RtlpAddKnownObjectAce
INT64 __stdcall RtlpAddKnownObjectAce(
_ACL *Acl,
UINT64 AceRevision,
UINT64 AceFlags,
UINT64 AccessMask,
_GUID *ObjectTypeGuid,
_GUID *InheritedObjectTypeGuid,
PVOID Sid,
UINT8 NewType){
ACCESS_MASK v9;
int v10;
int v11;
INT64 result;
unsigned int v13;
int v14;
WORD v15;
__int64 v16;
PACE v17;
_GUID *p_AccessMask;
PACE Ace;
Ace = 0i64;
v9 = AccessMask;
v10 = AceFlags;
v11 = AceRevision;
if( !RtlValidSid(Sid) )
return 3221225592i64;
if( Acl->AclRevision > 4u || v11 != 4 )
return 3221225561i64;
v13 = v10 & 0xFFFFFFE0;
if( (v10 & 0xFFFFFFE0) != 0 )
{
if( NewType == 7 )
v13 = v10 & 0xFFFFFF20;
if( v13 )
return 3221225485i64;
}
if( !RtlValidAcl(Acl) || !RtlFirstFreeAce(Acl, (VOID **)&Ace) )
return 3221225591i64;
v14 = *((unsigned __int8 *)Sid + 1);
v15 = 4 * v14 + 20;
if( ObjectTypeGuid )
v15 = 4 * v14 + 36;
v16 = ObjectTypeGuid != 0i64;
if( InheritedObjectTypeGuid )
{
LODWORD(v16) = v16 | 2;
v15 += 16;
}
v17 = Ace;
if( !Ace || (char *)Ace + v15 > (char *)Acl + Acl->AclSize )
return 3221225625i64;
Ace->Header.AceSize = v15;
p_AccessMask = (_GUID *)&v17[1].AccessMask;
v17->Header.AceFlags = v10;
v17->Header.AceType = NewType;
v17->AccessMask = v9;
v17[1].Header = (ACE_HEADER)v16;
if( ObjectTypeGuid )
{
*p_AccessMask = *ObjectTypeGuid;
p_AccessMask = (_GUID *)&v17[3].AccessMask;
}
if( InheritedObjectTypeGuid )
*p_AccessMask++ = *InheritedObjectTypeGuid;
RtlCopySid(4 * v14 + 8, p_AccessMask, Sid);
++Acl->AceCount;
result = 0i64;
Acl->AclRevision = 4;
return result;
}Referenced by:
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlAddAuditAccessObjectAce