Sabes si un proceso es de sistema o no

[[escafandra]]

Código Delphi [-]
function EnablePrivilege(name: String; Enable: boolean): boolean;
var
   hToken: Cardinal;
   priv: TOKEN_PRIVILEGES;
begin
   priv.PrivilegeCount:= 1;
   priv.Privileges[0].Attributes:= 0;
   if Enable then priv.Privileges[0].Attributes:= SE_PRIVILEGE_ENABLED;
   LookupPrivilegeValue(nil, PCHAR(name), priv.Privileges[0].Luid);
   OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES, hToken);
   AdjustTokenPrivileges (hToken, FALSE, priv, sizeof(priv), nil, PDWORD(nil)^);
   Result:= (GetLastError = ERROR_SUCCESS);
   CloseHandle (hToken);
end;

function GetProcessOwner(ProcessId: DWORD; var User, Domain: String): boolean;
var
  hToken, hProcess, cbBuf, UserSize, DomainSize: Cardinal;
  pSidUser: ^SID_AND_ATTRIBUTES;
  SidNU: SID_NAME_USE;
begin
  Result:= false;
  EnablePrivilege('SeDebugPrivilege', true);
  hProcess:= OpenProcess(PROCESS_QUERY_INFORMATION, false, ProcessId);
  if hProcess <> 0 then
  begin
    if OpenProcessToken(hProcess, TOKEN_QUERY, hToken) then
    begin
      GetTokenInformation(hToken, TokenUser, nil, 0, cbBuf);
      GetMem(pSidUser, cbBuf);
      GetTokenInformation(hToken, TokenUser, pSidUser, cbBuf, cbBuf);
      CloseHandle(hToken);
      UserSize:= 0;
      DomainSize:= 0;
      LookupAccountSid(nil, pSidUser.Sid, nil, UserSize, nil, DomainSize, SidNU);
      if (UserSize <> 0) or (DomainSize <> 0) then
      begin
        SetLength(User, UserSize);
        SetLength(Domain, DomainSize);
        Result:= LookupAccountSid(nil, pSidUser.Sid, PCHAR(User), UserSize, PCHAR(Domain), DomainSize, SidNU);
      end;
    end;
     CloseHandle(hProcess);
  end;
  EnablePrivilege('SeDebugPrivilege', false);
end;

Ejemplo:

Código Delphi [-]
var
  User, Domain: String;
begin
   GetProcessOwner(StrToInt(Edit1.Text), User, Domain);
   Label1.Caption := User;
   Label2.Caption := Domain;
end;

Saludos.