SeQuerySecurityAttributesToken
INT64 __fastcall SeQuerySecurityAttributesToken(
VOID *pToken,
const _UNICODE_STRING *pAttributes,
UINT64 AttributeCount,
VOID *pBuffer,
UINT64 BufferLength,
UINT64 *pReturnLength){
UINT8 v7;
const _UNICODE_STRING *v8;
_ETHREAD *CurrentThread;
UNICODE_STRING *v11;
unsigned int SecurityAttributesToken;
VOID *pBuffera;
UINT64 *v15;
v7 = AttributeCount;
v8 = pAttributes;
if( (_DWORD)BufferLength )
{
if( pBuffer )
{
LABEL_3:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
LOBYTE(pAttributes) = 1;
ExAcquireResourceSharedLite(*((PERESOURCE *)pToken + 6), (BOOL)pAttributes);
LODWORD(v15) = BufferLength;
LOBYTE(pBuffera) = 0;
SecurityAttributesToken = SepInternalQuerySecurityAttributesTokenEx(
pToken,
v11,
(UINT64)v8,
v7,
pBuffera,
(UINT64)pBuffer,
v15);
ExReleaseResourceLite(*((PERESOURCE *)pToken + 6));
KeLeaveCriticalRegion();
return SecurityAttributesToken;
}
}
else if( !pBuffer )
{
goto LABEL_3;
}
return 3221225485i64;
}Referenced by:
RtlpQueryPackageIdentityAttributes
SepVerifyDesktopAppxPackageName