Appinfo服务在创建提升进程时，会调用Windows API函数CreateProcessAsUser函数。该函数可以使用指定用户的安全令牌来创建一个新进程，以达到提升进程权限的目的。示例代码如下：

HANDLE hToken = NULL; HANDLE hDupToken = NULL; DWORD sessionId = 0;

// 获取当前进程所在的SessionId ProcessIdToSessionId(GetCurrentProcessId(), &sessionId);

// 获取当前SessionId对应的用户令牌 WTSQueryUserToken(sessionId, &hToken);

// 复制令牌 DuplicateTokenEx( hToken, TOKEN_ALL_ACCESS, 0, SecurityIdentification, TokenPrimary, &hDupToken );

// 构造进程启动信息 STARTUPINFO si; ZeroMemory(&si, sizeof(STARTUPINFO)); si.cb = sizeof(STARTUPINFO); si.lpDesktop = TEXT("Winsta0\default");

// 构造进程创建参数 PROCESS_INFORMATION pi; ZeroMemory(&pi, sizeof(PROCESS_INFORMATION)); TCHAR* lpExePath = TEXT("C:\Path\To\App.exe"); CreateProcessAsUser( hDupToken, lpExePath, NULL, NULL, NULL, FALSE, CREATE_NEW_CONSOLE | CREATE_NEW_PROCESS_GROUP, NULL, NULL, &si, &pi );

// 关闭句柄 CloseHandle(hToken); CloseHandle(hDupToken); CloseHandle(pi.hProcess); CloseHandle(pi.hThread);