NtCreateTokenEx
INT64 __fastcall NtCreateTokenEx(
_QWORD *a1,
DWORD a2,
__int64 a3,
int a4,
__int64 *a5,
__int64 *a6,
void *a7,
ULONG *a8,
int *a9,
unsigned __int64 a10,
unsigned __int64 a11,
int *a12,
int *a13,
void **a14,
void **a15,
void **a16,
__int64 a17){
__int64 v17;
INT8 v18;
__int64 v19;
_TOKEN_TYPE v20;
INT64 result;
int v22;
VOID *v23;
LUID_AND_ATTRIBUTES **v24;
unsigned int v25;
int v26;
UINT64 PoolType;
UINT64 *PoolTypea;
_POOL_TYPE ForceCapture;
_POOL_TYPE ForceCapturea;
UINT8 CapturedAcl;
_ACL **CapturedAcla;
UINT64 Count;
INT64 GroupsLength;
INT64 PrivilegeCount;
UINT64 DeviceGroupsCount;
UINT8 SecurityQosPresent;
char v38;
INT8 RequestorMode;
int v40;
UINT64 v41;
int v42;
UINT64 v43;
unsigned int v44;
_TOKEN_TYPE TokenType;
UINT8 PrimaryGroup[8];
INT64 DefaultDacl;
INT64 DeviceGroups;
PVOID P;
PVOID DeviceClaims;
_SID_AND_ATTRIBUTES *User;
_SID_AND_ATTRIBUTES *CapturedArray;
INT64 Privileges;
PVOID CapturedSid;
UINT64 AlignedArraySize;
UINT64 AlignedAclSize;
UINT64 a3a;
__int64 *v58;
_LARGE_INTEGER *v59;
ULONG *v60;
int *v61;
void **v62;
__int64 v63;
_LARGE_INTEGER ExpirationTime;
INT64 AuthenticationId;
_OBJECT_ATTRIBUTES *ObjectAttributes;
_TOKEN *a1a;
_QWORD *v68;
_SECURITY_QUALITY_OF_SERVICE CapturedSecurityQos;
void *Src;
unsigned __int64 v71;
int *v72;
_TOKEN_SOURCE TokenSource;
TokenType = a4;
ObjectAttributes = (_OBJECT_ATTRIBUTES *)a3;
LODWORD(a3a) = a2;
v68 = a1;
v58 = a5;
v59 = (_LARGE_INTEGER *)a6;
Src = a7;
v60 = a8;
v61 = a9;
v17 = a11;
v71 = a11;
v72 = a13;
v62 = a15;
v63 = a17;
AlignedAclSize = 0i64;
a1a = 0i64;
SecurityQosPresent = 0;
*(_QWORD *)&CapturedSecurityQos.Length = 0i64;
*(_DWORD *)&CapturedSecurityQos.ContextTrackingMode = 0;
AuthenticationId = 0i64;
ExpirationTime.QuadPart = 0i64;
User = 0i64;
AlignedArraySize = 0i64;
v44 = 0;
CapturedArray = 0i64;
v41 = 0x100000000i64;
Privileges = 0i64;
CapturedSid = 0i64;
*(_QWORD *)PrimaryGroup = 0i64;
DefaultDacl = 0i64;
TokenSource = 0i64;
v42 = 0;
v38 = 0;
P = 0i64;
DeviceClaims = 0i64;
v43 = 0i64;
DeviceGroups = 0i64;
v18 = *((_BYTE *)KeGetCurrentThread() + 562);
RequestorMode = v18;
if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeCreateTokenPrivilege, v18) )
return 3221225569i64;
if( v18 )
{
v19 = (__int64)v68;
if( (unsigned __int64)v68 >= 0x7FFFFFFF0000i64 )
v19 = 0x7FFFFFFF0000i64;
*(_QWORD *)v19 = *(_QWORD *)v19;
if( ((unsigned __int8)v59 & 3) != 0
|| ((unsigned __int8)v60 & 3) != 0
|| ((unsigned __int8)v61 & 3) != 0
|| (v63 & 3) != 0
|| a14 && ((unsigned __int8)a14 & 3) != 0
|| ((unsigned __int8)v62 & 3) != 0
|| a16 && ((unsigned __int8)a16 & 3) != 0
|| ((unsigned __int8)v58 & 3) != 0
|| a13 && ((unsigned __int8)a13 & 3) != 0
|| a12 && ((unsigned __int8)a12 & 3) != 0
|| a11 && (a11 & 3) != 0
|| a10 && (a10 & 3) != 0 )
{
ExRaiseDatatypeMisalignment();
}
}
v20 = TokenType;
if( (unsigned int)(TokenType - 1) > 1 )
return 3221225640i64;
result = SeCaptureSecurityQos(ObjectAttributes, v18, &SecurityQosPresent, &CapturedSecurityQos);
if( (int)result >= 0 )
{
if( SecurityQosPresent || v20 != TokenImpersonation )
{
v40 = 0;
AuthenticationId = *v58;
ExpirationTime = *v59;
LODWORD(PoolType) = 0;
v22 = SeCaptureSidAndAttributesArray(
(_SID_AND_ATTRIBUTES *)Src,
1ui64,
v18,
0i64,
PoolType,
ForceCapture,
CapturedAcl,
&User,
&AlignedArraySize);
v40 = v22;
if( v22 >= 0 )
{
v25 = *v60;
v44 = v25;
LODWORD(PoolTypea) = 0;
v22 = SeCaptureSidAndAttributesArray(
(_SID_AND_ATTRIBUTES *)(v60 + 2),
v25,
v18,
0i64,
(UINT64)PoolTypea,
ForceCapturea,
(UINT8)CapturedAcla,
&CapturedArray,
&v41);
v40 = v22;
LODWORD(v41) = (-16 * v25 + v41 + 3) & 0xFFFFFFFC;
v17 = v71;
}
if( v22 >= 0 )
{
HIDWORD(v43) = *v61;
v22 = SeCaptureLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)(v61 + 1), HIDWORD(v43), v18, v24, PoolTypea);
v40 = v22;
}
if( a14 && v22 >= 0 )
{
CapturedAcla = (_ACL **)&CapturedSid;
LOBYTE(ForceCapturea) = 1;
v22 = SeCaptureSid(*a14, v18, (UINT8)v23, (PVOID *)v24);
v40 = v22;
}
if( v22 >= 0 )
{
CapturedAcla = (_ACL **)PrimaryGroup;
LOBYTE(ForceCapturea) = 1;
v22 = SeCaptureSid(*v62, v18, (UINT8)v23, (PVOID *)v24);
v40 = v22;
}
if( a16 && v22 >= 0 && *a16 )
{
v22 = SeCaptureAcl(
(_ACL *)*a16,
v18,
v23,
(UINT64)v24,
NonPagedPoolNx,
ForceCapturea,
(_ACL **)&DefaultDacl,
&AlignedAclSize);
v40 = v22;
}
TokenSource = *(_TOKEN_SOURCE *)v63;
if( a12 && v22 >= 0 )
{
LODWORD(v43) = *a12;
LODWORD(PoolTypea) = 0;
v22 = SeCaptureSidAndAttributesArray(
(_SID_AND_ATTRIBUTES *)(a12 + 2),
(unsigned int)v43,
v18,
0i64,
(UINT64)PoolTypea,
ForceCapturea,
(UINT8)CapturedAcla,
(_SID_AND_ATTRIBUTES **)&DeviceGroups,
(UINT64 *)((char *)&AlignedAclSize + 4));
v40 = v22;
}
if( a10 && v22 >= 0 )
{
v22 = SepCaptureTokenSecurityAttributesInformation(a10, (_DWORD *)&v41 + 1, 1, v18, 0, &P);
v40 = v22;
}
if( v17 && v22 >= 0 )
{
v22 = SepCaptureTokenSecurityAttributesInformation(v17, (_DWORD *)&v41 + 1, 1, v18, 0, &DeviceClaims);
v40 = v22;
}
if( v72 && v22 >= 0 )
{
v42 = *v72;
v38 = 1;
}
if( v22 >= 0 )
{
LODWORD(PrivilegeCount) = HIDWORD(v43);
LODWORD(DeviceGroupsCount) = v43;
LODWORD(GroupsLength) = v41;
LODWORD(Count) = v44;
SepCreateTokenEx(
&a1a,
v18,
(unsigned int)a3a,
ObjectAttributes,
TokenType,
CapturedSecurityQos.ImpersonationLevel,
(INT64)&AuthenticationId,
&ExpirationTime,
User,
Count,
CapturedArray,
GroupsLength,
PrivilegeCount,
Privileges,
CapturedSid,
*(UINT8 **)PrimaryGroup,
DefaultDacl,
&TokenSource,
(INT64)P,
(INT64)DeviceClaims,
DeviceGroupsCount,
DeviceGroups,
(unsigned __int64)&v42 & -(__int64)(v38 != 0),
0);
v22 = v26;
}
if( User )
SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)User, v18);
if( CapturedArray )
SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)CapturedArray, v18);
if( Privileges )
SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)Privileges, v18);
if( CapturedSid )
SeReleaseSid(CapturedSid, v18, 1u);
if( *(_QWORD *)PrimaryGroup )
SeReleaseSid(*(PVOID *)PrimaryGroup, v18, 1u);
if( DefaultDacl )
SeReleaseAcl((ACL *)DefaultDacl, v18);
if( DeviceGroups )
SeReleaseLuidAndAttributesArray((LUID_AND_ATTRIBUTES *)DeviceGroups, v18);
if( P )
SepFreeCapturedTokenSecurityAttributesInformation(P);
if( DeviceClaims )
SepFreeCapturedTokenSecurityAttributesInformation(DeviceClaims);
if( v22 >= 0 )
*v68 = a1a;
return(unsigned int)v22;
}
else
{
return 3221225637i64;
}
}
return result;
}Referenced by:
NtCreateToken