SeOpenObjectAuditAlarmWithTransaction
VOID __stdcall SeOpenObjectAuditAlarmWithTransaction(
_UNICODE_STRING *ObjectTypeName,
VOID *Object,
_UNICODE_STRING *AbsoluteObjectName,
VOID *SecurityDescriptor,
_ACCESS_STATE *AccessState,
UINT8 ObjectCreated,
UINT8 AccessGranted,
CHAR AccessMode,
_GUID *TransactionId,
UINT8 *GenerateOnClose){
UINT16 v10;
void *v11;
_UNICODE_STRING *v12;
_UNICODE_STRING *v13;
_BYTE *PrimaryToken;
_SECURITY_SUBJECT_CONTEXT *v15;
__int64 v16;
VOID *v17;
UINT8 v18;
bool v19;
int v20;
char v21;
UINT8 v22;
_SECURITY_SUBJECT_CONTEXT *v23;
bool v24;
UINT8 v25;
unsigned __int8 v26;
UINT8 v27;
PRIVILEGE_SET *v28;
char v29;
UINT8 v30;
_SECURITY_SUBJECT_CONTEXT *p_SubjectContext;
__int16 v32;
__int16 v33;
unsigned int i;
int v35;
unsigned int v36;
__int16 v37;
_ACL *v38;
_ACL *v39;
__int64 v40;
__int64 v41;
__int16 v42;
_ACL *v43;
__int64 v44;
__int16 v45;
_ACL *v46;
__int64 v47;
_TOKEN *v48;
VOID *v49;
int v50;
_UNICODE_STRING *v51;
NTSTATUS v52;
_GUID *v53;
void *v54;
VOID **PoolWithTag;
_TOKEN *v56;
void *v57;
VOID **v58;
UINT64 GrantedAccess;
UINT64 v60;
UINT8 GenerateAudit;
UINT8 GenerateAlarm[3];
UINT16 FlatSubCategoryId;
NTSTATUS NameString;
_TOKEN *ClientToken;
_UNICODE_STRING *TypeName;
_OBJECT_NAME_INFORMATION *ObjectNameInfo;
_UNICODE_STRING *v68;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
UINT16 AccessModea;
v10 = 999;
v11 = SecurityDescriptor;
v12 = ObjectTypeName;
GenerateAudit = 0;
v13 = 0i64;
GenerateAlarm[0] = 0;
ObjectNameInfo = 0i64;
TypeName = 0i64;
ClientToken = 0i64;
v68 = 0i64;
NameString = 0;
FlatSubCategoryId = 999;
if( !AccessMode )
return;
PrimaryToken = (_BYTE *)*((_QWORD *)AccessState + 4);
v15 = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
v16 = *((_QWORD *)AccessState + 9);
if( PrimaryToken )
v17 = (VOID *)*((_QWORD *)AccessState + 4);
else
v17 = (VOID *)*((_QWORD *)AccessState + 6);
v18 = AccessGranted;
if( !SecurityDescriptor )
goto LABEL_22;
v10 = 118;
FlatSubCategoryId = 118;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v19 = AccessGranted == 0;
v20 = (AccessGranted != 0 ? 3 : 0) | 0x30;
if( AccessGranted )
v20 = AccessGranted != 0 ? 3 : 0;
if( !dword_140C1D368 )
{
v22 = GenerateAudit;
goto LABEL_11;
}
if( (v20 & dword_140C1D368) != 0 )
{
LABEL_58:
v10 = SepAdtClassifyObjectIntoSubCategory(Object, v12, v18, v19);
AccessModea = v10;
FlatSubCategoryId = v10;
if( SepAdtAuditThisEventWithContext(v10, v18, v19, (_SECURITY_SUBJECT_CONTEXT *)AccessState + 1) )
{
v36 = *((_DWORD *)AccessState + 4) | *((_DWORD *)AccessState + 5);
v37 = *((_WORD *)SecurityDescriptor + 1);
if( (v37 & 0x10) != 0 )
{
if( v37 >= 0 )
{
v38 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v40 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v40 )
v38 = (_ACL *)((char *)SecurityDescriptor + v40);
else
v38 = 0i64;
}
if( v37 >= 0 )
{
v39 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v41 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v41 )
v39 = (_ACL *)((char *)SecurityDescriptor + v41);
else
v39 = 0i64;
}
}
else
{
v38 = 0i64;
v39 = 0i64;
}
SeExamineSacl(v39, v38, v17, v36, v18, &GenerateAudit, GenerateAlarm);
v42 = *((_WORD *)SecurityDescriptor + 1);
if( (v42 & 0x10) != 0 )
{
if( v42 >= 0 )
{
v43 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v44 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v44 )
v43 = (_ACL *)((char *)SecurityDescriptor + v44);
else
v43 = 0i64;
}
}
else
{
v43 = 0i64;
}
SeExamineGlobalSacl(ObjectTypeName, v43, v17, v36, v18, &GenerateAudit, GenerateAlarm);
v22 = GenerateAudit;
if( !GenerateAudit || (*GenerateOnClose = 1, !v18) )
{
v10 = AccessModea;
goto LABEL_89;
}
v45 = *((_WORD *)SecurityDescriptor + 1);
if( (v45 & 0x10) != 0 )
{
if( v45 >= 0 )
{
v46 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v47 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v47 )
v46 = (_ACL *)((char *)SecurityDescriptor + v47);
else
v46 = 0i64;
}
}
else
{
v46 = 0i64;
}
SeMaximumAuditMask(v46, v36, v17, (UINT64 *)(v16 + 28));
SeMaximumAuditMaskFromGlobalSacl(ObjectTypeName, v36, v17, (UINT64 *)(v16 + 28));
v10 = AccessModea;
}
v22 = GenerateAudit;
LABEL_89:
v11 = SecurityDescriptor;
goto LABEL_11;
}
v21 = 0;
if( !dword_140C1D428 )
{
v22 = GenerateAudit;
v10 = 118;
LABEL_11:
v23 = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
goto LABEL_12;
}
p_SubjectContext = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
if( AccessState == (_ACCESS_STATE *)-32i64 )
{
p_SubjectContext = &SubjectContext;
SeCaptureSubjectContext((INT64)&SubjectContext);
PrimaryToken = SubjectContext.ClientToken;
v11 = SecurityDescriptor;
v12 = ObjectTypeName;
}
if( PrimaryToken || (PrimaryToken = p_SubjectContext->PrimaryToken) != 0i64 )
{
if( PrimaryToken[118] != 2 )
goto LABEL_56;
v32 = 0;
v33 = 0;
for( i = 16; i < 0x1E; ++i )
{
v35 = (unsigned __int8)PrimaryToken[((unsigned __int64)i >> 1) + 88] >> (4 * (i & 1));
if( (v35 & 1) != 0 )
{
if( (v20 & 2) != 0 )
goto LABEL_54;
++v32;
}
if( (v35 & 4) != 0 )
{
if( (v20 & 0x20) != 0 )
goto LABEL_54;
++v33;
}
}
if( (v20 & 1) != 0 && v32 == 14 || (v20 & 0x10) != 0 && v33 == 14 )
LABEL_54:
v21 = 1;
}
else
{
SepAuditFailed(3221225596i64);
}
v12 = ObjectTypeName;
v11 = SecurityDescriptor;
LABEL_56:
v23 = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
if( AccessState == (_ACCESS_STATE *)-32i64 )
{
SeReleaseSubjectContext(p_SubjectContext);
v11 = SecurityDescriptor;
v23 = 0i64;
v12 = ObjectTypeName;
}
v18 = AccessGranted;
if( v21 )
goto LABEL_58;
v22 = GenerateAudit;
v10 = 118;
LABEL_12:
v24 = AccessGranted == 0;
if( (*((_DWORD *)AccessState + 6) & 0x2000000) != 0 )
v24 = 1;
v25 = 0;
if( (*((_DWORD *)AccessState + 6) & 0x2000000) == 0 )
v25 = v18;
v26 = 0;
while( *(int *)(*((_QWORD *)AccessState + 9) + 4i64 * v26 + 88) >= 0 )
{
if( ++v26 >= 0x20u )
{
v27 = 0;
goto LABEL_20;
}
}
v27 = SepAdtAuditThisEventWithContext(0x81ui64, v25, v24, v23);
v11 = SecurityDescriptor;
LABEL_20:
*(_BYTE *)(v16 + 216) = v27;
if( v22 )
goto LABEL_92;
v13 = TypeName;
v15 = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
LABEL_22:
if( v18 )
{
v28 = *(PRIVILEGE_SET **)v16;
if( *(_QWORD *)v16 )
{
if( v28->PrivilegeCount )
{
v30 = SepAdtAuditPrivilegeUseWithContext(v28, v18, 0, v15, &FlatSubCategoryId);
v10 = FlatSubCategoryId;
v11 = SecurityDescriptor;
if( v30 )
{
*((_BYTE *)AccessState + 124) = 1;
goto LABEL_92;
}
}
}
}
if( GenerateAlarm[0] )
{
LABEL_92:
v13 = TypeName;
v15 = (_SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
v29 = 1;
goto LABEL_27;
}
v29 = 0;
LABEL_27:
*((_BYTE *)AccessState + 9) = v29;
if( !v29 && !*(_BYTE *)(v16 + 216) )
return;
v48 = (_TOKEN *)AbsoluteObjectName;
if( AbsoluteObjectName && AbsoluteObjectName->Length )
{
ClientToken = (_TOKEN *)AbsoluteObjectName;
LABEL_96:
v49 = Object;
goto LABEL_104;
}
v49 = Object;
if( Object )
{
NameString = SepQueryNameString(Object, (PVOID *)&ObjectNameInfo);
v50 = NameString;
if( NameString < 0 )
goto LABEL_130;
v48 = ClientToken;
v11 = SecurityDescriptor;
if( ObjectNameInfo )
{
if( *((_WORD *)ObjectNameInfo + 1) != (_WORD)ClientToken )
v48 = (_TOKEN *)ObjectNameInfo;
v49 = Object;
ClientToken = v48;
goto LABEL_104;
}
goto LABEL_96;
}
v48 = ClientToken;
LABEL_104:
if( ObjectTypeName && ObjectTypeName->Length )
{
v51 = ObjectTypeName;
LABEL_113:
if( v18 )
{
if( v48 )
{
v54 = (void *)*((_QWORD *)AccessState + 17);
if( v54 )
{
ExFreePoolWithTag(v54, 0);
v48 = ClientToken;
*((_DWORD *)AccessState + 32) = 0;
}
PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned __int16 *)&v48->TokenSource.SourceName[2], 538994003i64);
*((_QWORD *)AccessState + 17) = PoolWithTag;
if( PoolWithTag )
{
v56 = ClientToken;
*((_WORD *)AccessState + 65) = *(_WORD *)&ClientToken->TokenSource.SourceName[2];
RtlCopyUnicodeString((PUNICODE_STRING)AccessState + 8, (PCUNICODE_STRING)v56);
}
}
if( v51 )
{
v57 = (void *)*((_QWORD *)AccessState + 19);
if( v57 )
{
ExFreePoolWithTag(v57, 0);
*((_DWORD *)AccessState + 36) = 0;
}
v58 = ExAllocatePoolWithTag(1ui64, v51->MaximumLength, 538994003i64);
*((_QWORD *)AccessState + 19) = v58;
if( v58 )
{
*((_WORD *)AccessState + 73) = v51->MaximumLength;
RtlCopyUnicodeString((PUNICODE_STRING)AccessState + 9, v51);
}
}
if( TransactionId )
*(_GUID *)(v16 + 32) = *TransactionId;
}
else
{
v53 = TransactionId;
if( !TransactionId )
v53 = (_GUID *)(v16 + 32);
SepAdtOpenObjectAuditAlarm(
v10,
(__int64)&SeSubsystemName,
0i64,
&v51->Length,
(__int64)v48,
v11,
(__int64)v15->ClientToken,
*((_QWORD *)AccessState + 6),
*((_DWORD *)AccessState + 6),
*((_DWORD *)AccessState + 5),
*(_QWORD *)v16,
0,
*((_QWORD *)AccessState + 7),
2,
0i64,
0,
0i64,
(__int64)v53,
(__int64)AccessState);
LODWORD(v60) = *((_DWORD *)AccessState + 5);
LODWORD(GrantedAccess) = *((_DWORD *)AccessState + 6);
SepAdtStagingEvent(
v10,
(_UNICODE_STRING *)ClientToken,
0i64,
v51,
(_UNICODE_STRING *)ClientToken,
(_TOKEN *)v15->ClientToken,
*((_TOKEN **)AccessState + 6),
GrantedAccess,
v60,
0,
0i64,
AccessState);
}
v50 = NameString;
goto LABEL_130;
}
if( !v49 )
{
v51 = v68;
goto LABEL_113;
}
v52 = SepQueryTypeString(v49, &TypeName);
v13 = TypeName;
v50 = v52;
NameString = v52;
if( v52 >= 0 )
{
v51 = v68;
v11 = SecurityDescriptor;
v48 = ClientToken;
if( TypeName )
v51 = TypeName;
goto LABEL_113;
}
LABEL_130:
if( ObjectNameInfo )
ExFreePoolWithTag(ObjectNameInfo, 0);
if( v13 )
ExFreePoolWithTag(v13, 0);
if( v50 < 0 )
SepAuditFailed((unsigned int)v50);
}Referenced by:
CmpCheckKeyBodyAccess
CmpCheckOpenAccessOnKeyBody
ObpCreateHandle
SeOpenObjectAuditAlarm