NtCreateTokenEx
NTSTATUS __stdcall NtCreateTokenEx(
VOID **TokenHandle,
_ACCESS_MASK DesiredAccess,
_OBJECT_ATTRIBUTES *ObjectAttributes,
_TOKEN_TYPE TokenType,
_LUID *AuthenticationId,
_LARGE_INTEGER *ExpirationTime,
_TOKEN_USER *User,
_TOKEN_GROUPS *Groups,
_TOKEN_PRIVILEGES *Privileges,
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *UserAttributes,
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *DeviceAttributes,
_TOKEN_GROUPS *DeviceGroups,
_TOKEN_MANDATORY_POLICY *TokenMandatoryPolicy,
_TOKEN_OWNER *Owner,
_TOKEN_PRIMARY_GROUP *PrimaryGroup,
_TOKEN_DEFAULT_DACL *DefaultDacl,
_TOKEN_SOURCE *TokenSource){
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *v17;
char PreviousMode;
__int64 v19;
_TOKEN_TYPE v20;
NTSTATUS result;
INT64 v22;
INT64 v23;
int v24;
VOID *v25;
_LUID_AND_ATTRIBUTES **v26;
ULONG v27;
UINT64 CaptureBufferLength;
UINT64 *CaptureBufferLengtha;
POOL_TYPE ForceCapture;
INT64 ForceCapturea;
UINT8 CapturedAcl;
_ACL **CapturedAcla;
UINT64 GroupCount;
UINT64 GroupsLength;
UINT64 PrivilegeCount;
UINT64 DeviceGroupsCount;
UINT8 SecurityQosPresent;
char v39;
INT8 RequestorMode;
int v41;
UINT64 v42;
unsigned int Policy;
UINT64 v44;
ULONG v45;
_TOKEN_TYPE v46;
UINT64 AlignedArraySize;
_ACL *v48;
_LUID_AND_ATTRIBUTES *v49;
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *CapturedAttributesInfo;
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *DeviceClaims;
_LUID_AND_ATTRIBUTES *CapturedArray;
_LUID_AND_ATTRIBUTES *v53;
_LUID_AND_ATTRIBUTES *v54;
VOID *CapturedSid;
UINT64 v56;
UINT64 AlignedAclSize;
_ACCESS_MASK DesiredAccessa;
_LUID *v59;
_LARGE_INTEGER *v60;
_TOKEN_GROUPS *v61;
_TOKEN_PRIVILEGES *v62;
_TOKEN_PRIMARY_GROUP *v63;
_TOKEN_SOURCE *v64;
_LARGE_INTEGER v65;
_LUID v66;
_OBJECT_ATTRIBUTES *ObjectAttributesa;
VOID *TokenHandlea;
VOID **v69;
_SECURITY_QUALITY_OF_SERVICE CapturedSecurityQos;
_SID_AND_ATTRIBUTES *InputArray;
_TOKEN_SECURITY_ATTRIBUTES_INFORMATION *v72;
_TOKEN_MANDATORY_POLICY *v73;
_TOKEN_SOURCE v74;
v46 = TokenType;
ObjectAttributesa = ObjectAttributes;
DesiredAccessa = DesiredAccess;
v69 = TokenHandle;
v59 = AuthenticationId;
v60 = ExpirationTime;
InputArray = &User->User;
v61 = Groups;
v62 = Privileges;
v17 = DeviceAttributes;
v72 = DeviceAttributes;
v73 = TokenMandatoryPolicy;
v63 = PrimaryGroup;
v64 = TokenSource;
AlignedAclSize = 0i64;
TokenHandlea = 0i64;
SecurityQosPresent = 0;
*(_QWORD *)&CapturedSecurityQos.Length = 0i64;
*(_DWORD *)&CapturedSecurityQos.ContextTrackingMode = 0;
v66 = 0i64;
v65.QuadPart = 0i64;
CapturedArray = 0i64;
v56 = 0i64;
v45 = 0;
v53 = 0i64;
v42 = 0x100000000i64;
v54 = 0i64;
CapturedSid = 0i64;
AlignedArraySize = 0i64;
v48 = 0i64;
v74 = 0i64;
Policy = 0;
v39 = 0;
CapturedAttributesInfo = 0i64;
DeviceClaims = 0i64;
v44 = 0i64;
v49 = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
RequestorMode = PreviousMode;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateTokenPrivilege, PreviousMode) )
return -1073741727;
if( PreviousMode )
{
v19 = (__int64)v69;
if( (unsigned __int64)v69 >= 0x7FFFFFFF0000i64 )
v19 = 0x7FFFFFFF0000i64;
*(_QWORD *)v19 = *(_QWORD *)v19;
if( ((unsigned __int8)v60 & 3) != 0
|| ((unsigned __int8)v61 & 3) != 0
|| ((unsigned __int8)v62 & 3) != 0
|| ((unsigned __int8)v64 & 3) != 0
|| Owner && ((unsigned __int8)Owner & 3) != 0
|| ((unsigned __int8)v63 & 3) != 0
|| DefaultDacl && ((unsigned __int8)DefaultDacl & 3) != 0
|| ((unsigned __int8)v59 & 3) != 0
|| TokenMandatoryPolicy && ((unsigned __int8)TokenMandatoryPolicy & 3) != 0
|| DeviceGroups && ((unsigned __int8)DeviceGroups & 3) != 0
|| DeviceAttributes && ((unsigned __int8)DeviceAttributes & 3) != 0
|| UserAttributes && ((unsigned __int8)UserAttributes & 3) != 0 )
{
ExRaiseDatatypeMisalignment();
}
}
v20 = v46;
if( (unsigned int)(v46 - 1) > 1 )
return -1073741656;
result = SeCaptureSecurityQos(ObjectAttributesa, PreviousMode, &SecurityQosPresent, &CapturedSecurityQos);
if( result >= 0 )
{
if( SecurityQosPresent || v20 != TokenImpersonation )
{
v41 = 0;
v66 = *v59;
v65 = *v60;
LODWORD(CaptureBufferLength) = 0;
LOBYTE(v22) = PreviousMode;
v24 = SeCaptureSidAndAttributesArray(
InputArray,
1ui64,
v22,
0i64,
CaptureBufferLength,
ForceCapture,
CapturedAcl,
(_SID_AND_ATTRIBUTES **)&CapturedArray,
&v56);
v41 = v24;
if( v24 >= 0 )
{
v27 = v61->GroupCount;
v45 = v27;
LODWORD(CaptureBufferLengtha) = 0;
LOBYTE(v25) = PreviousMode;
v24 = SeCaptureSidAndAttributesArray(
v61->Groups,
v27,
(INT64)v25,
0i64,
(UINT64)CaptureBufferLengtha,
(POOL_TYPE)ForceCapturea,
(UINT8)CapturedAcla,
(_SID_AND_ATTRIBUTES **)&v53,
&v42);
v41 = v24;
LODWORD(v42) = (-16 * v27 + v42 + 3) & 0xFFFFFFFC;
v17 = v72;
}
if( v24 >= 0 )
{
HIDWORD(v44) = v62->PrivilegeCount;
v24 = SeCaptureLuidAndAttributesArray(v62->Privileges, HIDWORD(v44), PreviousMode, v26, CaptureBufferLengtha);
v41 = v24;
}
if( Owner && v24 >= 0 )
{
CapturedAcla = (_ACL **)&CapturedSid;
LOBYTE(ForceCapturea) = 1;
LOBYTE(v23) = PreviousMode;
v24 = SeCaptureSid(Owner->Owner, v23, (CHAR)v25, (INT64)v26);
v41 = v24;
}
if( v24 >= 0 )
{
CapturedAcla = (_ACL **)&AlignedArraySize;
LOBYTE(ForceCapturea) = 1;
LOBYTE(v23) = PreviousMode;
v24 = SeCaptureSid(v63->PrimaryGroup, v23, (CHAR)v25, (INT64)v26);
v41 = v24;
}
if( DefaultDacl && v24 >= 0 && DefaultDacl->DefaultDacl )
{
LODWORD(CaptureBufferLengtha) = 512;
LOBYTE(v23) = PreviousMode;
v24 = SeCaptureAcl(
DefaultDacl->DefaultDacl,
v23,
v25,
(INT64)v26,
(INT64)CaptureBufferLengtha,
ForceCapturea,
&v48,
&AlignedAclSize);
v41 = v24;
}
v74 = *v64;
if( DeviceGroups && v24 >= 0 )
{
LODWORD(v44) = DeviceGroups->GroupCount;
LODWORD(CaptureBufferLengtha) = 0;
LOBYTE(v25) = PreviousMode;
v24 = SeCaptureSidAndAttributesArray(
DeviceGroups->Groups,
(unsigned int)v44,
(INT64)v25,
0i64,
(UINT64)CaptureBufferLengtha,
(POOL_TYPE)ForceCapturea,
(UINT8)CapturedAcla,
(_SID_AND_ATTRIBUTES **)&v49,
(UINT64 *)((char *)&AlignedAclSize + 4));
v41 = v24;
}
if( UserAttributes && v24 >= 0 )
{
LOBYTE(v26) = PreviousMode;
v24 = SepCaptureTokenSecurityAttributesInformation(
UserAttributes,
(INT8)&v42 + 4,
1u,
(_TOKEN_SECURITY_ATTRIBUTES_INFORMATION **)v26);
v41 = v24;
}
if( v17 && v24 >= 0 )
{
LOBYTE(v26) = PreviousMode;
v24 = SepCaptureTokenSecurityAttributesInformation(
v17,
(INT8)&v42 + 4,
1u,
(_TOKEN_SECURITY_ATTRIBUTES_INFORMATION **)v26);
v41 = v24;
}
if( v73 && v24 >= 0 )
{
Policy = v73->Policy;
v39 = 1;
}
if( v24 >= 0 )
{
LODWORD(PrivilegeCount) = HIDWORD(v44);
LODWORD(DeviceGroupsCount) = v44;
LODWORD(GroupsLength) = v42;
LODWORD(GroupCount) = v45;
v24 = SepCreateTokenEx(
&TokenHandlea,
PreviousMode,
(unsigned int)DesiredAccessa,
ObjectAttributesa,
v46,
CapturedSecurityQos.ImpersonationLevel,
&v66,
&v65,
(_SID_AND_ATTRIBUTES *)CapturedArray,
GroupCount,
(_SID_AND_ATTRIBUTES *)v53,
GroupsLength,
PrivilegeCount,
v54,
CapturedSid,
(VOID *)AlignedArraySize,
v48,
&v74,
CapturedAttributesInfo,
DeviceClaims,
DeviceGroupsCount,
(_SID_AND_ATTRIBUTES *)v49,
(_TOKEN_MANDATORY_POLICY *)((unsigned __int64)&Policy & -(__int64)(v39 != 0)),
0);
}
if( CapturedArray )
SeReleaseLuidAndAttributesArray(CapturedArray, PreviousMode);
if( v53 )
SeReleaseLuidAndAttributesArray(v53, PreviousMode);
if( v54 )
SeReleaseLuidAndAttributesArray(v54, PreviousMode);
if( CapturedSid )
SeReleaseSid(CapturedSid, PreviousMode, 1u);
if( AlignedArraySize )
SeReleaseSid((VOID *)AlignedArraySize, PreviousMode, 1u);
if( v48 )
SeReleaseAcl(v48, PreviousMode);
if( v49 )
SeReleaseLuidAndAttributesArray(v49, PreviousMode);
if( CapturedAttributesInfo )
SepFreeCapturedTokenSecurityAttributesInformation(CapturedAttributesInfo);
if( DeviceClaims )
SepFreeCapturedTokenSecurityAttributesInformation(DeviceClaims);
if( v24 >= 0 )
*v69 = TokenHandlea;
return v24;
}
else
{
return -1073741659;
}
}
return result;
}Referenced by:
NtCreateToken