PspIsContextAdmin
UINT8 __stdcall PspIsContextAdmin(){
void *PrimaryToken;
UINT8 IsAdmin;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
memset(&SubjectContext, 0, sizeof(SubjectContext));
SeCaptureSubjectContext((INT64)&SubjectContext);
SeLockSubjectContext(&SubjectContext);
PrimaryToken = SubjectContext.PrimaryToken;
if( SubjectContext.ClientToken )
PrimaryToken = SubjectContext.ClientToken;
IsAdmin = SeTokenIsAdmin(PrimaryToken);
SeUnlockSubjectContext(&SubjectContext);
SeReleaseSubjectContext(&SubjectContext);
return IsAdmin;
}Referenced by:
NtPowerInformation
NtSetInformationJobObject
PopPowerInformationInternal