SepVerifyDesktopAppPolicyOverrideCaller
CHAR __fastcall SepVerifyDesktopAppPolicyOverrideCaller(VOID *pToken){
bool v2;
char PreviousMode;
_ADAPTER_OBJECT *v4;
_EPROCESS *Process;
signed __int64 Object;
signed __int64 v7;
_TOKEN_TYPE TokenType[2];
_PS_PKG_CLAIM PkgClaim;
UINT64 PackageSize;
UINT64 v12;
_UNICODE_STRING v13;
_UNICODE_STRING String1_8;
_SECURITY_IMPERSONATION_LEVEL ImpersonationLevel[4];
WCHAR PackageFullName[128];
WCHAR v17[128];
PkgClaim = 0i64;
TokenType[1] = 0;
v12 = 256i64;
PackageSize = 256i64;
v2 = 0;
LOBYTE(TokenType[0]) = 0;
v13 = 0i64;
PreviousMode = KeGetCurrentThread()->PreviousMode;
String1_8 = 0i64;
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, PreviousMode) )
return 1;
if( RtlQueryPackageClaims(pToken, PackageFullName, &PackageSize, 0i64, 0i64, 0i64, 0i64, 0i64) >= 0 )
{
v4 = (_ADAPTER_OBJECT *)PsReferenceEffectiveToken(
(_ETHREAD *)KeGetCurrentThread(),
&TokenType[1],
(UINT8 *)TokenType,
ImpersonationLevel,
0i64);
if( RtlQueryPackageClaims(v4, v17, &v12, 0i64, 0i64, 0i64, (PS_PKG_CLAIM *)&PkgClaim, 0i64) >= 0
&& (PkgClaim._bf_0 & 4) != 0 )
{
String1_8.Length = PackageSize - 2;
String1_8.MaximumLength = PackageSize - 2;
String1_8.Buffer = PackageFullName;
v13.Length = v12 - 2;
v13.MaximumLength = v12 - 2;
v13.Buffer = v17;
v2 = RtlCompareUnicodeString(&String1_8, &v13, 0) == 0;
}
if( v4 )
{
if( TokenType[1] == TokenPrimary )
{
Process = KeGetCurrentThread()->ApcState.Process;
_m_prefetchw(&Process->Token);
Object = (signed __int64)Process->Token.Object;
while( ((unsigned __int64)v4 ^ Object) < 0xF )
{
v7 = Object;
Object = _InterlockedCompareExchange64((volatile signed __int64 *)&Process->Token, Object + 1, Object);
if( v7 == Object )
return v2;
}
HalPutDmaAdapter(v4);
}
else
{
ObfDereferenceObjectWithTag(v4, 0x746C6644ui64);
}
}
}
return v2;
}Referenced by:
No references.