How can I tell in C# or VB.NET if a low-level hook is blocked by a high-integrity process?

Maybe it is possible to assume that any other window, even not in foreground, belongs to a privileged program.

@jacky Perpète,

I cobbled together a VB console application the compares process integrity levels. I have no doubt that the code can be restructured and modernized but I think it will be helpful to you.

Initial version deleted. See updated code in following comment.

Updated code example -

Module Module1

    Public Enum TOKEN_INFORMATION_CLASS
        TokenUser = 1
        TokenGroups
        TokenPrivileges
        TokenOwner
        TokenPrimaryGroup
        TokenDefaultDacl
        TokenSource
        TokenType
        TokenImpersonationLevel
        TokenStatistics
        TokenRestrictedSids
        TokenSessionId
        TokenGroupsAndPrivileges
        TokenSessionReference
        TokenSandBoxInert
        TokenAuditPolicy
        TokenOrigin
        TokenElevationType
        TokenLinkedToken
        TokenElevation
        TokenHasRestrictions
        TokenAccessInformation
        TokenVirtualizationAllowed
        TokenVirtualizationEnabled
        TokenIntegrityLevel
        TokenUIAccess
        TokenMandatoryPolicy
        TokenLogonSid
        TokenIsAppContainer
        TokenCapabilities
        TokenAppContainerSid
        TokenAppContainerNumber
        TokenUserClaimAttributes
        TokenDeviceClaimAttributes
        TokenRestrictedUserClaimAttributes
        TokenRestrictedDeviceClaimAttributes
        TokenDeviceGroups
        TokenRestrictedDeviceGroups
        TokenSecurityAttributes
        TokenIsRestricted
        TokenProcessTrustLevel
        TokenPrivateNameSpace
        TokenSingletonAttributes
        TokenBnoIsolation
        TokenChildProcessFlags
        TokenIsLessPrivilegedAppContainer
        TokenIsSandboxed
        TokenOriginatingProcessTrustLevel
        MaxTokenInfoClass  'MaxTokenInfoClass should always be the last Enum
    End Enum

    <DllImport("kernel32.dll", CallingConvention:=CallingConvention.StdCall, ExactSpelling:=True, SetLastError:=True)>
    Public Function OpenProcess(DesiredAccess As UInteger, Inheritable As Boolean, ProcessId As Integer) As SafeProcessHandle

    End Function

    <DllImport("advapi32.dll", CallingConvention:=CallingConvention.StdCall, ExactSpelling:=True, SetLastError:=True)>
    Public Function OpenProcessToken(ProcessHandle As SafeProcessHandle, DesiredAccess As UInteger, <Out> ByRef TokenHandle As SafeAccessTokenHandle) As Boolean

    End Function

    <DllImport("advapi32.dll", CallingConvention:=CallingConvention.StdCall, ExactSpelling:=True, SetLastError:=True)>
    Public Function GetTokenInformation(handle As SafeAccessTokenHandle,
            TokenInformationClass As TOKEN_INFORMATION_CLASS,
            TokenInformation As IntPtr,
            TokenInformationLength As Integer,
            ByRef ReturnLength As Integer) As Boolean
    End Function

    <StructLayout(LayoutKind.Sequential)>
    Public Structure SID_AND_ATTRIBUTES
        Public PSID As IntPtr
        Public Attributes As UInteger
    End Structure

    <StructLayout(LayoutKind.Sequential)>
    Public Class TOKEN_MANDATORY_LABEL
        Public Label As SID_AND_ATTRIBUTES
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=SECURITY_MAX_SID_SIZE)>
        Public Buffer As Byte() ' Provide buffer to avoid calling GetTokenInformation twice
    End Class

    Const SECURITY_MAX_SID_SIZE As Integer = 68

    Public Function GetIntegrityOfProcess(ProcessId As Integer) As SecurityIdentifier
        Dim PROCESS_QUERY_LIMITED_INFORMATION As Integer = &H1000
        Dim TOKEN_QUERY As Short = &H8
        Dim ti As IntPtr = IntPtr.Zero

        Try
            Using ProcessHandle As SafeProcessHandle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, ProcessId)
                Dim TokenHandle As New SafeAccessTokenHandle(IntPtr.Zero)
                Try
                    If OpenProcessToken(ProcessHandle, TOKEN_QUERY, TokenHandle) Then
                        Dim len = Marshal.SizeOf(Of TOKEN_MANDATORY_LABEL)()

                        ti = Marshal.AllocHGlobal(len)
                        If GetTokenInformation(TokenHandle, TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, ti, len, len) Then
                            Dim label As TOKEN_MANDATORY_LABEL = New TOKEN_MANDATORY_LABEL()
                            Marshal.PtrToStructure(ti, label)
                            Dim sid As SecurityIdentifier = New SecurityIdentifier(label.Label.PSID)
                            Return sid
                        Else
                            Throw New Win32Exception(Marshal.GetLastWin32Error(), "GetTokenInformation failed")
                        End If
                    Else
                        Throw New Win32Exception(Marshal.GetLastWin32Error(), "OpenProcessToken failed")
                    End If
                Finally
                    TokenHandle.Dispose()
                End Try
            End Using

        Finally
            If ti <> IntPtr.Zero Then
                Marshal.FreeHGlobal(ti)
            End If
        End Try
    End Function

    Sub Main()
        Try
            Dim processIntegrity = GetIntegrityOfProcess(Process.GetCurrentProcess().Id)

            Dim taskmanagerIntegrity = GetIntegrityOfProcess(Process.GetProcessesByName("TaskMgr")(0).Id)

            Dim result = processIntegrity.CompareTo(taskmanagerIntegrity)

            If result < 0 Then
                Console.WriteLine("Process integrity is less than TaskManger integrity")
            ElseIf result = 0 Then
                Console.WriteLine("Process integrity is same as TaskManager integrity")
            Else
                Console.WriteLine("Process integrity is greater than TaskManager integrity")
            End If
        Catch ex As Exception
            Console.WriteLine($"Caught exception {ex.Message}")
        End Try

    End Sub

End Module

I think this is a better version. :)

@RLWA32 ,with your example, I was able to correctly use the GetTokenInformation API.Now it works for me.

Thank you.

Here is the result obtained during testing:

GetTokenInformation(tokenHandle, TokenIntegrityLevel, integrityLevelPtr, returnLength, returnLength)
Dim label As TOKEN_MANDATORY_LABEL = New TOKEN_MANDATORY_LABEL()
Marshal.PtrToStructure(integrityLevelPtr, label)
Dim sid As SecurityIdentifier = New SecurityIdentifier(label.Label.PSID)
Select Case sid.ToString
    Case "S-1-16-0"
        'Unknown Integrity Level
    Case "S-1-16-4096"
        'Low Integrity Level
    Case "S-1-16-8192"
         'Medium Integrity Level
    Case "S-1-16-12288"
        'High Integrity Level
    Case "S-1-16-16384"
        'System Integrity Level'
    Case Else
        'Custom Integrity Level'
End Select