ExCpuSetResourceManagerAccessCheck
NTSTATUS __stdcall ExCpuSetResourceManagerAccessCheck(INT8 PreviousMode){
_ETHREAD *CurrentThread;
UINT64 DesiredAccess;
UINT64 v5;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
INT64 AccessStatus;
UINT64 GrantedAccess;
LODWORD(GrantedAccess) = 0;
LODWORD(AccessStatus) = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
if( !PreviousMode || SeSinglePrivilegeCheck(*(INT64 *)SeIncreaseBasePriorityPrivilege, PreviousMode) )
return 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
SeCaptureSubjectContextEx(CurrentThread, *((_EPROCESS **)CurrentThread + 23), &SubjectContext);
LODWORD(v5) = 0;
LODWORD(DesiredAccess) = 1;
SeAccessCheckWithHint(
ExpCpuSetSecurityDescriptor,
7ui64,
&SubjectContext,
0i64,
DesiredAccess,
v5,
0i64,
(GENERIC_MAPPING *)&ExpRestrictedGenericMapping,
PreviousMode,
&GrantedAccess,
&AccessStatus);
SeReleaseSubjectContext(&SubjectContext);
return AccessStatus;
}Referenced by:
ExpQuerySystemInformation
NtAcquireProcessActivityReference
NtSetInformationProcess
NtSetSystemInformation