PiDqSameUserHive
INT64 __stdcall PiDqSameUserHive(
SECURITY_SUBJECT_CONTEXT *SecurityContext1,
SECURITY_SUBJECT_CONTEXT *SecurityContext2,
UINT8 *IsSameUser){
void *ClientToken;
void *PrimaryToken;
char Sid2[80];
char Sid1[80];
memset((INT64)Sid1, 0i64);
memset((INT64)Sid2, 0i64);
ClientToken = SecurityContext1->ClientToken;
if( !SecurityContext1->ClientToken )
ClientToken = SecurityContext1->PrimaryToken;
SeQueryUserSidToken(ClientToken, Sid1, 0x44ui64, 0i64);
PrimaryToken = SecurityContext2->ClientToken;
if( !SecurityContext2->ClientToken )
PrimaryToken = SecurityContext2->PrimaryToken;
SeQueryUserSidToken(PrimaryToken, Sid2, 0x44ui64, 0i64);
*IsSameUser = RtlEqualSid(Sid1, Sid2);
return 0i64;
}Referenced by:
PiDqQueryApplyObjectEvent