Otwarcie procesu z SeDebugPrivilege

#include <windows.h>
#include <iostream>
#include <conio.h>

LPCWSTR lpstrWindowName = L"WindowName";
HWND hWindow;
DWORD dwProcess;
HANDLE hProcess;
int value = 0;
DWORD* pointer = (DWORD*)0x00540240;
HANDLE hToken;

BOOL SetPrivilege(
    HANDLE hToken,          // access token handle
    LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
    BOOL bEnablePrivilege   // to enable or disable privilege
    ) 
{
	TOKEN_PRIVILEGES tp;
	LUID luid;

	if ( !LookupPrivilegeValue( 
			NULL,            // lookup privilege on local system
			lpszPrivilege,   // privilege to lookup 
			&luid ) )        // receives LUID of privilege
	{
		printf("LookupPrivilegeValue error: %u\n", GetLastError() ); 
		return FALSE; 
	}

	tp.PrivilegeCount = 1;
	tp.Privileges[0].Luid = luid;
	if (bEnablePrivilege)
		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	else
		tp.Privileges[0].Attributes = 0;

	// Enable the privilege or disable all privileges.

	if ( !AdjustTokenPrivileges(
		   hToken, 
		   FALSE, 
		   &tp, 
		   sizeof(TOKEN_PRIVILEGES), 
		   (PTOKEN_PRIVILEGES) NULL, 
		   (PDWORD) NULL) )
	{ 
		  printf("AdjustTokenPrivileges error: %u\n", GetLastError() ); 
		  return FALSE; 
	} 

	if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

	{
		  printf("The token does not have the specified privilege. \n");
		  return FALSE;
	} 

	return TRUE;
}

int main()
{	
	if (!(hWindow = FindWindow(NULL, lpstrWindowName)))
		printf ("Window not found\n");
		
	if (!GetWindowThreadProcessId(hWindow, &dwProcess))
		printf ("Process not found\n");	
	
	if (!(hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, dwProcess)))
		printf ("Cant open process! \n");

	if(!OpenProcessToken(hProcess,/*TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY*/TOKEN_ADJUST_PRIVILEGES,&hToken))
        printf ("Cannot open process token\n");	
	SetPrivilege(hToken, SE_DEBUG_NAME, true);
	
	if (!ReadProcessMemory(hProcess, pointer, &value, 4, NULL))
	{
		printf ("Cant read in: 0x00%X \n", pointer);
		printf ("Error: %d\n", GetLastError());
	}
	else
	{
		printf ("Memory: %s \n", value);
	}

	getch();
	return 0;
}

Cant open process!
Cannot open process token
AdjustTokenPrivileges error: 6
Cant read in: 0x00740240
Error: 6

PROCESSENTRY32 pe32;
wchar_t cProcessName[260] = L"term.exe";
//.......................
HANDLE hProcessSnap;

do
if (pe32.szExeFile == cProcessName)
 return pe32.th32ProcessID;
while (Process32Next( hProcessSnap, &pe32 ))
// .........................
 return false;

DWORD dwProcess; // ID mojego procesu
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
		
	SetPrivilege(hToken, SE_DEBUG_NAME, true);

	if (!(hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, dwProcess)))
	{		
		printError(L"OpenProcess");
	}

	if(!OpenProcessToken(hProcess,TOKEN_ADJUST_PRIVILEGES,&hToken))
        printError(L"OpenProcessToken");

OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
SetPrivilege(hToken, SE_DEBUG_NAME, true);
CloaseHandle(hToken);

        if (!(hWindow = FindWindow(NULL, lpstrWindowName)))
                printf ("Window not found\n");
               
        if (!GetWindowThreadProcessId(hWindow, &dwProcess))
                printf ("Process not found\n");       
       
        if (!(hProcess = OpenProcess(PROCESS_VM_READ, false, dwProcess)))
                printf ("Cant open process! \n");

        if (!ReadProcessMemory(hProcess, pointer, &value, 4, NULL))
        {
                printf ("Cant read in: 0x00%X \n", pointer);
                printf ("Error: %d\n", GetLastError());
        }
        else
        {
                printf ("Memory: %s \n", value);
        }

#include <windows.h>

typedef DWORD (__stdcall *CSRPID)(void);
typedef DWORD (__stdcall *NTQSI)(ULONG SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength, ULONG* ReturnLength);
#define SystemHandleInformation 16

typedef struct {
    ULONG OwnerPid;
    BYTE ObjectType;
    BYTE HandleFlags;
    USHORT HandleValue;
    PVOID ObjectPointer;
    ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_ENTRY;

typedef struct {
    ULONG HandleCount;
    SYSTEM_HANDLE_ENTRY Handles[1];
} SYSTEM_HANDLE_INFORMATION;


BOOL OpenProcessEx(DWORD pid, HANDLE *ppv)
{
	BOOL success = FALSE;
	HMODULE ntdll = GetModuleHandle("ntdll");
	while (1)
	{
		CSRPID CsrGetProcessId = (CSRPID)GetProcAddress(ntdll, "CsrGetProcessId");
		NTQSI NtQuerySystemInformation = (NTQSI)GetProcAddress(ntdll, "NtQuerySystemInformation");

		if (!CsrGetProcessId || !NtQuerySystemInformation)
		{
			//MessageBox(0, TEXT("no api"),0,0);
			break;
		}
		// otwórz csrss.exe
		DWORD csrpid = CsrGetProcessId();
		HANDLE csrss = OpenProcess(PROCESS_DUP_HANDLE, FALSE, csrpid);
		if (!csrss)
		{
			//MessageBox(0, TEXT("Open csrss error"),0,0);
			break;
		}

		ULONG bsize = 32768;
		SYSTEM_HANDLE_INFORMATION *handles = (SYSTEM_HANDLE_INFORMATION*)malloc(bsize);
		DWORD status;
		while (handles)
		{
			ULONG cch;
			status = NtQuerySystemInformation(SystemHandleInformation, handles, bsize, &cch);
			if (!status || (status != 0xc0000004)) break;
			free(handles);
			bsize += 32768;
			handles = (SYSTEM_HANDLE_INFORMATION*)malloc(bsize);
		}

		if (!status && handles)
		{
			int i;
			for (i=0; i<handles->HandleCount; i++)
			{
				if (handles->Handles[i].OwnerPid == csrpid)
				{
					if (DuplicateHandle(csrss, (HANDLE)handles->Handles[i].HandleValue, GetCurrentProcess(),
						ppv, 0, FALSE, DUPLICATE_SAME_ACCESS))
					{
						if (GetProcessId(*ppv) == pid) // głupie ale łatwe
						{
							success = TRUE;
							break;
						}
						CloseHandle(*ppv);
					}
				}
			}
		}
		if (handles) free(handles);
		CloseHandle(csrss);
		break;
	}
	return success;
}

int main(void)
{
	TOKEN_PRIVILEGES tp;
	HANDLE hToken;
	OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
	tp.PrivilegeCount = 1;
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), 0, 0);
	CloseHandle(hToken);

	HANDLE hProcess;
	if (OpenProcessEx(wpisz_tutaj_pid, &hProcess))
	{
		MessageBox(0, TEXT("OK"),0,0);
		CloseHandle(hProcess);
	}
	else
	{
		MessageBox(0, TEXT("pid not found"),0,0);
	}
}