SepMaximumAccessCheck
VOID __stdcall SepMaximumAccessCheck(
VOID *EToken,
VOID *PrimaryToken,
_ACL *Dacl,
_ACL *Sacl,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **ResourceInfo,
VOID *PrincipalSelfSid,
UINT64 LocalTypeListLength,
_IOBJECT_TYPE_LIST *LocalTypeList,
UINT64 ObjectTypeListLength,
UINT64 RestrictionMask,
UINT8 Restricted,
UINT8 TokenIsOwner,
_SE_PACKAGE_CAPABILITY_INFO *PackageCapabilityInfo){
unsigned int v13;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pUserSecurityAttributes;
_TOKEN *v15;
int v16;
UINT8 v17;
VOID *v18;
_ACL *v19;
unsigned int v20;
VOID *v21;
unsigned __int8 AclRevision;
unsigned __int8 *v23;
__int64 v24;
char *v25;
int v26;
unsigned __int8 v27;
__int64 v28;
unsigned int v29;
unsigned __int64 v30;
int v31;
__int64 v32;
int v33;
__int64 v34;
unsigned int v35;
_SE_PACKAGE_CAPABILITY_INFO *v36;
unsigned int *p_CapabilityGrantedAccess;
_SE_PACKAGE_CAPABILITY_INFO *v38;
unsigned int *p_PackageGrantedAccess;
__int64 v40;
_IOBJECT_TYPE_LIST *v41;
int v42;
_IOBJECT_TYPE_LIST *v43;
__int64 v44;
_IOBJECT_TYPE_LIST v45;
UINT8 v46;
_IOBJECT_TYPE_LIST *v47;
unsigned __int16 AclSize;
unsigned int v49;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **v50;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *pClaimAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedUserSecurityAttributes;
int v55;
__int64 v56;
UINT64 v57;
UINT64 v58;
__int64 v59;
unsigned int v60;
int v61;
_GUID *p_AceCount;
UINT8 v63;
_IOBJECT_TYPE_LIST *v64;
unsigned int v65;
UINT8 v66;
_GUID *v67;
_IOBJECT_TYPE_LIST *v68;
UINT8 *CapabilityMatched;
_ACCESS_MASK_FIELD_TO_UPDATE GrantedAccess;
unsigned int *ConditionSize;
unsigned int v72;
INT64 Result;
unsigned int AceCount;
int v75;
__int64 v76;
__int64 v77;
UINT64 ReturnedIndex;
_ACL *v81;
char v82;
v81 = Sacl;
v13 = LocalTypeListLength;
pUserSecurityAttributes = 0i64;
v15 = (_TOKEN *)EToken;
v16 = *((_DWORD *)EToken + 50) & 0x2000;
v17 = Restricted;
v18 = PrimaryToken;
LODWORD(ReturnedIndex) = 0;
v75 = v16;
LODWORD(Result) = -1;
if( Restricted && (_DWORD)LocalTypeListLength )
{
v40 = (unsigned int)LocalTypeListLength;
v41 = LocalTypeList + 7;
do
{
*(_QWORD *)(v41 - 1) = (unsigned int)*v41;
v41 += 12;
--v40;
}
while( v40 );
}
v19 = Dacl + 1;
AceCount = Dacl->AceCount;
v20 = 0;
if( !AceCount )
goto LABEL_33;
v21 = PrincipalSelfSid;
do
{
if( (v19->Sbz1 & 8) != 0 )
goto LABEL_32;
AclRevision = v19->AclRevision;
if( v19->AclRevision )
{
switch( AclRevision )
{
case 5u:
v61 = *(_DWORD *)&v19[1].AclRevision;
p_AceCount = (_GUID *)&v19[1].AceCount;
if( (v61 & 1) == 0 )
p_AceCount = 0i64;
if( p_AceCount )
{
if( !(_DWORD)ObjectTypeListLength )
goto LABEL_114;
if( !SepSidInToken(
v15,
v21,
(char *)&v19[2 * (v61 & 1)] + ((8i64 * (v61 & 2)) | 0xC),
0,
Restricted,
TokenIsOwner) )
goto LABEL_28;
v64 = LocalTypeList;
if( AuthzBasepObjectInTypeList(
p_AceCount,
LocalTypeList,
(unsigned int)LocalTypeListLength,
&ReturnedIndex) )
{
LODWORD(CapabilityMatched) = *(_DWORD *)&v19->AceCount;
AuthzBasepAddAccessTypeList(
v64,
(unsigned int)LocalTypeListLength,
(unsigned int)ReturnedIndex,
v20,
(UINT64)CapabilityMatched,
1);
goto LABEL_28;
}
v17 = Restricted;
goto LABEL_116;
}
v17 = Restricted;
v63 = SepSidInToken(
v15,
v21,
(char *)&v19[2 * (v61 & 1)] + ((8i64 * (v61 & 2)) | 0xC),
0,
Restricted,
TokenIsOwner);
break;
case 4u:
v66 = TokenIsOwner;
if( !SepSidInToken(v15, v21, &v19[2].AceCount + 2 * HIBYTE(v19[1].AceCount), 0, v17, TokenIsOwner) )
goto LABEL_29;
v63 = SepSidInToken(v18, 0i64, &v19[1].AceCount, 0, 0, v66);
break;
case 1u:
v46 = SepSidInToken(v15, v21, &v19[1], 1u, v17, TokenIsOwner);
v13 = LocalTypeListLength;
if( !v46 )
goto LABEL_30;
v47 = LocalTypeList;
if( (_DWORD)LocalTypeListLength == 1 )
{
LocalTypeList[8] |= *(_DWORD *)&v19->AceCount & ~LocalTypeList[7];
goto LABEL_30;
}
LABEL_95:
GrantedAccess = 2;
LABEL_96:
v57 = v13;
LABEL_73:
v58 = 0i64;
LABEL_74:
LODWORD(CapabilityMatched) = *(_DWORD *)&v19->AceCount;
AuthzBasepAddAccessTypeList(v47, v57, v58, v20, (UINT64)CapabilityMatched, GrantedAccess);
goto LABEL_29;
case 6u:
if( !SepSidInToken(
v15,
v21,
(char *)&v19[2 * (*(_DWORD *)&v19[1].AclRevision & 1)]
+ ((8i64 * (*(_DWORD *)&v19[1].AclRevision & 2)) | 0xC),
1u,
v17,
TokenIsOwner) )
goto LABEL_29;
v67 = (_GUID *)&v19[1].AceCount;
pUserSecurityAttributes = 0i64;
if( (*(_DWORD *)&v19[1].AclRevision & 1) == 0 )
v67 = 0i64;
if( !v67 )
{
v13 = LocalTypeListLength;
v47 = LocalTypeList;
if( (_DWORD)LocalTypeListLength == 1 )
{
LocalTypeList[8] |= *(_DWORD *)&v19->AceCount & ~LocalTypeList[7];
goto LABEL_31;
}
goto LABEL_95;
}
if( !(_DWORD)ObjectTypeListLength )
{
v13 = LocalTypeListLength;
LocalTypeList[8] |= *(_DWORD *)&v19->AceCount & ~LocalTypeList[7];
goto LABEL_31;
}
v68 = LocalTypeList;
if( AuthzBasepObjectInTypeList(v67, LocalTypeList, (unsigned int)LocalTypeListLength, &ReturnedIndex) )
{
v58 = (unsigned int)ReturnedIndex;
v47 = v68;
v57 = (unsigned int)LocalTypeListLength;
GrantedAccess = 2;
goto LABEL_74;
}
LABEL_116:
v13 = v65;
goto LABEL_30;
case 9u:
AclSize = v19->AclSize;
v49 = 4 * v19[1].Sbz1 + 8;
if( (int)(AclSize - v49 - 8) > 0 )
{
v50 = ResourceInfo;
if( Sacl && !*ResourceInfo )
{
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
AclSize = v19->AclSize;
pUserSecurityAttributes = 0i64;
}
pClaimAttributes = v15->pClaimAttributes;
if( pClaimAttributes )
{
pRestrictedDeviceSecurityAttributes = pClaimAttributes->pRestrictedDeviceSecurityAttributes;
pDeviceSecurityAttributes = pClaimAttributes->pDeviceSecurityAttributes;
pRestrictedUserSecurityAttributes = pClaimAttributes->pRestrictedUserSecurityAttributes;
pUserSecurityAttributes = pClaimAttributes->pUserSecurityAttributes;
}
else
{
pRestrictedDeviceSecurityAttributes = 0i64;
pDeviceSecurityAttributes = 0i64;
pRestrictedUserSecurityAttributes = 0i64;
}
v55 = AclSize - v49 - 8;
v56 = v49;
v17 = Restricted;
LODWORD(ConditionSize) = v55;
AuthzBasepEvaluateAceCondition(
v15,
v15->pSecurityAttributes,
*v50,
pUserSecurityAttributes,
pRestrictedUserSecurityAttributes,
pDeviceSecurityAttributes,
pRestrictedDeviceSecurityAttributes,
(UINT8 *)&v19[1] + v56,
(UINT64)ConditionSize,
0,
Restricted,
&Result);
if( (_DWORD)Result != 1 )
goto LABEL_29;
if( !v16 && !v17 )
{
if( SepIsPackageSid(&v19[1]) )
{
LABEL_43:
v38 = PackageCapabilityInfo;
ConditionSize = &PackageCapabilityInfo[1].PackageGrantedAccess;
p_PackageGrantedAccess = &PackageCapabilityInfo->PackageGrantedAccess;
SepMatchPackage(
v15,
0xFFFFFFFFui64,
&v19[1],
*(unsigned int *)&v19->AceCount,
(UINT8 *)&PackageCapabilityInfo[1].Remaining + 1,
(UINT64 *)&PackageCapabilityInfo->PackageGrantedAccess,
(UINT8 *)&PackageCapabilityInfo[1]);
v38->Remaining &= ~*p_PackageGrantedAccess;
goto LABEL_28;
}
if( SepIsCapabilitySid(&v19[1]) )
{
LABEL_42:
v36 = PackageCapabilityInfo;
p_CapabilityGrantedAccess = &PackageCapabilityInfo->CapabilityGrantedAccess;
SepMatchCapability(
v15,
0xFFFFFFFFui64,
&v19[1],
*(unsigned int *)&v19->AceCount,
(UINT8 *)&PackageCapabilityInfo[1].Remaining + 2,
(UINT64 *)&PackageCapabilityInfo->CapabilityGrantedAccess);
v36->Remaining &= ~*p_CapabilityGrantedAccess;
goto LABEL_28;
}
}
if( !SepSidInToken(v15, v21, &v19[1], 0, v17, TokenIsOwner) )
goto LABEL_29;
v57 = (unsigned int)LocalTypeListLength;
v47 = LocalTypeList;
GrantedAccess = 1;
goto LABEL_73;
}
LABEL_114:
v17 = Restricted;
goto LABEL_32;
default:
goto LABEL_32;
}
v13 = LocalTypeListLength;
if( !v63 )
goto LABEL_30;
v47 = LocalTypeList;
if( (_DWORD)LocalTypeListLength == 1 )
{
LocalTypeList[7] |= *(_DWORD *)&v19->AceCount & ~LocalTypeList[8];
goto LABEL_30;
}
GrantedAccess = 1;
goto LABEL_96;
}
if( !v16 && !v17 )
{
if( SepIsPackageSid(&v19[1]) )
goto LABEL_43;
if( SepIsCapabilitySid(&v19[1]) )
goto LABEL_42;
}
v23 = (unsigned __int8 *)&v19[1];
v24 = 504i64;
if( !v17 )
v24 = 232i64;
v25 = &v15->TokenSource.SourceName[v24];
if( v82 && v19 != (_ACL *)-8i64 && RtlEqualSid(SeAliasAdminsSid, &v19[1]) )
goto LABEL_28;
if( v21 && RtlEqualSid(SePrincipalSelfSid, &v19[1]) )
v23 = (unsigned __int8 *)v21;
if( TokenIsOwner && RtlEqualSid(SeOwnerRightsSid, v23) )
{
LABEL_22:
v13 = LocalTypeListLength;
if( (_DWORD)LocalTypeListLength != 1 )
{
LODWORD(CapabilityMatched) = *(_DWORD *)&v19->AceCount;
AuthzBasepAddAccessTypeList(
LocalTypeList,
(unsigned int)LocalTypeListLength,
0i64,
v20,
(UINT64)CapabilityMatched,
1);
goto LABEL_28;
}
v17 = Restricted;
LocalTypeList[7] |= *(_DWORD *)&v19->AceCount & ~LocalTypeList[8];
goto LABEL_30;
}
if( !v25 || !v23 )
goto LABEL_28;
v26 = v23[1];
v27 = 0;
v28 = *(unsigned __int16 *)v23;
v76 = v28;
v29 = 4 * v26 + 8;
v72 = v29;
v30 = *(_QWORD *)&v25[8 * (v23[4 * ((unsigned __int64)(unsigned int)v28 >> 8) + 4] & 0xF) + 16] & *(_QWORD *)&v25[8 * ((unsigned __int64)v23[4 * ((unsigned __int64)(unsigned int)v28 >> 8) + 4] >> 4) + 144];
if( !v30 )
{
LABEL_27:
v35 = *(_DWORD *)v25;
if( *(_DWORD *)v25 > 0x40u )
{
v59 = *((_QWORD *)v25 + 1);
v60 = 64;
do
{
v34 = v59 + 16i64 * v60;
if( **(_WORD **)v34 == (_WORD)v28 )
{
if( !memcmp(v23, *(const VOID **)v34, v29) )
goto LABEL_19;
LOWORD(v28) = v76;
v29 = v72;
}
++v60;
}
while( v60 < v35 );
}
goto LABEL_28;
}
while( 1 )
{
LOBYTE(v31) = v30;
if( (_BYTE)v30 )
break;
LABEL_26:
v27 += 8;
v30 >>= 8;
if( !v30 )
goto LABEL_27;
}
v32 = *((_QWORD *)v25 + 1);
v77 = v32;
v33 = v27;
while( 1 )
{
HIDWORD(Result) = *((unsigned __int8 *)SidHashByteToIndexLookupTable + (unsigned __int8)v31);
v34 = v32 + 16i64 * (unsigned int)(v33 + HIDWORD(Result));
if( **(_WORD **)v34 == (_WORD)v28 )
break;
LABEL_25:
v31 = (unsigned __int8)v31 ^ (1 << SBYTE4(Result));
v33 = v27;
if( !(_BYTE)v31 )
goto LABEL_26;
}
if( memcmp(v23, *(const VOID **)v34, v29) )
{
LOWORD(v28) = v76;
v29 = v72;
v32 = v77;
goto LABEL_25;
}
LABEL_19:
if( !Restricted && v34 == *((_QWORD *)v25 + 1) && (*(_DWORD *)(v34 + 8) & 0x10) == 0
|| (*(_DWORD *)(v34 + 8) & 4) != 0 )
{
goto LABEL_22;
}
LABEL_28:
v17 = Restricted;
LABEL_29:
v13 = LocalTypeListLength;
LABEL_30:
pUserSecurityAttributes = 0i64;
LABEL_31:
Sacl = v81;
LABEL_32:
++v20;
v16 = v75;
v19 = (_ACL *)((char *)v19 + v19->AclSize);
v15 = (_TOKEN *)EToken;
v21 = PrincipalSelfSid;
v18 = PrimaryToken;
}
while( v20 < AceCount );
LABEL_33:
if( v17 && v13 )
{
v42 = ~(_DWORD)RestrictionMask;
v43 = LocalTypeList + 7;
v44 = v13;
do
{
v45 = *v43;
v43 += 12;
*(v43 - 12) = *(v43 - 13) & (v42 | v45);
--v44;
}
while( v44 );
}
}Referenced by:
SepAccessCheck