NtCreateLowBoxToken
NTSTATUS __stdcall NtCreateLowBoxToken(
VOID **TokenHandle,
VOID *ExistingTokenHandle,
UINT64 DesiredAccess,
_OBJECT_ATTRIBUTES *ObjectAttributes,
VOID *PackageSid,
UINT64 CapabilityCount,
_SID_AND_ATTRIBUTES *Capabilities,
UINT64 HandleCount,
VOID **Handles){
_OBJECT_ATTRIBUTES *v9;
unsigned int v10;
char PreviousMode;
__int64 v14;
__int64 v15;
VOID **v16;
NTSTATUS result;
INT64 v18;
CHAR v19;
INT64 v20;
_BYTE *v21;
INT64 v22;
NTSTATUS appended;
unsigned int GrantedAccess;
unsigned int v25;
_SID_AND_ATTRIBUTES *v26;
int v27;
void *v28;
UINT8 *v29;
char v30;
INT64 v31;
_ETHREAD *CurrentThread;
INT64 *v33;
INT64 v34;
int v35;
_DWORD *v36;
signed __int32 v37[8];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
UINT64 *AlignedArraySize;
char v41;
char v42;
char Matcha[6];
_TOKEN *Token;
PVOID Sid;
_SID_AND_ATTRIBUTES *InputCapabilityArray;
_APPCONTAINER_SID_TYPE AppContainerSidType;
PVOID v48;
UINT64 v49;
PVOID *CapturedHandles;
PVOID Handle;
_OBJECT_HANDLE_INFORMATION v52;
CHAR *v53[4];
v9 = ObjectAttributes;
v10 = DesiredAccess;
InputCapabilityArray = 0i64;
v49 = 0x100000000i64;
CapturedHandles = 0i64;
Sid = 0i64;
v52 = 0i64;
Handle = 0i64;
Token = 0i64;
v42 = 0;
v41 = 0;
AppContainerSidType = NotAppContainerSidType;
Matcha[0] = 0;
memset(v53, 0, 24);
PreviousMode = KeGetCurrentThread()->PreviousMode;
if( PreviousMode )
{
v14 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)TokenHandle < 0x7FFFFFFF0000i64 )
v14 = (__int64)TokenHandle;
*(_QWORD *)v14 = *(_QWORD *)v14;
v15 = (unsigned int)HandleCount;
if( v15 * 8 )
{
if( ((unsigned __int8)Handles & 7) != 0 )
ExRaiseDatatypeMisalignment();
v16 = &Handles[v15];
if( (unsigned __int64)v16 > 0x7FFFFFFF0000i64 || v16 < Handles )
MEMORY[0x7FFFFFFF0000] = 0;
}
}
if( !PackageSid )
return -1073741811;
if( !(_DWORD)HandleCount )
{
if( !Handles )
goto LABEL_13;
return -1073741776;
}
if( !Handles )
return -1073741776;
LABEL_13:
v48 = 0i64;
result = ObReferenceObjectByHandle(
ExistingTokenHandle,
2ui64,
(_OBJECT_TYPE *)SeTokenObjectType,
PreviousMode,
&v48,
&v52);
if( result < 0 )
return result;
AlignedArraySize = (UINT64 *)&Sid;
LOBYTE(HandleInformation) = 1;
LOBYTE(v18) = PreviousMode;
result = SeCaptureSid(PackageSid, v18, v19, v20);
if( result < 0 )
return result;
v21 = Sid;
result = SepCheckCreateLowBox(Sid);
appended = result;
if( result < 0 )
return result;
if( *((_DWORD *)v48 + 48) != 1 && *((int *)v48 + 49) < 2 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)v48);
return -1073741659;
}
GrantedAccess = v52.GrantedAccess;
if( v10 )
GrantedAccess = v10;
if( Capabilities )
{
LODWORD(Object) = 0;
LOBYTE(v22) = PreviousMode;
appended = SeCaptureSidAndAttributesArray(
Capabilities,
(unsigned int)CapabilityCount,
v22,
0i64,
(UINT64)Object,
(POOL_TYPE)HandleInformation,
(UINT8)AlignedArraySize,
&InputCapabilityArray,
&v49);
}
if( appended < 0 )
goto LABEL_73;
appended = SepCaptureHandles((unsigned int)HandleCount, Handles, &CapturedHandles);
if( appended < 0 )
goto LABEL_73;
if( !RtlIsPackageSid(v21) )
goto LABEL_72;
if( ((v21[1] - 8) & 0xFB) != 0 )
{
appended = -1073700350;
goto LABEL_73;
}
v25 = 0;
if( (_DWORD)CapabilityCount )
{
v26 = InputCapabilityArray;
while( RtlIsCapabilitySid(v26->Sid) )
{
v27 = 0;
if( v25 )
{
v28 = v26->Sid;
while( !RtlEqualSid(v28, InputCapabilityArray[v27].Sid) )
{
if( ++v27 >= v25 )
goto LABEL_32;
}
appended = -1073741811;
goto LABEL_73;
}
LABEL_32:
++v25;
++v26;
if( v25 >= (unsigned int)CapabilityCount )
{
v9 = ObjectAttributes;
goto LABEL_34;
}
}
LABEL_72:
appended = -1073741811;
goto LABEL_73;
}
LABEL_34:
appended = RtlGetAppContainerSidType(v21, &AppContainerSidType);
if( appended < 0 )
{
LABEL_73:
v30 = v41;
goto LABEL_53;
}
if( AppContainerSidType == ChildAppContainerSidType )
{
appended = SepCheckCapabilities(v48, (unsigned int)CapabilityCount, InputCapabilityArray, v29, (UINT8 *)Matcha);
if( !Matcha[0] )
{
appended = -1073741790;
goto LABEL_73;
}
}
if( appended < 0 )
goto LABEL_73;
appended = SepDuplicateToken((_TOKEN *)v48, v9, 0, TokenPrimary, SecurityAnonymous, PreviousMode, 0, &Token);
if( appended < 0 )
goto LABEL_73;
v30 = 1;
appended = SeSetMandatoryPolicyToken(Token, (_TOKEN_MANDATORY_POLICY *)&v49 + 1);
if( appended < 0 )
goto LABEL_53;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
ExAcquireResourceExclusiveLite((UINT64)Token->TokenLock, 1, v31);
_InterlockedOr(v37, 0);
v42 = 1;
SepLocateTokenIntegrity();
if( v33 )
{
v34 = *v33;
v35 = *(unsigned __int8 *)(*v33 + 1);
if( (_BYTE)v35 )
{
LODWORD(v36) = RtlSubAuthoritySid(v34, (unsigned int)(v35 - 1));
*v36 = 4096;
}
Token->Privileges.Enabled &= 0x200800000ui64;
Token->Privileges.EnabledByDefault &= 0x200800000ui64;
Token->Privileges.Present &= 0x200800000ui64;
Token->TokenFlags &= ~0x2000u;
Token->TokenFlags |= 0x4000u;
}
else
{
appended = -1073740730;
}
v21 = Sid;
if( appended < 0 )
goto LABEL_53;
appended = SepSetTokenCapabilities(Token, Sid, InputCapabilityArray, (unsigned int)CapabilityCount);
if( appended < 0 )
goto LABEL_53;
appended = SepSetTokenLowboxNumber(Token, v21);
if( appended < 0 )
goto LABEL_53;
v53[1] = v21;
appended = SepSetTokenCachedHandles(Token, v53, HandleCount, (_XSTATE_FEATURE **)CapturedHandles);
if( appended < 0 )
goto LABEL_53;
appended = SepSetTokenPackage(Token, v21);
if( appended < 0 )
goto LABEL_53;
appended = SepAppendAceToTokenDefaultDacl(Token, v21);
if( appended < 0 )
goto LABEL_53;
Token->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
_InterlockedOr(v37, 0);
ExReleaseResourceLite(Token->TokenLock);
KeLeaveCriticalRegion();
v42 = 0;
appended = ObInsertObject(Token, 0i64, GrantedAccess, 1ui64, 0i64, &Handle);
v21 = Sid;
if( appended < 0 )
goto LABEL_52;
appended = SepAppendAceToTokenObjectAcl(Token, 0xF01FFui64, Sid);
if( appended >= 0 )
{
SepAppendAdminAceToTokenAcl(Token);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
LABEL_52:
v30 = 0;
}
LABEL_53:
if( v42 )
{
if( appended >= 0 )
Token->ModifiedId = (_LUID)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
_InterlockedOr(v37, 0);
ExReleaseResourceLite(Token->TokenLock);
KeLeaveCriticalRegion();
v21 = Sid;
}
if( appended < 0 )
{
if( v30 )
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
if( Handle )
ObCloseHandle(Handle, PreviousMode);
}
if( InputCapabilityArray )
SeReleaseLuidAndAttributesArray((_LUID_AND_ATTRIBUTES *)InputCapabilityArray, PreviousMode);
if( v21 )
SeReleaseSid(v21, PreviousMode, 1u);
HalPutDmaAdapter((PADAPTER_OBJECT)v48);
if( CapturedHandles )
ExFreePoolWithTag(CapturedHandles, 0);
if( appended >= 0 )
*TokenHandle = Handle;
return appended;
}Referenced by:
No references.