NtOpenObjectAuditAlarm
INT64 __fastcall NtOpenObjectAuditAlarm(
_UNICODE_STRING *SubsystemName,
VOID *HandleId,
_UNICODE_STRING *ObjectTypeName,
_UNICODE_STRING *ObjectName,
VOID *SecurityDescriptor,
VOID *ClientToken,
UINT64 DesiredAccess,
UINT64 GrantedAccess,
_PRIVILEGE_SET *Privileges,
UINT8 ObjectCreation,
UINT8 AccessGranted,
UINT8 *GenerateOnClose){
_UNICODE_STRING *v12;
char v14;
int v15;
struct _DMA_ADAPTER *v16;
NTSTATUS v17;
__int64 v18;
unsigned int PrivilegeCount;
unsigned int v20;
char *v21;
unsigned int *PoolWithTag;
unsigned int *v23;
PVOID v25;
UINT8 v26;
PVOID v27;
bool v28;
unsigned int v29;
INT64 v30;
__int16 v31;
__int64 v32;
struct _ACL *v33;
__int64 v34;
struct _ACL *v35;
BOOL HandleInformation;
UINT64 v37;
__int16 GenerateAudit;
INT8 RequestorMode;
char v40;
NTSTATUS v41;
UINT16 FlatSubCategoryId;
PVOID OutputSecurityDescriptor;
PVOID Token;
PVOID v45;
PVOID P;
PVOID v47;
PVOID CapturedPrivileges;
VOID *HandleIda;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
unsigned int v51;
unsigned int v52;
size_t Size;
v12 = ObjectTypeName;
P = 0i64;
v45 = 0i64;
v47 = 0i64;
OutputSecurityDescriptor = 0i64;
CapturedPrivileges = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
GenerateAudit = 0;
HandleIda = 0i64;
FlatSubCategoryId = 0;
v14 = *((_BYTE *)KeGetCurrentThread() + 562);
RequestorMode = v14;
v40 = v14;
SeCaptureSubjectContext(&SubjectContext);
if( !SeCheckAuditPrivilege(&SubjectContext, v14) )
{
v29 = -1073741727;
LABEL_53:
SeReleaseSubjectContext(&SubjectContext);
return v29;
}
Token = 0i64;
v15 = ObReferenceObjectByHandle(ClientToken, 8u, (POBJECT_TYPE)SeTokenObjectType, v14, &Token, 0i64);
if( v15 < 0 )
{
SeReleaseSubjectContext(&SubjectContext);
if( v15 != -1073741816 )
{
v30 = (unsigned int)v15;
LABEL_49:
SepAuditFailed(v30);
}
return(unsigned int)v15;
}
v16 = (struct _DMA_ADAPTER *)Token;
if( *((_DWORD *)Token + 48) == 2 && *((int *)Token + 49) < 1 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
v29 = -1073741659;
goto LABEL_53;
}
if( !SecurityDescriptor )
{
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
v29 = -1073741703;
goto LABEL_53;
}
v17 = SeCaptureSecurityDescriptor(SecurityDescriptor, v14, PagedPool, 0, &OutputSecurityDescriptor);
v41 = v17;
if( v17 >= 0 && OutputSecurityDescriptor )
{
if( AccessGranted && Privileges )
{
if( ((unsigned __int8)Privileges & 3) != 0 )
goto LABEL_29;
v18 = 0x7FFFFFFF0000i64;
PrivilegeCount = Privileges->PrivilegeCount;
v51 = PrivilegeCount;
if( PrivilegeCount >= 0x43 )
{
v15 = -1073741811;
v41 = -1073741811;
goto LABEL_30;
}
v20 = 12 * PrivilegeCount + 8;
v52 = v20;
if( 12 * PrivilegeCount != -8 )
{
v21 = (char *)Privileges + v20;
if( (unsigned __int64)v21 > 0x7FFFFFFF0000i64 || v21 < (char *)Privileges )
MEMORY[0x7FFFFFFF0000] = 0;
}
Size = v20;
PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(PagedPool, v20, 0x72506553ui64);
v23 = PoolWithTag;
CapturedPrivileges = PoolWithTag;
if( !PoolWithTag )
{
SeReleaseSecurityDescriptor(OutputSecurityDescriptor, RequestorMode, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
v41 = -1073741670;
SepAuditFailed(3221225626i64);
return 3221225626i64;
}
memmove((UINT8 *)PoolWithTag, (UINT8 *)Privileges, Size);
*v23 = PrivilegeCount;
v14 = RequestorMode;
v12 = ObjectTypeName;
}
else
{
v18 = 0x7FFFFFFF0000i64;
}
if( !HandleId )
{
LABEL_20:
if( (unsigned __int64)GenerateOnClose < 0x7FFFFFFF0000i64 )
v18 = (__int64)GenerateOnClose;
*(_BYTE *)v18 = *(_BYTE *)v18;
v15 = SepProbeAndCaptureString_U(SubsystemName, (_UNICODE_STRING **)&P);
v41 = v15;
if( v15 >= 0 )
{
v15 = SepProbeAndCaptureString_U(v12, (_UNICODE_STRING **)&v45);
v41 = v15;
if( v15 >= 0 )
{
v15 = SepProbeAndCaptureString_U(ObjectName, (_UNICODE_STRING **)&v47);
v41 = v15;
}
}
LABEL_30:
if( v15 >= 0 )
{
LOBYTE(HandleInformation) = 0;
v25 = v45;
v26 = SepAdtAuditObjectAccessWithContext(
0i64,
(UNICODE_STRING *)v45,
AccessGranted,
AccessGranted == 0,
&SubjectContext,
HandleInformation,
&FlatSubCategoryId);
v27 = OutputSecurityDescriptor;
if( !v26 )
goto LABEL_32;
v31 = *((_WORD *)OutputSecurityDescriptor + 1);
if( (v31 & 0x10) != 0 )
{
if( v31 >= 0 )
{
v33 = (struct _ACL *)*((_QWORD *)OutputSecurityDescriptor + 3);
LABEL_70:
if( (v31 & 0x10) != 0 )
{
if( v31 >= 0 )
{
v35 = (struct _ACL *)*((_QWORD *)OutputSecurityDescriptor + 3);
LABEL_76:
SeExamineSacl(
v35,
v33,
Token,
GrantedAccess | DesiredAccess,
AccessGranted,
(PBOOLEAN)&GenerateAudit,
(PBOOLEAN)&GenerateAudit + 1);
if( GenerateAudit )
{
v27 = OutputSecurityDescriptor;
v25 = v45;
v28 = SepAdtOpenObjectAuditAlarm(
FlatSubCategoryId,
(__int64)P,
(unsigned __int64 *)((unsigned __int64)&HandleIda & -(__int64)(HandleId != 0i64)),
(unsigned __int16 *)v45,
(__int64)v47,
OutputSecurityDescriptor,
(__int64)Token,
(__int64)SubjectContext.PrimaryToken,
DesiredAccess,
GrantedAccess,
(__int64)CapturedPrivileges,
AccessGranted,
*(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1088i64),
2,
0i64,
0,
0i64,
0i64,
0i64);
LABEL_33:
if( !GenerateAudit && Privileges && AccessGranted )
{
LODWORD(v37) = DesiredAccess;
v25 = v45;
SepAdtPrivilegeObjectAuditAlarm(
(_UNICODE_STRING *)P,
(_UNICODE_STRING *)v45,
(_UNICODE_STRING *)v47,
HandleIda,
(_TOKEN *)Token,
(_TOKEN *)SubjectContext.PrimaryToken,
*(VOID **)(*((_QWORD *)KeGetCurrentThread() + 23) + 1088i64),
v37,
(_PRIVILEGE_SET *)CapturedPrivileges,
AccessGranted);
v28 = 0;
v27 = OutputSecurityDescriptor;
}
SeReleaseSecurityDescriptor(v27, v14, 0);
if( P )
ExFreePoolWithTag(P, 0);
if( v25 )
ExFreePoolWithTag(v25, 0);
if( v47 )
ExFreePoolWithTag(v47, 0);
if( CapturedPrivileges )
ExFreePoolWithTag(CapturedPrivileges, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
*GenerateOnClose = v28;
return 0i64;
}
LABEL_32:
v28 = 0;
goto LABEL_33;
}
v34 = *((unsigned int *)OutputSecurityDescriptor + 3);
if( (_DWORD)v34 )
{
v35 = (struct _ACL *)((char *)OutputSecurityDescriptor + v34);
goto LABEL_76;
}
}
v35 = 0i64;
goto LABEL_76;
}
v32 = *((unsigned int *)OutputSecurityDescriptor + 3);
if( (_DWORD)v32 )
{
v33 = (struct _ACL *)((char *)OutputSecurityDescriptor + v32);
goto LABEL_70;
}
}
v33 = 0i64;
goto LABEL_70;
}
if( P )
ExFreePoolWithTag(P, 0);
if( v45 )
ExFreePoolWithTag(v45, 0);
if( v47 )
ExFreePoolWithTag(v47, 0);
if( CapturedPrivileges )
ExFreePoolWithTag(CapturedPrivileges, 0);
SeReleaseSecurityDescriptor(OutputSecurityDescriptor, v14, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
if( v15 == -1073741670 )
{
v30 = 3221225626i64;
goto LABEL_49;
}
return(unsigned int)v15;
}
if( ((unsigned __int8)HandleId & 7) == 0 )
{
HandleIda = *(VOID **)HandleId;
goto LABEL_20;
}
LABEL_29:
ExRaiseDatatypeMisalignment();
}
HalPutDmaAdapter(v16);
SeReleaseSubjectContext(&SubjectContext);
if( v17 == -1073741670 )
SepAuditFailed(3221225626i64);
return(unsigned int)v17;
}Referenced by:
No references.