PiAuCheckClientInteractive
NTSTATUS __stdcall PiAuCheckClientInteractive(UINT8 *ClientInteractive){
VOID **PoolWithTag;
VOID **v3;
int v4;
_DWORD *v5;
UINT8 IsMember;
_SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
*(_DWORD *)IdentifierAuthority.Value = 0;
*ClientInteractive = 0;
*(_WORD *)&IdentifierAuthority.Value[4] = 1280;
IsMember = 0;
PoolWithTag = ExAllocatePoolWithTag(1ui64, 0xCui64, 538996816i64);
v3 = PoolWithTag;
if( !PoolWithTag )
return -1073741670;
v4 = RtlInitializeSid(PoolWithTag, &IdentifierAuthority, 1u);
if( v4 >= 0 )
{
LODWORD(v5) = RtlSubAuthoritySid((INT64)v3, 0i64);
*v5 = 4;
if( !RtlValidSid(v3) )
v4 = -1073741595;
if( v4 >= 0 )
{
v4 = PiAuCheckTokenMembership(v3, &IsMember);
if( v4 >= 0 )
*ClientInteractive = IsMember;
}
}
ExFreePoolWithTag(v3, 0);
return v4;
}Referenced by:
PiCMQueryRemove