Detecting IE7 Protected Mode, Take 2

On Friday, I posted one method that an ActiveX control or IE toolbar can use to determine whether IE 7 is running in Protected Mode. After thinking about this some more, I realized that there are many other ways to accomplish the same goal.

Much of the primary information on IE7 Protected Mode can be found in an MSDN article, Understanding and Working in Protected Mode Internet Explorer. That article mentions the IEIsProtectedModeProcess function I talked about on Friday, but it also explains some of the other characteristics of Protected Mode and Vista UAC mode. For example, Protected Mode modifies IE’s environment, so that the Windows GetTempPath() API will return the value of %Temp%Low rather than the value of %Temp% when Protected Mode is active.

Later in the article, the authors give a code sample, ShowProcessIntegrityLevel(), shown below, that looks at the current process token and determines its integrity level. The integrity level actually tells us more than just whether Protected Mode is enabled.

If we are in Protected Mode, the process integrity will be Low; if we are running as a normal user or running in UAC mode, the process integrity will be Medium; and if we are running as Administrator, the process integrity will be High. An ActiveX control that wants to expose the integrity level to JavaScript through a COM interface could run a variation on this code and return a short integer that is 0 for Low Integrity (Protected Mode), 1 for Medium Integrity (Normal User/UAC mode), and 2 for High Integrity (Administrator).

I really wish this was already built into IE 7, but it’ll do.

void ShowProcessIntegrityLevel()
{
  HANDLE hToken;
  HANDLE hProcess;

  DWORD dwLengthNeeded;
  DWORD dwError = ERROR_SUCCESS;

  PTOKEN_MANDATORY_LABEL pTIL = NULL;
  LPWSTR pStringSid;
  DWORD dwIntegrityLevel;
 
  hProcess = GetCurrentProcess();
  if (OpenProcessToken(hProcess, TOKEN_QUERY | 
        TOKEN_QUERY_SOURCE, &hToken)) 
  {
    // Get the Integrity level.
    if (!GetTokenInformation(hToken, TokenIntegrityLevel, 
           NULL, 0, &dwLengthNeeded))
    {
      dwError = GetLastError();
      if (dwError == ERROR_INSUFFICIENT_BUFFER)
      {
        pTIL = (PTOKEN_MANDATORY_LABEL)LocalAlloc(0, 
                  dwLengthNeeded);
        if (pTIL != NULL)
        {
          if (GetTokenInformation(hToken, TokenIntegrityLevel, 
                 pTIL, dwLengthNeeded, &dwLengthNeeded))
          {
            dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, 
               (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid)-1));
 
            if (dwIntegrityLevel < SECURITY_MANDATORY_MEDIUM_RID)
            {
              // Low Integrity
              wprintf(L"Low Process");
            }
            else if (dwIntegrityLevel >= SECURITY_MANDATORY_MEDIUM_RID && 
                     dwIntegrityLevel < SECURITY_MANDATORY_HIGH_RID)
            {
              // Medium Integrity
              wprintf(L"Medium Process");
            }
            else if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID)
            {
              // High Integrity
              wprintf(L"High Integrity Process");
            }
          }
          LocalFree(pTIL);
        }
      }
    }
    CloseHandle(hToken);
  }
}