NtCreateLowBoxToken
INT64 __fastcall NtCreateLowBoxToken(
VOID **TokenHandle,
VOID *ExistingTokenHandle,
UINT64 DesiredAccess,
_OBJECT_ATTRIBUTES *ObjectAttributes,
VOID *PackageSid,
UINT64 CapabilityCount,
_SID_AND_ATTRIBUTES *Capabilities,
UINT64 HandleCount,
VOID **Handles){
_OBJECT_ATTRIBUTES *v9;
unsigned int v10;
KPROCESSOR_MODE v13;
__int64 v14;
__int64 v15;
VOID **v16;
INT64 result;
UINT8 v18;
PVOID *v19;
_BYTE *v20;
int AppContainerSidType;
unsigned int GrantedAccess;
unsigned int v23;
_SID_AND_ATTRIBUTES *v24;
int v25;
PVOID v26;
UINT8 *v27;
char v28;
_ETHREAD *CurrentThread;
INT64 TokenIntegrity;
void *v31;
int v32;
signed __int32 v33[8];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
UINT8 ForceCapture[8];
char v37;
char v38;
_WORD v39[7];
PSID Sid;
_SID_AND_ATTRIBUTES *InputCapabilityArray;
int v42;
PVOID Token;
UINT64 AlignedArraySize;
PVOID P;
void *Handle;
struct _OBJECT_HANDLE_INFORMATION v47;
CHAR *a2[4];
v9 = ObjectAttributes;
v10 = DesiredAccess;
InputCapabilityArray = 0i64;
AlignedArraySize = 0x100000000i64;
P = 0i64;
Sid = 0i64;
v47 = 0i64;
Handle = 0i64;
*(_QWORD *)&v39[3] = 0i64;
v38 = 0;
v37 = 0;
v42 = 0;
LOBYTE(v39[0]) = 0;
memset(a2, 0, 24);
v13 = *((_BYTE *)KeGetCurrentThread() + 562);
if( v13 )
{
v14 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)TokenHandle < 0x7FFFFFFF0000i64 )
v14 = (__int64)TokenHandle;
*(_QWORD *)v14 = *(_QWORD *)v14;
v15 = (unsigned int)HandleCount;
if( v15 * 8 )
{
if( ((unsigned __int8)Handles & 7) != 0 )
ExRaiseDatatypeMisalignment();
v16 = &Handles[v15];
if( (unsigned __int64)v16 > 0x7FFFFFFF0000i64 || v16 < Handles )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
if( !PackageSid )
return 3221225485i64;
if( !(_DWORD)HandleCount )
{
if( !Handles )
goto LABEL_13;
return 3221225520i64;
}
if( !Handles )
return 3221225520i64;
LABEL_13:
Token = 0i64;
LODWORD(result) = ObReferenceObjectByHandle(
ExistingTokenHandle,
2u,
(POBJECT_TYPE)SeTokenObjectType,
v13,
&Token,
&v47);
if( (int)result < 0 )
return result;
*(_QWORD *)ForceCapture = &Sid;
LOBYTE(HandleInformation) = 1;
LODWORD(result) = SeCaptureSid(PackageSid, v13, v18, v19);
if( (int)result < 0 )
return result;
v20 = Sid;
LODWORD(result) = SepCheckCreateLowBox(Sid);
AppContainerSidType = result;
if( (int)result < 0 )
return result;
if( *((_DWORD *)Token + 48) != 1 && *((int *)Token + 49) < 2 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
return 3221225637i64;
}
GrantedAccess = v47.GrantedAccess;
if( v10 )
GrantedAccess = v10;
if( Capabilities )
{
LODWORD(Object) = 0;
AppContainerSidType = SeCaptureSidAndAttributesArray(
Capabilities,
(unsigned int)CapabilityCount,
v13,
0i64,
(UINT64)Object,
(_POOL_TYPE)HandleInformation,
ForceCapture[0],
&InputCapabilityArray,
&AlignedArraySize);
}
if( AppContainerSidType < 0 )
goto LABEL_73;
AppContainerSidType = SepCaptureHandles((unsigned int)HandleCount, Handles, (PVOID **)&P);
if( AppContainerSidType < 0 )
goto LABEL_73;
if( !RtlIsPackageSid(v20) )
goto LABEL_72;
if( ((v20[1] - 8) & 0xFB) != 0 )
{
AppContainerSidType = -1073700350;
goto LABEL_73;
}
v23 = 0;
if( (_DWORD)CapabilityCount )
{
v24 = InputCapabilityArray;
while( RtlIsCapabilitySid(v24->Sid) )
{
v25 = 0;
if( v23 )
{
v26 = v24->Sid;
while( !RtlEqualSid(v26, InputCapabilityArray[v25].Sid) )
{
if( ++v25 >= v23 )
goto LABEL_32;
}
AppContainerSidType = -1073741811;
goto LABEL_73;
}
LABEL_32:
++v23;
++v24;
if( v23 >= (unsigned int)CapabilityCount )
{
v9 = ObjectAttributes;
goto LABEL_34;
}
}
LABEL_72:
AppContainerSidType = -1073741811;
goto LABEL_73;
}
LABEL_34:
AppContainerSidType = RtlGetAppContainerSidType(v20, &v42);
if( AppContainerSidType < 0 )
{
LABEL_73:
v28 = v37;
goto LABEL_53;
}
if( v42 == 1 )
{
Object = (PVOID *)v39;
AppContainerSidType = SepCheckCapabilities(Token, (unsigned int)CapabilityCount, InputCapabilityArray, v27);
if( !LOBYTE(v39[0]) )
{
AppContainerSidType = -1073741790;
goto LABEL_73;
}
}
if( AppContainerSidType < 0 )
goto LABEL_73;
AppContainerSidType = SepDuplicateToken(
(_TOKEN *)Token,
v9,
0,
TokenPrimary,
SecurityAnonymous,
v13,
0,
(_TOKEN **)&v39[3]);
if( AppContainerSidType < 0 )
goto LABEL_73;
v28 = 1;
AppContainerSidType = SeSetMandatoryPolicyToken(*(VOID **)&v39[3], (_TOKEN_MANDATORY_POLICY *)&AlignedArraySize + 1);
if( AppContainerSidType < 0 )
goto LABEL_53;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--*((_WORD *)CurrentThread + 242);
ExAcquireResourceExclusiveLite(*(ERESOURCE **)(*(_QWORD *)&v39[3] + 48i64), 1u);
_InterlockedOr(v33, 0);
v38 = 1;
TokenIntegrity = SepLocateTokenIntegrity(*(INT64 *)&v39[3]);
if( TokenIntegrity )
{
v31 = *(void **)TokenIntegrity;
v32 = *(unsigned __int8 *)(*(_QWORD *)TokenIntegrity + 1i64);
if( (_BYTE)v32 )
*RtlSubAuthoritySid(v31, (unsigned int)(v32 - 1)) = 4096;
*(_QWORD *)(*(_QWORD *)&v39[3] + 72i64) &= 0x200800000ui64;
*(_QWORD *)(*(_QWORD *)&v39[3] + 80i64) &= 0x200800000ui64;
*(_QWORD *)(*(_QWORD *)&v39[3] + 64i64) &= 0x200800000ui64;
*(_DWORD *)(*(_QWORD *)&v39[3] + 200i64) &= ~0x2000u;
*(_DWORD *)(*(_QWORD *)&v39[3] + 200i64) |= 0x4000u;
}
else
{
AppContainerSidType = -1073740730;
}
v20 = Sid;
if( AppContainerSidType < 0 )
goto LABEL_53;
AppContainerSidType = SepSetTokenCapabilities(
*(_TOKEN **)&v39[3],
Sid,
InputCapabilityArray,
(unsigned int)CapabilityCount);
if( AppContainerSidType < 0 )
goto LABEL_53;
AppContainerSidType = SepSetTokenLowboxNumber(*(_TOKEN **)&v39[3], v20);
if( AppContainerSidType < 0 )
goto LABEL_53;
a2[1] = v20;
AppContainerSidType = SepSetTokenCachedHandles(*(_QWORD **)&v39[3], a2, (unsigned int)HandleCount, (PVOID *)P);
if( AppContainerSidType < 0 )
goto LABEL_53;
AppContainerSidType = SepSetTokenPackage(*(INT64 *)&v39[3], v20);
if( AppContainerSidType < 0 )
goto LABEL_53;
AppContainerSidType = SepAppendAceToTokenDefaultDacl(*(INT64 *)&v39[3], v20);
if( AppContainerSidType < 0 )
goto LABEL_53;
*(_QWORD *)(*(_QWORD *)&v39[3] + 56i64) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v33, 0);
ExReleaseResourceLite(*(PERESOURCE *)(*(_QWORD *)&v39[3] + 48i64));
KeLeaveCriticalRegion();
v38 = 0;
AppContainerSidType = ObInsertObject(*(PVOID *)&v39[3], 0i64, GrantedAccess, 1ui64, 0i64, &Handle);
v20 = Sid;
if( AppContainerSidType < 0 )
goto LABEL_52;
AppContainerSidType = SepAppendAceToTokenObjectAcl(*(_TOKEN **)&v39[3], 0xF01FFui64, Sid);
if( AppContainerSidType >= 0 )
{
SepAppendAdminAceToTokenAcl(*(_TOKEN **)&v39[3]);
HalPutDmaAdapter(*(PADAPTER_OBJECT *)&v39[3]);
LABEL_52:
v28 = 0;
}
LABEL_53:
if( v38 )
{
if( AppContainerSidType >= 0 )
*(_QWORD *)(*(_QWORD *)&v39[3] + 56i64) = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
_InterlockedOr(v33, 0);
ExReleaseResourceLite(*(PERESOURCE *)(*(_QWORD *)&v39[3] + 48i64));
KeLeaveCriticalRegion();
v20 = Sid;
}
if( AppContainerSidType < 0 )
{
if( v28 )
HalPutDmaAdapter(*(PADAPTER_OBJECT *)&v39[3]);
if( Handle )
ObCloseHandle(Handle, v13);
}
if( InputCapabilityArray )
SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)InputCapabilityArray, v13);
if( v20 )
SeReleaseSid(v20, v13, 1u);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
if( P )
ExFreePoolWithTag(P, 0);
if( AppContainerSidType >= 0 )
*TokenHandle = Handle;
return(unsigned int)AppContainerSidType;
}Referenced by:
No references.