bsp; DWORD dwSidPrimLen = 0;

  DWORD dwSDLen;
  EXPLICIT_ACCESS ea;
  PSECURITY_DESCRIPTOR pOrigSd = NULL;
  PSECURITY_DESCRIPTOR pNewSd = NULL;

  STARTUPINFO si;
  PROCESS_INFORMATION pi;

  BOOL bError;

  if ( !EnableDebugPriv( "SeDebugPrivilege" ) )
  {
    printf( "EnableDebugPriv() to failed!\n" );

    bError = TRUE;
    goto Cleanup;
  }

  //
  // 选择 WINLOGON 进程
  //
  if ( ( dwPid = GetProcessId( "WINLOGON.EXE" ) ) == NULL )
  {
    printf( "GetProcessId() to failed!\n" );  

    bError = TRUE;
    goto Cleanup;
  }

  hProcess = OpenProcess( PROCESS_QUERY_INFORMATION, FALSE, dwPid );
  if ( hProcess == NULL )
  {
    printf( "OpenProcess() = %d\n", GetLastError() );  

    bError = TRUE;
    goto Cleanup;
  }

  if ( !OpenProcessToken( hProcess, READ_CONTROL | WRITE_DAC, &hToken ) )
  {
    printf( "OpenProcessToken() = %d\n", GetLastError() );

    bError = TRUE;
    goto Cleanup;
  }

  //
  // 设置 ACE 具有所有访问权限
  //
  ZeroMemory( &ea, sizeof( EXPLICIT_ACCESS ) );
  BuildExplicitAccessWithName( &ea,
                               "Everyone",
                               TOKEN_ALL_ACCESS,
                               GRANT_ACCESS,
                               0 );

  if ( !GetKernelObjectSecurity( hToken,
                                 DACL_SECURITY_INFORMATION,
                                 pOrigSd,