Recently I've been studying the sandboxie source code,But I don't know how dcomlaunch calls createprocess successfully

[lmou523]

When I use sandboxie，I set up these configurations
{
UnfilteredToken=y
OriginalToken=y
UnrestrictedToken=y
NoSecurityIsolation=y
OpenCredentials=y
NoSandboxieDesktop=y
}
dcomlaunch should be the privilege of the current user, but why should it call creatprocessasuser successfully?
I can probably guess that the driver did something，But I can't find the code to do that
If anyone can help me, I will be very grateful

[DavidXanatos]

could you please elaborate why you expect createprocessasuser not being available?

[lmou523]

I want createprocessasuser to be available.
But I wish I could know how it works and use the same techniques in my own programs.
Can you elaborate on why sandboxie was able to do that?

[DavidXanatos]

I'm not sure what you problem is, createprocessasuser can be used if you have the right permissions, sandboxie manipulates a lot around token usage and process creation, for example it intercepts CreateProcessInternalW and uses an own mechanism to asign a custom token to a process using its driver.

[lmou523]

When I set up these configurations
{
UnfilteredToken=y
OriginalToken=y
UnrestrictedToken=y
NoSecurityIsolation=y
OpenCredentials=y
NoSandboxieDesktop=y
}
In most cases, sandboxie will not process tokens。
At this point, dcomlaunch should be user permission，creatprocessasuser can succeed when the driver is assisted
I want my program to have the createprocessasuser permission, even though the current user does not have this permission

[lmou523]

I'm just wondering how did sandboxie get the createprocessasuser permission