SeQueryServerSiloToken
NTSTATUS __stdcall SeQueryServerSiloToken(VOID *InToken, PFLUSH_ADAPTER_BUFFERS_EX *ServerSilo){
_ETHREAD *CurrentThread;
unsigned int v5;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite(*((_QWORD *)InToken + 6), 1);
v5 = *((_DWORD *)InToken + 30);
ExReleaseResourceLite(*((PERESOURCE *)InToken + 6));
KeLeaveCriticalRegion();
return PsGetSiloBySessionId(v5, ServerSilo);
}Referenced by:
NtCreateUserProcess
SepCreateClientSecurityEx
SepUpdateSiloInClientSecurity