PiDqSameUserHive
NTSTATUS __stdcall PiDqSameUserHive(
_SECURITY_SUBJECT_CONTEXT *SecurityContext1,
_SECURITY_SUBJECT_CONTEXT *SecurityContext2,
UINT8 *IsSameUser){
void *ClientToken;
void *PrimaryToken;
char Sid2[80];
char UserSid[80];
memset(UserSid, 0i64, 0x44u);
memset(Sid2, 0i64, 0x44u);
ClientToken = SecurityContext1->ClientToken;
if( !SecurityContext1->ClientToken )
ClientToken = SecurityContext1->PrimaryToken;
SeQueryUserSidToken(ClientToken, UserSid, 0x44ui64, 0i64);
PrimaryToken = SecurityContext2->ClientToken;
if( !SecurityContext2->ClientToken )
PrimaryToken = SecurityContext2->PrimaryToken;
SeQueryUserSidToken(PrimaryToken, Sid2, 0x44ui64, 0i64);
*IsSameUser = RtlEqualSid(UserSid, Sid2);
return 0;
}Referenced by:
PiDqQueryApplyObjectEvent