process token privilege is store in EProcess structure:
Win2000: EProcess+$12C
WinXP SP2: EProcess+$C8
Win2003 SP2 EProcess+$D8
Vista: EProcess+$E0
WinLogo.Exe is running under system privilege, so read its EProcess+$12C
and then overwrite the DWORD to target EProcess,
now your process is running under system account
Example code: (Win2003SP2)
ReadVirtualMemory(WinLogonEProcess+$D8, @Token, 4);
WriteVirtualMemory(TargetEProcess+$D8, @Token, 4)
