SeTokenGetNoChildProcessRestricted
VOID __stdcall SeTokenGetNoChildProcessRestricted(
PACCESS_TOKEN Token,
PBOOLEAN Enforced,
PBOOLEAN UnlessSecure,
PBOOLEAN AuditOnly){
_ETHREAD *CurrentThread;
int v9;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceSharedLite(*((_QWORD *)Token + 6), 1);
v9 = *((_DWORD *)Token + 50);
ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
KeLeaveCriticalRegionThread(KeGetCurrentThread());
*Enforced = (v9 & 0x80000) != 0;
*UnlessSecure = (v9 & 0x100000) != 0;
*AuditOnly = (v9 & 0x200000) != 0;
}Referenced by:
PspGetNoChildProcessRestrictedPolicy
SeSubProcessToken