SepCopyAnonymousTokenAndSetSilo
INT64 __stdcall SepCopyAnonymousTokenAndSetSilo(_EJOB *DestServerSilo, PADAPTER_OBJECT *a2){
int AnonymousToken;
_TOKEN *v5;
__int64 CurrentProcess;
unsigned int ServerSiloServiceSessionId;
UINT64 v9;
PACCESS_TOKEN Token;
INT64 result[6];
struct DMA_ADAPTER *v12;
__int64 v13[28];
Token = 0i64;
AnonymousToken = SepGetAnonymousToken(0i64, (PADAPTER_OBJECT *)&Token);
if( AnonymousToken < 0 )
goto LABEL_8;
memset((INT64)result, 0i64);
memset((INT64)v13, 0i64);
v5 = (_TOKEN *)Token;
SeCreateAccessState(
(_ACCESS_STATE *)result,
(_AUX_ACCESS_DATA *)v13,
0i64,
(_GENERIC_MAPPING *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*((char *)Token - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)Token - 48) >> 8)]
+ 76));
CurrentProcess = PsGetCurrentProcess();
ObFastDereferenceObject((INT64 *)(CurrentProcess + 1208), v12);
ObfReferenceObject(SeAnonymousLogonTokenNoEveryone);
LODWORD(v9) = 0;
v12 = (struct DMA_ADAPTER *)SeAnonymousLogonTokenNoEveryone;
AnonymousToken = ObInsertObjectEx(v5, (ACCESS_STATE *)result, 0i64, 0i64, v9, 0i64, 0i64);
SeDeleteAccessState((_ACCESS_STATE *)result);
if( AnonymousToken < 0 )
goto LABEL_8;
SepAppendAceToTokenObjectAcl(v5, 8ui64, SeAliasAdminsSid);
*a2 = (PADAPTER_OBJECT)v5;
ServerSiloServiceSessionId = PsGetServerSiloServiceSessionId(DestServerSilo);
if( ServerSiloServiceSessionId != -1 )
AnonymousToken = SeSetSessionIdToken(v5, ServerSiloServiceSessionId);
if( AnonymousToken < 0 || (AnonymousToken = SepSetServerSiloToken(*a2, DestServerSilo), AnonymousToken < 0) )
{
HalPutDmaAdapter(*a2);
LABEL_8:
*a2 = 0i64;
}
return(unsigned int)AnonymousToken;
}Referenced by:
NtImpersonateAnonymousToken