NtSetSecurityObject
NTSTATUS __fastcall NtSetSecurityObject(UINT64 a1, UINT64 a2, INT64 a3){
unsigned int v4;
int v5;
int v6;
int v7;
char PreviousMode;
VOID *v9;
int SecurityDescriptorInfo;
NTSTATUS v11;
_ADAPTER_OBJECT *v12;
VOID *v13;
unsigned int v14;
void *NewSecurityDescriptor;
PVOID OldSecurityDescriptorScope;
PVOID v17;
int v19;
char v20;
UINT64 v21;
POBJECT_HANDLE_INFORMATION HandleInformation;
VOID *OldSecurityDescriptorAudit;
VOID *OldSecurityDescriptorAudita;
VOID *OldSecurityDescriptorAttribute;
char SaclDefaulted[4];
char DesiredAccess[12];
PVOID v28;
VOID *OutputSecurityDescriptor;
PVOID Object;
PVOID P;
PVOID v32;
_OBJECT_HANDLE_INFORMATION OldSecurityDescriptorDaclOwner;
_SEP_GLOBAL_SACL *Match;
PACL Sacl;
unsigned int SaclPresent;
CHAR RequestorMode;
OutputSecurityDescriptor = 0i64;
v4 = a2;
memset(DesiredAccess, 0, sizeof(DesiredAccess));
OldSecurityDescriptorDaclOwner = 0i64;
v28 = 0i64;
P = 0i64;
v32 = 0i64;
if( !a3 )
return -1073741819;
v5 = a2 & 0x80;
v6 = v4 & 0x100;
if( (v4 & 0x10000) != 0 )
{
v19 = v4 | 0x1FF;
v4 = v4 & 0xFFFFFE00 | 0x17F;
if( v5 )
v4 = v19;
if( !v6 )
v4 &= ~0x100u;
}
SeSetSecurityAccessMask(v4, (UINT64 *)DesiredAccess);
v7 = *(_DWORD *)DesiredAccess;
Object = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
RequestorMode = PreviousMode;
SecurityDescriptorInfo = ObReferenceObjectByHandle(
v9,
*(unsigned int *)DesiredAccess,
0i64,
PreviousMode,
&Object,
&OldSecurityDescriptorDaclOwner);
if( SecurityDescriptorInfo < 0 )
return SecurityDescriptorInfo;
v11 = SeCaptureSecurityDescriptor(
(VOID *)a3,
PreviousMode,
PagedPool,
1u,
&OutputSecurityDescriptor,
(INT64)HandleInformation,
(INT64)OldSecurityDescriptorAudit);
v12 = (_ADAPTER_OBJECT *)Object;
SecurityDescriptorInfo = v11;
if( v11 < 0 )
{
LABEL_32:
HalPutDmaAdapter(v12);
return SecurityDescriptorInfo;
}
v13 = OutputSecurityDescriptor;
v14 = v4 & 0xFFFFFE07;
if( (v4 & 0x10000) == 0 || (*((_WORD *)OutputSecurityDescriptor + 1) & 0x10) != 0 )
v14 = v4;
if( ((v14 & 1) == 0 || *((_DWORD *)OutputSecurityDescriptor + 1))
&& ((v14 & 2) == 0 || *((_DWORD *)OutputSecurityDescriptor + 2)) )
{
if( (OldSecurityDescriptorDaclOwner.HandleAttributes & 4) == 0 )
v7 &= 0xFFF3FFFF;
if( !v7 )
goto LABEL_12;
SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(Object, 8ui64, 0i64);
if( SecurityDescriptorInfo < 0 )
{
OldSecurityDescriptorScope = v28;
NewSecurityDescriptor = *(void **)&DesiredAccess[4];
LABEL_27:
if( NewSecurityDescriptor )
ExFreePoolWithTag(NewSecurityDescriptor, 0);
if( OldSecurityDescriptorScope )
ExFreePoolWithTag(OldSecurityDescriptorScope, 0);
SeReleaseSecurityDescriptor(v13, RequestorMode, 1u);
goto LABEL_32;
}
if( (v7 & 0xFEFFFFFF) != 0 )
{
NewSecurityDescriptor = *(void **)&DesiredAccess[4];
LOBYTE(SaclPresent) = 0;
SecurityDescriptorInfo = RtlGetSaclSecurityDescriptor(
*(VOID **)&DesiredAccess[4],
(UINT8 *)&SaclPresent,
&Sacl,
(UINT8 *)SaclDefaulted);
v20 = SaclPresent;
if( !(_BYTE)SaclPresent )
{
Match = 0i64;
v20 = SepRmGlobalSaclFind(
&Match,
0i64,
(const _UNICODE_STRING *)(ObTypeIndexTable[(unsigned __int8)(ObHeaderCookie ^ LOBYTE(v12[-1].AllocationState) ^ ((unsigned __int16)((_WORD)v12 - 48) >> 8))]
+ 16),
1u) != -1073741772;
}
if( SecurityDescriptorInfo < 0 )
{
LABEL_63:
OldSecurityDescriptorScope = v28;
goto LABEL_27;
}
if( v20 )
{
v21 = ((v7 & 0x80000) != 0 ? v14 & 0x13 : 0) | 4;
if( (v7 & 0x40000) == 0 )
v21 = (v7 & 0x80000) != 0 ? v14 & 0x13 : 0;
SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, v21, 0i64);
}
else
{
v7 &= 0xFFF3FFFF;
}
}
else
{
LABEL_12:
NewSecurityDescriptor = *(void **)&DesiredAccess[4];
}
if( SecurityDescriptorInfo >= 0 )
{
if( (v14 & 0x40) != 0
&& ((POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)] != IoFileObjectType
|| (HIDWORD(v12->AdapterObject.DmaHeader.DmaOperations->FreeAdapterChannel) & 0x10) == 0) )
{
SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, 0x40ui64, 0i64);
}
OldSecurityDescriptorScope = v28;
if( SecurityDescriptorInfo < 0 )
goto LABEL_21;
SaclPresent = v14 & 0x20;
if( (v14 & 0x20) != 0
&& ((POBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)] != IoFileObjectType
|| (HIDWORD(v12->AdapterObject.DmaHeader.DmaOperations->FreeAdapterChannel) & 0x10) == 0) )
{
SecurityDescriptorInfo = ObpAllocateAndQuerySecurityDescriptorInfo(v12, 0x20ui64, 0i64);
}
if( SecurityDescriptorInfo >= 0
&& (SecurityDescriptorInfo = ObSetSecurityObjectByPointer(v12, v14, v13), SecurityDescriptorInfo >= 0)
&& (v7 || SaclPresent) )
{
v17 = P;
LODWORD(OldSecurityDescriptorAttribute) = v14;
LODWORD(OldSecurityDescriptorAudita) = v7;
SeSecurityDescriptorChangedAuditAlarm(
0i64,
(_UNICODE_STRING *)v12,
(VOID *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ LOBYTE(v12[-1].AllocationState) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v12 - 48) >> 8)]
+ 16),
0i64,
a1,
0i64,
OldSecurityDescriptorAudita,
OldSecurityDescriptorAttribute,
OldSecurityDescriptorScope,
NewSecurityDescriptor);
}
else
{
LABEL_21:
v17 = P;
}
if( v32 )
ExFreePoolWithTag(v32, 0);
if( v17 )
ExFreePoolWithTag(v17, 0);
v13 = OutputSecurityDescriptor;
goto LABEL_27;
}
goto LABEL_63;
}
SeReleaseSecurityDescriptor(OutputSecurityDescriptor, PreviousMode, 1u);
HalPutDmaAdapter((PADAPTER_OBJECT)Object);
return -1073741703;
}Referenced by:
RtlpSysVolCheckOwnerAndSecurity
RtlpSysVolTakeOwnership