SepExamineSaclEx
VOID __stdcall SepExamineSaclEx(
_ACL *Sacl,
_ACL *ResourceSacl,
VOID *Token,
UINT64 DesiredAccess,
_IOBJECT_TYPE_LIST *ObjectTypeList,
UINT64 ObjectTypeListLength,
UINT8 ReturnResultList,
INT64 *AccessStatus,
UINT64 *GrantedAccess,
VOID *PrincipalSelfSid,
UINT8 bOwner,
UINT8 *GenerateSuccessAudit,
UINT8 *GenerateFailureAudit){
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v13;
_QWORD **v14;
int v15;
UINT8 *v16;
_ACL *v17;
UINT8 *v19;
INT64 *v20;
char v21;
_WORD *v22;
NTSTATUS v23;
unsigned int v24;
_ACL *v25;
signed __int8 Sbz1;
unsigned __int8 AclRevision;
unsigned int v28;
bool v29;
bool v30;
unsigned int v31;
unsigned int v32;
unsigned int v33;
_WORD *v34;
_GUID *v35;
unsigned int v36;
UINT8 *v37;
int v38;
_ACL *v39;
unsigned int v40;
unsigned int v41;
_QWORD *v42;
VOID *v43;
VOID *v44;
VOID *v45;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v46;
unsigned int v47;
UINT64 Restricted;
UINT64 Restricteda;
UINT64 Restrictedb;
UINT64 ObjectTypeIndex;
UINT64 ConditionSize;
unsigned int count;
char count_4;
UINT64 ReturnedIndex;
int v56;
unsigned int AceCount;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *ppResourceInfo;
_ACL *v59;
unsigned int v60;
unsigned int DesiredAccessa;
DesiredAccessa = DesiredAccess;
HIDWORD(ReturnedIndex) = -1;
v13 = 0i64;
v14 = (_QWORD **)Token;
ppResourceInfo = 0i64;
v15 = DesiredAccess;
v16 = GenerateFailureAudit;
v17 = ResourceSacl;
count = 0;
v19 = GenerateSuccessAudit;
*GenerateSuccessAudit = 0;
*GenerateFailureAudit = 0;
if( Sacl )
{
AceCount = Sacl->AceCount;
if( AceCount )
{
v20 = AccessStatus;
v21 = 0;
count_4 = 0;
if( (v15 & 0x2000000) != 0 )
{
v21 = 0x80;
if( *(int *)AccessStatus >= 0 )
v21 = 64;
count_4 = v21;
}
v22 = (_WORD *)*v14[19];
if( *v22 == *(_WORD *)SeAnonymousLogonSid )
{
v23 = memcmp(v22, SeAnonymousLogonSid, 4i64 * *((unsigned __int8 *)SeAnonymousLogonSid + 1) + 8);
v19 = GenerateSuccessAudit;
v16 = GenerateFailureAudit;
v14 = (_QWORD **)Token;
v17 = ResourceSacl;
if( !v23 )
count = 4 * *((unsigned __int8 *)SeWorldSid + 1) + 8;
}
v24 = 0;
v25 = Sacl + 1;
v60 = 0;
v59 = Sacl + 1;
while( 1 )
{
if( (*v19 || *v16) && (unsigned int)ObjectTypeListLength <= 1 )
{
LABEL_91:
if( v13 )
{
AuthzBasepFreeSecurityAttributesList(v13);
ExFreePoolWithTag(v13, 0);
}
return;
}
Sbz1 = v25->Sbz1;
if( (Sbz1 & 8) == 0 )
{
AclRevision = v25->AclRevision;
v56 = -1;
LODWORD(ReturnedIndex) = -1;
switch( AclRevision )
{
case 2u:
if( !SepSidInToken(v14, PrincipalSelfSid, &v25[1], 1u, 0, bOwner)
&& (!count || *(_WORD *)SeWorldSid != *(_WORD *)&v25[1].AclRevision
|| memcmp(SeWorldSid, &v25[1], count)) )
{
goto LABEL_87;
}
v28 = *(_DWORD *)&v25->AceCount;
if( !(_DWORD)ObjectTypeListLength )
{
if( *(int *)v20 >= 0 )
{
if( (Sbz1 & 0x40) != 0 )
{
if( (*(_DWORD *)GrantedAccess & v28) == 0 )
{
v29 = v21 == 64;
goto LABEL_75;
}
goto LABEL_76;
}
goto LABEL_87;
}
if( Sbz1 >= 0 )
goto LABEL_87;
if( (v28 & DesiredAccessa) == 0 )
{
v30 = v21 == (char)0x80;
LABEL_80:
if( !v30 )
goto LABEL_87;
}
goto LABEL_81;
}
v31 = 0;
do
{
LODWORD(ObjectTypeIndex) = v31;
LODWORD(Restricted) = ObjectTypeListLength;
SepSetAuditInfoForObjectType(
Sbz1,
v28,
DesiredAccessa,
ObjectTypeList,
Restricted,
ReturnResultList,
ObjectTypeIndex,
AccessStatus,
GrantedAccess,
GenerateSuccessAudit,
GenerateFailureAudit);
++v31;
}
while( v31 < (unsigned int)ObjectTypeListLength );
v25 = v59;
v19 = GenerateSuccessAudit;
v13 = ppResourceInfo;
v16 = GenerateFailureAudit;
LABEL_31:
v24 = v60;
break;
case 7u:
v32 = *(_DWORD *)&v25->AceCount;
v33 = *(_DWORD *)&v25[1].AclRevision & 1;
v34 = (_WORD *)((char *)&v25[2 * v33] + ((8i64 * (*(_DWORD *)&v25[1].AclRevision & 2)) | 0xC));
v35 = (_GUID *)((unsigned __int64)&v25[1].AceCount & -(__int64)(v33 != 0));
if( v35 )
{
if( SepSidInToken(v14, PrincipalSelfSid, v34, 1u, 0, bOwner)
|| count && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, count) )
{
v37 = GenerateSuccessAudit;
if( AuthzBasepObjectInTypeList(
v35,
ObjectTypeList,
(unsigned int)ObjectTypeListLength,
&ReturnedIndex) )
{
v38 = ReturnedIndex;
}
else
{
v38 = -1;
}
LABEL_85:
if( v38 != -1 )
{
LODWORD(ObjectTypeIndex) = v38;
LODWORD(Restrictedb) = ObjectTypeListLength;
SepSetAuditInfoForObjectType(
Sbz1,
v32,
DesiredAccessa,
ObjectTypeList,
Restrictedb,
ReturnResultList,
ObjectTypeIndex,
AccessStatus,
GrantedAccess,
v37,
GenerateFailureAudit);
}
}
}
else if( SepSidInToken(v14, PrincipalSelfSid, v34, 1u, 0, bOwner)
|| count && *(_WORD *)SeWorldSid == *v34 && !memcmp(SeWorldSid, v34, count) )
{
v36 = 0;
if( (_DWORD)ObjectTypeListLength )
{
do
{
LODWORD(ObjectTypeIndex) = v36;
LODWORD(Restricteda) = ObjectTypeListLength;
SepSetAuditInfoForObjectType(
Sbz1,
v32,
DesiredAccessa,
ObjectTypeList,
Restricteda,
ReturnResultList,
ObjectTypeIndex,
AccessStatus,
GrantedAccess,
GenerateSuccessAudit,
GenerateFailureAudit);
++v36;
}
while( v36 < (unsigned int)ObjectTypeListLength );
v25 = v59;
v19 = GenerateSuccessAudit;
v13 = ppResourceInfo;
goto LABEL_88;
}
}
goto LABEL_87;
case 0xDu:
v32 = *(_DWORD *)&v25->AceCount;
v39 = v25 + 1;
v40 = 4 * v25[1].Sbz1 + 8;
if( v17 && !v13 )
{
AuthzBasepInitializeResourceClaimsFromSacl(v17, &ppResourceInfo);
v19 = GenerateSuccessAudit;
v24 = v60;
v13 = ppResourceInfo;
}
v41 = v25->AclSize - v40;
if( (int)(v41 - 8) <= 0 )
goto LABEL_89;
v42 = (_QWORD *)*((_QWORD *)Token + 137);
if( v42 )
v43 = (VOID *)v42[75];
else
v43 = 0i64;
if( v42 )
v44 = (VOID *)v42[73];
else
v44 = 0i64;
if( v42 )
v45 = (VOID *)v42[74];
else
v45 = 0i64;
if( v42 )
v46 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v42[72];
else
v46 = 0i64;
LODWORD(ConditionSize) = v41 - 8;
AuthzBasepEvaluateAceCondition(
Token,
*((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)Token + 97),
v13,
v46,
v45,
v44,
v43,
(UINT8 *)v39 + v40,
ConditionSize,
1u,
0,
(INT64 *)((char *)&ReturnedIndex + 4));
if( HIDWORD(ReturnedIndex) != 1
|| !SepSidInToken(Token, PrincipalSelfSid, &v25[1], 1u, 0, bOwner)
&& (!count || *(_WORD *)SeWorldSid != *(_WORD *)&v39->AclRevision || memcmp(SeWorldSid, &v25[1], count)) )
{
goto LABEL_87;
}
if( (_DWORD)ObjectTypeListLength )
{
v47 = 0;
v37 = GenerateSuccessAudit;
do
{
LODWORD(ObjectTypeIndex) = v47;
LODWORD(Restrictedb) = ObjectTypeListLength;
SepSetAuditInfoForObjectType(
Sbz1,
v32,
DesiredAccessa,
ObjectTypeList,
Restrictedb,
ReturnResultList,
ObjectTypeIndex,
AccessStatus,
GrantedAccess,
GenerateSuccessAudit,
GenerateFailureAudit);
++v47;
}
while( v47 < (unsigned int)ObjectTypeListLength );
v38 = v56;
v25 = v59;
v13 = ppResourceInfo;
goto LABEL_85;
}
if( *(int *)AccessStatus >= 0 )
{
if( (Sbz1 & 0x40) != 0 )
{
if( (*(_DWORD *)GrantedAccess & v32) != 0 )
goto LABEL_76;
v29 = count_4 == 64;
LABEL_75:
if( v29 )
{
LABEL_76:
v19 = GenerateSuccessAudit;
*GenerateSuccessAudit = 1;
LABEL_88:
v24 = v60;
LABEL_89:
v16 = GenerateFailureAudit;
break;
}
}
LABEL_87:
v19 = GenerateSuccessAudit;
goto LABEL_88;
}
if( Sbz1 >= 0 )
goto LABEL_87;
if( (v32 & DesiredAccessa) == 0 )
{
v30 = count_4 == (char)0x80;
goto LABEL_80;
}
LABEL_81:
v16 = GenerateFailureAudit;
v19 = GenerateSuccessAudit;
*GenerateFailureAudit = 1;
goto LABEL_31;
}
}
++v24;
v21 = count_4;
v25 = (_ACL *)((char *)v25 + v25->AclSize);
v20 = AccessStatus;
v14 = (_QWORD **)Token;
v17 = ResourceSacl;
v60 = v24;
v59 = v25;
if( v24 >= AceCount )
goto LABEL_91;
}
}
}
}Referenced by:
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepExamineGlobalSaclEx