RtlpAddKnownObjectAce
NTSTATUS __stdcall RtlpAddKnownObjectAce(
PACL Acl,
UINT64 AceRevision,
UINT64 AceFlags,
_ACCESS_MASK AccessMask,
_GUID *ObjectTypeGuid,
_GUID *InheritedObjectTypeGuid,
VOID *Sid,
UINT8 NewType){
int v10;
int v11;
VOID *v12;
VOID *v13;
NTSTATUS result;
unsigned int v15;
char v16;
int v17;
unsigned __int16 v18;
__int64 v19;
char *v20;
_GUID *v21;
VOID *FirstFree;
FirstFree = 0i64;
v10 = AceFlags;
v11 = AceRevision;
if( !RtlValidSid(Sid) )
return -1073741704;
if( Acl->AclRevision > 4u || v11 != 4 )
return -1073741735;
v15 = v10 & 0xFFFFFFE0;
if( (v10 & 0xFFFFFFE0) != 0 )
{
if( NewType == 7 )
v15 = v10 & 0xFFFFFF20;
if( v15 )
return -1073741811;
}
RtlValidAcl(Acl, v12, v13);
if( !v16 || !RtlFirstFreeAce(Acl, &FirstFree) )
return -1073741705;
v17 = *((unsigned __int8 *)Sid + 1);
v18 = 4 * v17 + 20;
if( ObjectTypeGuid )
v18 = 4 * v17 + 36;
v19 = ObjectTypeGuid != 0i64;
if( InheritedObjectTypeGuid )
{
LODWORD(v19) = v19 | 2;
v18 += 16;
}
v20 = (char *)FirstFree;
if( !FirstFree || (char *)FirstFree + v18 > (char *)Acl + Acl->AclSize )
return -1073741671;
*((_WORD *)FirstFree + 1) = v18;
v21 = (_GUID *)(v20 + 12);
v20[1] = v10;
*v20 = NewType;
*((_DWORD *)v20 + 1) = AccessMask;
*((_DWORD *)v20 + 2) = v19;
if( ObjectTypeGuid )
{
*v21 = *ObjectTypeGuid;
v21 = (_GUID *)(v20 + 28);
}
if( InheritedObjectTypeGuid )
*v21++ = *InheritedObjectTypeGuid;
RtlCopySid((unsigned int)(4 * v17 + 8), v21, Sid);
++Acl->AceCount;
result = 0;
Acl->AclRevision = 4;
return result;
}Referenced by:
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlAddAuditAccessObjectAce