PiDqSameUserHive

INT64 __stdcall PiDqSameUserHive(
        SECURITY_SUBJECT_CONTEXT *SecurityContext1,
        SECURITY_SUBJECT_CONTEXT *SecurityContext2,
        UINT8 *IsSameUser){
  void *ClientToken; 
  void *PrimaryToken; 
  char Sid2[80]; 
  char Sid1[80]; 
  memset((INT64)Sid1, 0i64);
  memset((INT64)Sid2, 0i64);
  ClientToken = SecurityContext1->ClientToken;
  if( !SecurityContext1->ClientToken )
    ClientToken = SecurityContext1->PrimaryToken;
  SeQueryUserSidToken(ClientToken, Sid1, 0x44ui64, 0i64);
  PrimaryToken = SecurityContext2->ClientToken;
  if( !SecurityContext2->ClientToken )
    PrimaryToken = SecurityContext2->PrimaryToken;
  SeQueryUserSidToken(PrimaryToken, Sid2, 0x44ui64, 0i64);
  *IsSameUser = RtlEqualSid(Sid1, Sid2);
  return 0i64;
}

Referenced by:

PiDqQueryApplyObjectEvent