SeQuerySessionIdToken
INT64 __fastcall SeQuerySessionIdToken(VOID *Token, UINT64 *SessionId){
_ETHREAD *CurrentThread;
UINT64 *v3;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = SessionId;
--*((_WORD *)CurrentThread + 242);
LOBYTE(SessionId) = 1;
ExAcquireResourceSharedLite(*((PERESOURCE *)Token + 6), (BOOL)SessionId);
*(_DWORD *)v3 = *((_DWORD *)Token + 30);
ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
KeLeaveCriticalRegion();
return 0i64;
}Referenced by:
NtQueryInformationToken
PnpGetCallerSessionId
PspAllocateProcess
SeQueryInformationToken