CmpGetSecurityDescriptorNode
NTSTATUS __stdcall CmpGetSecurityDescriptorNode(
_HHIVE *Hive,
UINT64 Cell,
_CM_KEY_NODE *Node,
PVOID SecurityDescriptor,
UINT8 Replace,
UINT64 *SecurityCell){
unsigned int v8;
unsigned int v10;
_CELL_DATA *v11;
int v13;
unsigned int v14;
VOID *v15;
UINT64 v16;
_HV_GET_CELL_CONTEXT CellAddressContext;
VOID *CellAddress;
LODWORD(v16) = 0;
CellAddress = 0i64;
CellAddressContext.Cell = -1;
*(_DWORD *)&CellAddressContext.BinContext = 0;
v8 = Cell;
if( !HvMarkCellDirty((UINT64)Hive, Cell, 0) )
return -1073741443;
CmpUpdateKeyNodeAccessBits((UINT64)Hive, (INT64)Node, v8);
if( !CmpFindMatchingDescriptorCell((__int64)Hive, SecurityDescriptor, v8 >> 31, &v16, 0i64) )
{
if( *((_BYTE *)KeGetCurrentThread() + 562)
&& (Hive[2].Storage[1].FreeDisplay[6].RealVectorSize & 0x20) != 0
&& Hive[1].Storage[0].FreeDisplay[1].RealVectorSize > 1 )
{
return -1073741790;
}
v13 = RtlLengthSecurityDescriptorStrict(SecurityDescriptor);
v10 = HvAllocateCell(Hive, (unsigned int)(v13 + 20), (HSTORAGE_TYPE)(v8 >> 31), &CellAddress, &CellAddressContext);
if( v10 == -1 )
return -1073741670;
v14 = RtlLengthSecurityDescriptorStrict(SecurityDescriptor);
v15 = CellAddress;
*(_WORD *)CellAddress = 27507;
*((_DWORD *)v15 + 3) = 1;
*((_DWORD *)v15 + 4) = v14;
memmove((UINT8 *)v15 + 20, (UINT8 *)SecurityDescriptor, v14);
Hive->ReleaseCellRoutine(Hive, &CellAddressContext);
if( CmpInsertSecurityCellList(Hive, v8, v10, Replace) )
goto LABEL_6;
HvFreeCell((UINT64)Hive, v10);
return -1073741443;
}
v10 = v16;
if( !HvMarkCellDirty((UINT64)Hive, (unsigned int)v16, 0) )
return -1073741443;
v11 = Hive->GetCellRoutine(Hive, v10, &CellAddressContext);
if( v11 )
{
++v11->u.KeyValue.Type;
Hive->ReleaseCellRoutine(Hive, &CellAddressContext);
LABEL_6:
*(_DWORD *)SecurityCell = v10;
return 0;
}
return -1073741670;
}Referenced by:
CmpAssignSecurityDescriptor
CmpCopyMergeOfLayeredKeyNode
CmpCopySaclToVirtualKey
CmpCreateChild
CmpLightWeightPrepareSetSecDescUoW