SeAuditFipsCryptoSelftests

VOID __stdcall SeAuditFipsCryptoSelftests(UINT8 bSuccess, UINT64 SelftestCode){
  unsigned __int64 v3; 
  void *PrimaryToken; 
  _EPROCESS *CurrentThreadProcess; 
  unsigned __int64 UniqueProcessId; 
  NTSTATUS AllocatedFullProcessImageName; 
  unsigned int v8; 
  _UNICODE_STRING *ImageName; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  SubjectContext.ClientToken = 0i64;
  v3 = (unsigned int)SelftestCode;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  ImageName = 0i64;
  AuditParameters.CategoryId = 1;
  AuditParameters.FlatSubCategoryId = 102;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[1].Length = 32;
  AuditParameters.Parameters[0].Address = (void *)**((_QWORD **)PrimaryToken + 19);
  AuditParameters.Parameters[0].Length = 4 * *((unsigned __int8 *)AuditParameters.Parameters[0].Address + 1) + 8;
  AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
  if( AllocatedFullProcessImageName >= 0 )
  {
    AuditParameters.Parameters[2].Type = SeAdtParmTypePtr;
    AuditParameters.Parameters[2].Length = 8;
    AuditParameters.Parameters[2].Data[0] = UniqueProcessId;
    v8 = ImageName->Length + 16;
    AuditParameters.Parameters[3].Type = SeAdtParmTypeFileSpec;
    AuditParameters.Parameters[3].Length = v8;
    AuditParameters.Parameters[3].Address = ImageName;
    AuditParameters.ParameterCount = 4;
    if( bSuccess )
    {
      AuditParameters.AuditId = 6417;
      AuditParameters.Type = 8;
    }
    else
    {
      AuditParameters.AuditId = 6418;
      AuditParameters.Type = 16;
      AuditParameters.Parameters[4].Type = SeAdtParmTypeHexUlong;
      AuditParameters.Parameters[4].Length = 4;
      AuditParameters.Parameters[4].Data[0] = v3;
      AuditParameters.ParameterCount = 5;
    }
    SepAdtLogAuditRecord(&AuditParameters);
  }
  SeReleaseSubjectContext(&SubjectContext);
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
  if( AllocatedFullProcessImageName < 0 )
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
}

Referenced by: