CmpSetSecurityDescriptorInfo
__int64 __fastcall CmpSetSecurityDescriptorInfo(
__int64 a1,
int *a2,
void *a3,
__int64 a4,
UINT64 a5,
_GENERIC_MAPPING *GenericMapping,
__int64 a7,
__int64 a8,
PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext){
__int64 v11;
ULONG_PTR v12;
unsigned int v13;
_DWORD *v14;
__int64(__fastcall *v15)(__int64, _QWORD, int *);
_CM_KEY_NODE *v16;
__int64 v17;
INT64 v18;
ULONG_PTR *KCBCacheSecurity;
__int64 v20;
unsigned int *v21;
void *TransientPoolWithTag;
int v23;
PSECURITY_SUBJECT_CONTEXT Token;
int v25;
unsigned int v26;
__int64 v27;
_LARGE_INTEGER v28;
unsigned int v29;
__int64 v30;
unsigned int v32;
unsigned __int64 v33;
__int64 v34;
int v35;
unsigned int v36;
__int64 v37;
size_t v38;
_DWORD *v39;
NTSTATUS v40;
_UNICODE_STRING *v41;
CM_KEY_SECURITY_CACHE *v42;
_HV_GET_CELL_CONTEXT *CellAddressContext;
UINT64 PoolType;
__int64 v46;
ULONG_PTR v47;
VOID *CellAddress;
PVOID BugCheckParameter4;
VOID *ObjectsSecurityDescriptor;
PVOID CellIndex;
PSECURITY_DESCRIPTOR CurrentDescriptor;
int v53[2];
_CM_KEY_NODE *v54;
_HV_GET_CELL_CONTEXT v55;
size_t Size;
CM_KEY_SECURITY_CACHE *CachedSecurityPointer;
int v58[2];
int v59[2];
_UNICODE_STRING DestinationString[5];
PSECURITY_DESCRIPTOR NewDescriptor;
__int64 AceRemoved;
AceRemoved = a4;
NewDescriptor = a3;
ObjectsSecurityDescriptor = 0i64;
v53[1] = 0;
*(_DWORD *)&v55.BinContext._bf_0 = 0;
v53[0] = -1;
v55.Cell = -1;
v11 = *(_QWORD *)(a1 + 32);
v12 = 0;
v13 = *(_DWORD *)(a1 + 40);
v14 = 0i64;
v58[0] = -1;
v59[0] = -1;
v58[1] = 0;
v59[1] = 0;
DestinationString[0] = 0i64;
v15 = *(__int64(__fastcall **)(__int64, _QWORD, int *))(v11 + 8);
LODWORD(BugCheckParameter4) = 0;
CachedSecurityPointer = 0i64;
LOBYTE(AceRemoved) = 0;
v46 = 0i64;
CellAddress = 0i64;
CurrentDescriptor = 0i64;
LODWORD(CellIndex) = v13;
v16 = (_CM_KEY_NODE *)v15(v11, v13, v59);
v54 = v16;
if( !v16 )
return 3221225626i64;
CmpUpdateKeyNodeAccessBits((_HHIVE *)v11, v16, v13);
v17 = a7;
KCBCacheSecurity = (ULONG_PTR *)CmGetKCBCacheSecurity(a1, a7, v18);
v47 = *KCBCacheSecurity;
v20 = (*(__int64(__fastcall **)(__int64, _QWORD, int *))(v11 + 8))(v11, *KCBCacheSecurity, v53);
v21 = (unsigned int *)v20;
if( !v20
|| (TransientPoolWithTag = CmpAllocateTransientPoolWithTag(1ui64, *(unsigned int *)(v20 + 16)),
(CurrentDescriptor = TransientPoolWithTag) == 0i64) )
{
v25 = -1073741670;
goto LABEL_19;
}
memmove(TransientPoolWithTag, v21 + 5, v21[4]);
v23 = *a2;
Token = SubjectSecurityContext;
if( (v23 & 4) != 0 )
{
SeCheckForCriticalAceRemoval(
(UINT8 *)CurrentDescriptor,
(UINT8 *)NewDescriptor,
(INT64 *)SubjectSecurityContext,
&AceRemoved);
if( (_BYTE)AceRemoved )
{
v41 = CmpConstructName((_CM_KEY_CONTROL_BLOCK *)a1);
if( v41 )
{
v25 = -1073741822;
CmpFreeTransientPoolWithTag(v41, 0x624E4D43ui64);
}
else
{
RtlInitUnicodeString(DestinationString, L"");
v25 = -1073741822;
}
goto LABEL_19;
}
}
ObjectsSecurityDescriptor = CurrentDescriptor;
LODWORD(PoolType) = a5;
LODWORD(CellAddressContext) = 0;
v25 = RtlpSetSecurityObject(
0i64,
(unsigned int)*a2,
NewDescriptor,
&ObjectsSecurityDescriptor,
(UINT64)CellAddressContext,
PoolType,
GenericMapping,
Token);
if( v25 >= 0 )
{
v25 = CmpTraceSecurityChanging(a1, CurrentDescriptor, (unsigned int)*a2, NewDescriptor, ObjectsSecurityDescriptor);
if( v25 < 0 )
{
LABEL_19:
v30 = 0i64;
goto LABEL_20;
}
Size = RtlLengthSecurityDescriptorStrict(ObjectsSecurityDescriptor);
if( v17 )
v26 = 1;
else
v26 = (unsigned int)CellIndex >> 31;
v27 = a8;
v28 = *(_LARGE_INTEGER *)&KUSER_SHARED_DATA.SystemTime.LowPart;
if( v17 )
{
if( !HvMarkCellDirty((PVOID)v11, (PVOID)v47, 0) )
{
LABEL_76:
v25 = -1073741443;
LABEL_17:
v14 = CellAddress;
LABEL_18:
v12 = 0;
goto LABEL_19;
}
*(_DWORD *)(v27 + 96) = -1;
*(_QWORD *)(v27 + 88) = 0i64;
*(_DWORD *)(v27 + 68) = 9;
}
else if( !HvMarkCellDirty((PVOID)v11, (PVOID)(unsigned int)CellIndex, 0)
|| !HvMarkCellDirty((PVOID)v11, (PVOID)v47, 0) )
{
goto LABEL_76;
}
if( CmpFindMatchingDescriptorCell(
(CMHIVE *)v11,
ObjectsSecurityDescriptor,
v26,
(UINT64 *)&BugCheckParameter4,
&CachedSecurityPointer) )
{
v29 = (unsigned int)BugCheckParameter4;
if( (_DWORD)BugCheckParameter4 == v47 )
{
if( v17 )
{
++v21[3];
*(_QWORD *)(v27 + 88) = CachedSecurityPointer;
*(_DWORD *)(v27 + 96) = v29;
}
else
{
v54->LastWriteTime = v28;
*(_LARGE_INTEGER *)(a1 + 168) = v28;
}
goto LABEL_17;
}
if( !HvMarkCellDirty((PVOID)v11, (PVOID)(unsigned int)BugCheckParameter4, 0) )
goto LABEL_76;
if( v17 )
{
v42 = CachedSecurityPointer;
*(_DWORD *)(v27 + 96) = CachedSecurityPointer->Cell;
*(_QWORD *)(v27 + 88) = v42;
}
else if( v21[3] == 1
&& (!HvMarkCellDirty((PVOID)v11, (PVOID)v21[1], 0) || !HvMarkCellDirty((PVOID)v11, (PVOID)v21[2], 0)) )
{
goto LABEL_76;
}
v14 = (_DWORD *)(*(__int64(__fastcall **)(__int64, _QWORD, _HV_GET_CELL_CONTEXT *))(v11 + 8))(v11, v29, &v55);
if( !v14 )
{
if( !v17 )
KeBugCheckEx(0x51u, (PVOID)4, (PVOID)5, (PVOID)v11, (PVOID)(unsigned int)BugCheckParameter4);
v25 = -1073741670;
goto LABEL_18;
}
if( !v17 )
{
v32 = v21[3];
if( v32 == 1 )
{
(*(void(__fastcall **)(__int64, int *))(v11 + 16))(v11, v53);
v21 = 0i64;
CmpRemoveSecurityCellList((_HHIVE *)v11, v47);
HvFreeCell(v11, v47);
}
else
{
v21[3] = v32 - 1;
}
v54->Security = (unsigned int)BugCheckParameter4;
}
++v14[3];
LODWORD(v33) = v47;
}
else
{
v35 = RtlLengthSecurityDescriptorStrict(ObjectsSecurityDescriptor);
v36 = HvAllocateCell(v11, (unsigned int)(v35 + 20), v26, &CellAddress, &v55);
v33 = v36;
if( v36 == -1 )
{
v25 = -1073741670;
goto LABEL_17;
}
if( a7 )
{
v14 = CellAddress;
*((_DWORD *)CellAddress + 2) = v36;
v14[1] = v36;
}
else
{
if( !HvMarkCellDirty((PVOID)v11, (PVOID)v21[1], 0)
|| v21[3] == 1 && !HvMarkCellDirty((PVOID)v11, (PVOID)v21[2], 0) )
{
v14 = CellAddress;
v25 = -1073741443;
v12 = v33;
goto LABEL_45;
}
v37 = (*(__int64(__fastcall **)(__int64, _QWORD, int *))(v11 + 8))(v11, v21[1], v58);
v14 = CellAddress;
v46 = v37;
if( !v37 )
{
v25 = -1073741670;
v12 = v33;
v30 = 0i64;
LABEL_20:
if( ObjectsSecurityDescriptor )
ExFreePoolWithTag(ObjectsSecurityDescriptor, 0);
goto LABEL_22;
}
*((_DWORD *)CellAddress + 1) = v21[1];
v14[2] = v47;
v21[1] = v33;
*(_DWORD *)(v37 + 8) = v33;
--v21[3];
}
*(_WORD *)v14 = 27507;
v38 = Size;
v14[3] = 1;
v14[4] = v38;
memmove(v14 + 5, ObjectsSecurityDescriptor, v38);
if( (int)CmpAddSecurityCellToCache((CMHIVE *)v11, (unsigned int)v33, 0) < 0 )
{
v30 = v46;
if( !a7 )
{
++v21[3];
v21[1] = v14[1];
*(_DWORD *)(v46 + 8) = v14[2];
}
v25 = -1073741670;
v12 = v33;
goto LABEL_20;
}
if( !a7 )
{
v34 = (__int64)v54;
v54->Security = v33;
if( !v21[3] )
{
(*(void(__fastcall **)(__int64, int *))(v11 + 16))(v11, v53);
v21 = 0i64;
CmpRemoveSecurityCellList((_HHIVE *)v11, v47);
HvFreeCell(v11, v47);
}
LABEL_44:
*(_LARGE_INTEGER *)(v34 + 4) = v28;
++*(_QWORD *)(a1 + 304);
*(_LARGE_INTEGER *)(a1 + 168) = v28;
CmpAssignSecurityToKcb(a1, *(unsigned int *)(v34 + 44), 0i64, 1, 0);
v12 = 0;
LABEL_45:
v30 = v46;
goto LABEL_20;
}
LODWORD(NewDescriptor) = 0;
if( !CmpFindSecurityCellCacheIndex((CMHIVE *)v11, (unsigned int)v33, (UINT64 *)&NewDescriptor) )
KeBugCheckEx(0x51u, (PVOID)4, (PVOID)3, (PVOID)a1, (PVOID)v33);
v39 = *(_DWORD **)(*(_QWORD *)(v11 + 1880) + 16i64 * (unsigned int)NewDescriptor + 8);
*(_QWORD *)(v27 + 88) = v39;
*(_DWORD *)(v27 + 96) = *v39;
}
if( a7 )
{
v40 = CmAddLogForAction((CM_KCB_UOW *)v27);
v12 = 0;
v25 = v40;
if( v40 < 0 && v14[3]-- == 1 )
{
CmpRemoveSecurityCellList((_HHIVE *)v11, (unsigned int)v33);
HvFreeCell(v11, v33);
}
goto LABEL_45;
}
v34 = (__int64)v54;
goto LABEL_44;
}
ObjectsSecurityDescriptor = 0i64;
v30 = 0i64;
LABEL_22:
if( CurrentDescriptor )
CmSiFreeMemory((PPRIVILEGE_SET)CurrentDescriptor);
if( v12 )
HvFreeCell(v11, v12);
if( v30 )
(*(void(__fastcall **)(__int64, int *))(v11 + 16))(v11, v58);
if( v14 )
(*(void(__fastcall **)(__int64, _HV_GET_CELL_CONTEXT *))(v11 + 16))(v11, &v55);
if( v21 )
(*(void(__fastcall **)(__int64, int *))(v11 + 16))(v11, v53);
(*(void(__fastcall **)(__int64, int *))(v11 + 16))(v11, v59);
return(unsigned int)v25;
}Referenced by:
CmpSetKeySecurity