CmpCheckKeySecurityDescriptorAccess
INT64 __stdcall CmpCheckKeySecurityDescriptorAccess(PSECURITY_DESCRIPTOR SecurityDescriptor){
char v1;
_ACCESS_MASK v2;
char v3;
_ACCESS_MASK DesiredAccess;
char v5;
char v7;
_ETHREAD *CurrentThread;
_GENERIC_MAPPING *GenericMapping;
_KPROCESS *CurrentThreadProcess;
signed int v11;
_KPROCESSOR_MODE AccessMode;
unsigned int GrantedAccess;
int AccessStatus[3];
_SECURITY_SUBJECT_CONTEXT v16[5];
_AUX_ACCESS_DATA AuxData;
GrantedAccess = 0;
DesiredAccess = v2;
AccessStatus[0] = 0;
v5 = v1;
v7 = v3;
memset(v16, 0i64, sizeof(v16));
memset(&AuxData, 0i64, sizeof(AuxData));
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
GenericMapping = (_GENERIC_MAPPING *)((char *)CmKeyObjectType + 76);
CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
v11 = SeCreateAccessStateEx(
&CurrentThread->Tcb,
&CurrentThreadProcess->Pcb,
(_ACCESS_STATE *)v16,
&AuxData,
DesiredAccess,
GenericMapping);
if( v11 >= 0 )
{
if( v7 )
{
v11 = CmpSetAccessStateForBackupRestore((INT64)v16, v5, SecurityDescriptor, 0);
if( v11 < 0 )
goto LABEL_4;
if( !LODWORD(v16[0].PrimaryToken) )
{
v11 = 0;
goto LABEL_4;
}
GrantedAccess = HIDWORD(v16[0].PrimaryToken);
}
LOBYTE(AccessMode) = v5;
v11 = (unsigned __int8)SeAccessCheck(
SecurityDescriptor,
&v16[1],
0,
DesiredAccess,
0,
0i64,
(PGENERIC_MAPPING)((char *)CmKeyObjectType + 76),
AccessMode,
&GrantedAccess,
AccessStatus) == 0 ? 0xC0000022 : 0;
LABEL_4:
SepDeleteAccessState((_ACCESS_STATE *)v16);
SeReleaseSubjectContext(&v16[1]);
}
return(unsigned int)v11;
}Referenced by:
CmpCheckKcbStackAccess
CmpCheckKeyNodeStackAccess
CmpCheckSecurityCellAccess
CmpDoAccessCheckOnLayeredSubtree