SepSetAuditInfoForObjectType
VOID __stdcall SepSetAuditInfoForObjectType(
UINT8 AceFlags,
UINT64 AccessMask,
UINT64 DesiredAccess,
_IOBJECT_TYPE_LIST *ObjectTypeList,
UINT64 ObjectTypeListLength,
UINT8 ReturnResultList,
UINT64 ObjectTypeIndex,
INT64 *AccessStatus,
UINT64 *GrantedAccess,
UINT8 *GenerateSuccessAudit,
UINT8 *GenerateFailureAudit){
char v12;
v12 = 0;
if( (DesiredAccess & 0x2000000) != 0 )
{
v12 = 0x80;
if( *((int *)AccessStatus + (unsigned int)ObjectTypeIndex) >= 0 )
v12 = 64;
}
if( (((unsigned int)DesiredAccess | *((_DWORD *)GrantedAccess + (unsigned int)ObjectTypeIndex)) & (unsigned int)AccessMask) != 0 )
{
if( (AceFlags & 0x40) != 0 && *((int *)AccessStatus + (unsigned int)ObjectTypeIndex) >= 0 )
{
*GenerateSuccessAudit = 1;
if( (_DWORD)ObjectTypeListLength )
{
HIWORD(ObjectTypeList[12 * (unsigned int)ObjectTypeIndex]) |= 1u;
if( ReturnResultList )
SepAuditTypeList(
ObjectTypeList,
(unsigned int)ObjectTypeListLength,
AccessStatus,
(unsigned int)ObjectTypeIndex,
GenerateSuccessAudit,
GenerateFailureAudit);
}
}
else if( (AceFlags & 0x80u) != 0 && *((int *)AccessStatus + (unsigned int)ObjectTypeIndex) < 0 )
{
*GenerateFailureAudit = 1;
if( (_DWORD)ObjectTypeListLength )
{
HIWORD(ObjectTypeList[12 * (unsigned int)ObjectTypeIndex]) |= 2u;
if( ReturnResultList )
SepAuditTypeList(
ObjectTypeList,
(unsigned int)ObjectTypeListLength,
AccessStatus,
(unsigned int)ObjectTypeIndex,
GenerateSuccessAudit,
GenerateFailureAudit);
}
}
}
else if( ((unsigned __int8)v12 & AceFlags) != 0 )
{
if( v12 == (char)0x80 )
{
*GenerateFailureAudit = 1;
if( (_DWORD)ObjectTypeListLength )
HIWORD(ObjectTypeList[12 * (unsigned int)ObjectTypeIndex]) |= 2u;
}
else
{
*GenerateSuccessAudit = 1;
if( (_DWORD)ObjectTypeListLength )
HIWORD(ObjectTypeList[12 * (unsigned int)ObjectTypeIndex]) |= 1u;
}
}
}Referenced by:
SepExamineSaclEx