandle(token);
	CloseHandle(process);
}