PopBootStatAccessCheck
INT64 __fastcall PopBootStatAccessCheck(VOID *a1, CHAR a2, UINT64 a3){
unsigned int v3;
INT64 result;
PSECURITY_DESCRIPTOR v6;
bool v7;
UINT64 PreviouslyGrantedAccess;
KPROCESSOR_MODE AccessMode;
INT64 GrantedAccess;
PADAPTER_OBJECT DmaAdapter;
PSECURITY_DESCRIPTOR SecurityDescriptor;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
BOOLEAN MemoryAllocated;
v3 = a3;
MemoryAllocated = 0;
SecurityDescriptor = 0i64;
DmaAdapter = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
LODWORD(result) = ObReferenceObjectByHandle(a1, 0, 0i64, 0, (PVOID *)&DmaAdapter, 0i64);
GrantedAccess = (unsigned int)result;
if( (int)result >= 0 )
{
LODWORD(result) = ObpGetObjectSecurity(DmaAdapter, &SecurityDescriptor, &MemoryAllocated, 0);
LODWORD(GrantedAccess) = result;
if( (int)result >= 0 )
{
SeCaptureSubjectContext(&SubjectContext);
AccessMode = a2;
v6 = SecurityDescriptor;
LODWORD(PreviouslyGrantedAccess) = 0;
v7 = SeAccessCheck(
SecurityDescriptor,
&SubjectContext,
0,
v3,
PreviouslyGrantedAccess,
0i64,
(GENERIC_MAPPING *)&IopFileMapping,
AccessMode,
(UINT64 *)((char *)&GrantedAccess + 4),
&GrantedAccess);
SeReleaseSubjectContext(&SubjectContext);
result = (unsigned int)GrantedAccess;
if( v7 )
result = 0i64;
LODWORD(GrantedAccess) = result;
if( v6 )
{
ObReleaseObjectSecurity(v6, MemoryAllocated);
result = (unsigned int)GrantedAccess;
}
}
if( DmaAdapter )
{
HalPutDmaAdapter(DmaAdapter);
return(unsigned int)GrantedAccess;
}
}
return result;
}Referenced by:
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet