SeLogAccessFailure
VOID __stdcall SeLogAccessFailure(
VOID *InputToken,
VOID *TrustLevelSid,
VOID *SecurityDescriptor,
UINT64 AccessMask,
UINT8 Permissive){
unsigned int *v5;
unsigned __int8 CurrentIrql;
const wchar_t *v7;
const wchar_t *v8;
unsigned int v9;
CHAR *LearningModeObjectInformation;
__int64 v11;
unsigned __int16 *v12;
__int64 v13;
int v14;
const WCHAR *v15;
unsigned __int16 *v16;
const WCHAR *v17;
unsigned __int64 v18;
__int64 v19;
__int64 v20;
int v21;
const WCHAR *v22;
__int64 v23;
int *v24;
unsigned int v25;
UINT8 *PoolWithTag;
__int64 v27;
int *v28;
unsigned int v29;
__int64 *v30;
__int64 v31;
__int64 v32;
unsigned __int64 v33;
int v34;
__int64 v35;
unsigned int v36;
__int64 *v37;
__int64 v38;
void *v39;
UINT8 *v40;
unsigned int v41;
unsigned int v42;
__int64 v43;
UINT8 *v44;
__int64 v45;
unsigned int v46;
__int64 v47;
__int64 v48;
unsigned __int64 v49;
unsigned int v50;
__int64 v51;
int v52;
__int64 v53;
unsigned int v54;
__int64 v55;
unsigned int v56;
__int16 v57;
__int64 v58;
unsigned __int8 *v59;
__int64 v60;
unsigned int v61;
int v62;
__int64 v63;
unsigned __int8 *v64;
__int64 v65;
unsigned int v66;
int v67;
__int64 v68;
INT64 v69;
unsigned int v70;
__int64 v71;
int v72;
PVOID v73;
__int64 v74;
__int64 v75;
__int64 v76;
__int64 v77;
unsigned int v78;
__int64 v79;
INT64 v80;
unsigned int v81;
__int64 v82;
int v83;
PVOID v84;
__int64 v85;
__int64 v86;
__int64 v87;
UINT64 UserDataCount;
char v89;
char v90;
char v91[2];
__int16 v92[2];
UINT8 EffectiveOnly[2];
_WORD v94[2];
_WORD v95[2];
int v96;
unsigned int v97;
_TOKEN_TYPE TokenType;
_SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
int v100;
UINT64 v101;
PVOID v102;
PVOID v103;
int v104;
unsigned int v105;
PVOID v106;
CHAR *v107;
UINT64 v108;
PVOID P;
EVENT_DATA_DESCRIPTOR UserData;
const WCHAR *v111;
int v112;
int v113;
const WCHAR *v114;
int v115;
int v116;
const WCHAR *v117;
int v118;
int v119;
const WCHAR *v120;
__int64 v121;
char *v122;
__int64 v123;
_TOKEN_TYPE *p_TokenType;
__int64 v125;
_SECURITY_IMPERSONATION_LEVEL *p_ImpersonationLevel;
__int64 v127;
unsigned int *v128;
__int64 v129;
int *v130;
__int64 v131;
int *v132;
__int64 v133;
__int64 v134;
unsigned int v135;
int v136;
char v137;
char v138;
char v139;
char v140;
v103 = 0i64;
v5 = (unsigned int *)InputToken;
v97 = 0;
v90 = 0;
EffectiveOnly[0] = 0;
v106 = 0i64;
v94[0] = 0;
v101 = 0i64;
v102 = 0i64;
v95[0] = 0;
v91[0] = 0;
ImpersonationLevel = SecurityAnonymous;
TokenType = 0;
v96 = 0;
v89 = 0;
v92[0] = 0;
v108 = AccessMask;
v100 = 1;
CurrentIrql = KeGetCurrentIrql();
if( !byte_140C5424C || CurrentIrql >= 2u || !EtwKernelProvRegHandle )
return;
if( InputToken )
{
TokenType = *((_DWORD *)InputToken + 48);
ImpersonationLevel = *((_DWORD *)InputToken + 49);
}
else
{
v5 = (unsigned int *)PsReferenceEffectiveToken(
(_ETHREAD *)KeGetCurrentThread(),
&TokenType,
EffectiveOnly,
&ImpersonationLevel,
0i64);
if( !v5 )
return;
v90 = 1;
}
if( v139 )
{
v7 = L"Permissive";
v8 = L"Adminless Permissive";
v9 = v140 != 0 ? 42 : 22;
}
else
{
v7 = L"Normal";
v8 = L"Adminless";
v9 = v140 != 0 ? 20 : 14;
}
UserData.Size = v9;
UserData.Reserved = 0;
if( !v140 )
v8 = v7;
UserData.Ptr = (unsigned __int64)v8;
LearningModeObjectInformation = SepGetLearningModeObjectInformation((BYTE *)v91);
v107 = LearningModeObjectInformation;
v11 = (__int64)LearningModeObjectInformation;
if( LearningModeObjectInformation
&& (v12 = (unsigned __int16 *)*((_QWORD *)LearningModeObjectInformation + 2)) != 0i64 )
{
v13 = *v12;
v14 = v13 + 2;
if( v13 + 2 >= (unsigned __int64)v12[1] )
v14 = v12[1];
v15 = (const WCHAR *)*((_QWORD *)v12 + 1);
}
else
{
v14 = 2;
v15 = &ppszDestEnd;
}
v111 = v15;
v112 = v14;
v113 = 0;
if( v11 && (v16 = *(unsigned __int16 **)(v11 + 24)) != 0i64 )
{
if( *(_QWORD *)(v11 + 32) && (v17 = *(const WCHAR **)(v11 + 48)) != 0i64 )
{
LODWORD(v18) = *(unsigned __int16 *)(v11 + 42);
}
else
{
v19 = *v16;
v18 = v16[1];
if( v19 + 2 < v18 )
LODWORD(v18) = v19 + 2;
v17 = (const WCHAR *)*((_QWORD *)v16 + 1);
}
}
else
{
LODWORD(v18) = 2;
v17 = &ppszDestEnd;
}
v116 = 0;
v114 = v17;
v115 = v18;
v20 = *(_QWORD *)(*((_QWORD *)KeGetCurrentThread() + 23) + 1472i64);
if( v20 )
{
v21 = *(unsigned __int16 *)(v20 + 2);
v22 = *(const WCHAR **)(v20 + 8);
}
else
{
v21 = 2;
v22 = &ppszDestEnd;
}
v117 = v22;
v118 = v21;
v122 = &v138;
p_TokenType = &TokenType;
p_ImpersonationLevel = &ImpersonationLevel;
v128 = v5 + 30;
v119 = 0;
v120 = &ppszDestEnd;
v121 = 2i64;
v123 = 4i64;
v125 = 4i64;
v127 = 4i64;
v129 = 4i64;
v23 = *((_QWORD *)v5 + 135);
if( v23 )
v24 = (int *)(v23 + 40);
else
v24 = &v96;
v130 = v24;
v131 = 4i64;
v104 = 1;
v25 = 4 * *(unsigned __int8 *)(**((_QWORD **)v5 + 19) + 1i64) + 12;
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v25, 0x69536553ui64);
P = PoolWithTag;
v27 = (__int64)PoolWithTag;
if( PoolWithTag )
{
*(_DWORD *)PoolWithTag = *(_DWORD *)(*((_QWORD *)v5 + 19) + 8i64);
memmove(PoolWithTag + 4, **((UINT8 ***)v5 + 19), 4i64 * *(unsigned __int8 *)(**((_QWORD **)v5 + 19) + 1i64) + 8);
v134 = v27;
v28 = &v104;
v29 = 13;
v135 = v25;
v30 = (__int64 *)&v137;
v136 = 0;
}
else
{
v28 = &v96;
v29 = 12;
v30 = &v134;
}
v133 = 4i64;
v132 = v28;
v31 = *((_QWORD *)v5 + 98);
v30[1] = 4i64;
if( v31 )
{
*v30 = (__int64)&v100;
v32 = 2i64 * v29;
v33 = *((_QWORD *)v5 + 98);
++v29;
v34 = *(unsigned __int8 *)(v33 + 1);
*(&UserData.Ptr + v32) = v33;
*(&UserData.Reserved + 2 * v32) = 0;
*(&UserData.Size + 2 * v32) = 4 * v34 + 8;
}
else
{
*v30 = (__int64)&v96;
}
if( v5[200] )
{
v35 = v5[200];
v36 = 0;
v37 = (__int64 *)*((_QWORD *)v5 + 99);
do
{
v38 = *v37;
v37 += 2;
v36 += 4 * *(unsigned __int8 *)(v38 + 1) + 12;
--v35;
}
while( v35 );
v39 = ExAllocatePoolWithTag(PagedPool, v36, 0x69536553ui64);
v103 = v39;
v40 = (UINT8 *)v39;
if( v39 )
{
v41 = v5[200];
v105 = 0;
v97 = v41;
if( v41 )
{
v42 = v105;
do
{
v43 = 2i64 * v42;
*(_DWORD *)v40 = *(_DWORD *)(*((_QWORD *)v5 + 99) + 16i64 * v42 + 8);
v44 = *(UINT8 **)(*((_QWORD *)v5 + 99) + 16i64 * v42);
memmove(v40 + 4, v44, 4i64 * v44[1] + 8);
++v42;
v41 = v97;
v40 += 4 * *(unsigned __int8 *)(*(_QWORD *)(*((_QWORD *)v5 + 99) + 8 * v43) + 1i64) + 12;
}
while( v42 < v97 );
v11 = (__int64)v107;
v40 = (UINT8 *)v103;
}
else
{
v40 = (UINT8 *)v39;
}
}
else
{
v41 = v97;
}
v45 = 2i64 * v29;
v46 = v29 + 1;
*(&UserData.Reserved + 2 * v45) = 0;
*(&UserData.Ptr + v45) = (unsigned __int64)&v97;
*(&UserData.Size + 2 * v45) = 4;
if( v41 )
{
v47 = 2i64 * v46;
*(&UserData.Ptr + v47) = (unsigned __int64)v40;
*(&UserData.Reserved + 2 * v47) = 0;
++v46;
*(&UserData.Size + 2 * v47) = v36;
}
}
else
{
v48 = 2i64 * v29;
v46 = v29 + 1;
*(&UserData.Ptr + v48) = (unsigned __int64)&v96;
*((_QWORD *)&UserData.Size + v48) = 4i64;
}
v49 = v108;
v50 = v46 + 1;
*((_QWORD *)&UserData.Size + 2 * v46) = 4i64;
if( v49 )
{
*(&UserData.Ptr + 2 * v46) = (unsigned __int64)&v100;
v51 = 2i64 * v50;
v50 = v46 + 2;
v52 = 4 * *(unsigned __int8 *)(v49 + 1) + 8;
*(&UserData.Ptr + v51) = v49;
*(&UserData.Size + 2 * v51) = v52;
*(&UserData.Reserved + 2 * v51) = 0;
}
else
{
*(&UserData.Ptr + 2 * v46) = (unsigned __int64)&v96;
}
v53 = v50;
v54 = v50 + 1;
v53 *= 2i64;
v55 = 2i64 * v54;
v56 = v54 + 1;
*(&UserData.Ptr + v53) = Permissive;
*((_QWORD *)&UserData.Size + v53) = 1i64;
v57 = *(_WORD *)(Permissive + 2i64);
*(&UserData.Ptr + v55) = Permissive + 2i64;
*((_QWORD *)&UserData.Size + v55) = 2i64;
if( v57 >= 0 )
{
v59 = *(unsigned __int8 **)(Permissive + 8i64);
LABEL_61:
if( v59 )
goto LABEL_63;
goto LABEL_62;
}
v58 = *(unsigned int *)(Permissive + 4i64);
if( (_DWORD)v58 )
{
v59 = (unsigned __int8 *)(Permissive + v58);
goto LABEL_61;
}
LABEL_62:
v59 = (unsigned __int8 *)SeNullSid;
LABEL_63:
v60 = v56;
v61 = v56 + 1;
v60 *= 2i64;
v62 = 4 * v59[1] + 8;
*(&UserData.Ptr + v60) = (unsigned __int64)v59;
*(&UserData.Size + 2 * v60) = v62;
*(&UserData.Reserved + 2 * v60) = 0;
if( v57 >= 0 )
{
v64 = *(unsigned __int8 **)(Permissive + 8i64);
LABEL_67:
if( v64 )
goto LABEL_69;
goto LABEL_68;
}
v63 = *(unsigned int *)(Permissive + 4i64);
if( (_DWORD)v63 )
{
v64 = (unsigned __int8 *)(Permissive + v63);
goto LABEL_67;
}
LABEL_68:
v64 = (unsigned __int8 *)SeNullSid;
LABEL_69:
v65 = 2i64 * v61;
v66 = v61 + 1;
v67 = 4 * v64[1] + 8;
*(&UserData.Ptr + v65) = (unsigned __int64)v64;
*(&UserData.Size + 2 * v65) = v67;
*(&UserData.Reserved + 2 * v65) = 0;
if( (v57 & 4) == 0 )
{
LABEL_73:
v69 = 0i64;
goto LABEL_75;
}
if( v57 < 0 )
{
v68 = *(unsigned int *)(Permissive + 16i64);
if( (_DWORD)v68 )
{
v69 = Permissive + v68;
goto LABEL_75;
}
goto LABEL_73;
}
v69 = *(_QWORD *)(Permissive + 32i64);
LABEL_75:
v70 = v66 + 1;
v71 = 2i64 * v66;
if( v69 )
{
v72 = SepFlattenAcl(v69, (CHAR **)&v106, &v101, v94);
*((_QWORD *)&UserData.Size + v71) = 1i64;
v73 = v106;
if( v72 < 0 )
{
*(&UserData.Ptr + v71) = (unsigned __int64)&v89;
v76 = 2i64 * v70;
*(&UserData.Ptr + v76) = (unsigned __int64)v92;
*((_QWORD *)&UserData.Size + v76) = 2i64;
}
else
{
*(&UserData.Ptr + v71) = v69;
v74 = v70++;
v74 *= 2i64;
*(&UserData.Ptr + v74) = (unsigned __int64)v94;
*((_QWORD *)&UserData.Size + v74) = 2i64;
LODWORD(v74) = v101;
v75 = 2i64 * v70;
*(&UserData.Ptr + v75) = (unsigned __int64)v73;
*(&UserData.Size + 2 * v75) = v74;
*(&UserData.Reserved + 2 * v75) = 0;
}
v57 = *(_WORD *)(Permissive + 2i64);
}
else
{
v73 = v106;
*(&UserData.Ptr + 2 * v66) = (unsigned __int64)&v89;
*((_QWORD *)&UserData.Size + 2 * v66) = 1i64;
v77 = 2i64 * v70;
*(&UserData.Ptr + v77) = (unsigned __int64)v92;
*((_QWORD *)&UserData.Size + v77) = 2i64;
}
v78 = v70 + 1;
if( (v57 & 0x10) == 0 )
{
LABEL_85:
v80 = 0i64;
goto LABEL_87;
}
if( v57 < 0 )
{
v79 = *(unsigned int *)(Permissive + 12i64);
if( (_DWORD)v79 )
{
v80 = Permissive + v79;
goto LABEL_87;
}
goto LABEL_85;
}
v80 = *(_QWORD *)(Permissive + 24i64);
LABEL_87:
v81 = v70 + 2;
v82 = 2i64 * v78;
if( !v80 )
{
*((_QWORD *)&UserData.Size + 2 * v78) = 1i64;
goto LABEL_91;
}
v83 = SepFlattenAcl(v80, (CHAR **)&v102, (UINT64 *)((char *)&v101 + 4), v95);
*((_QWORD *)&UserData.Size + v82) = 1i64;
if( v83 < 0 )
{
LABEL_91:
v84 = v102;
*(&UserData.Ptr + v82) = (unsigned __int64)&v89;
v87 = 2i64 * v81;
*((_QWORD *)&UserData.Size + v87) = 2i64;
*(&UserData.Ptr + v87) = (unsigned __int64)v92;
goto LABEL_92;
}
*(&UserData.Ptr + v82) = v80;
v84 = v102;
v85 = v81++;
v85 *= 2i64;
*(&UserData.Ptr + v85) = (unsigned __int64)v95;
*((_QWORD *)&UserData.Size + v85) = 2i64;
LODWORD(v85) = HIDWORD(v101);
v86 = 2i64 * v81;
*(&UserData.Ptr + v86) = (unsigned __int64)v84;
*(&UserData.Size + 2 * v86) = v85;
*(&UserData.Reserved + 2 * v86) = 0;
LABEL_92:
LODWORD(UserDataCount) = v81 + 1;
EtwWriteEx(
EtwKernelProvRegHandle,
(EVENT_DESCRIPTOR *)&AccessCheckLog,
0i64,
0i64,
0i64,
0i64,
UserDataCount,
&UserData);
if( P )
ExFreePoolWithTag(P, 0);
if( v103 )
ExFreePoolWithTag(v103, 0);
if( v73 )
ExFreePoolWithTag(v73, 0);
if( v84 )
ExFreePoolWithTag(v84, 0);
if( v90 )
HalPutDmaAdapter((PADAPTER_OBJECT)v5);
if( v91[0] )
{
ExFreePoolWithTag(*(PVOID *)(*(_QWORD *)(v11 + 16) + 8i64), 0);
ExFreePoolWithTag(*(PVOID *)(v11 + 16), 0);
ExFreePoolWithTag(*(PVOID *)(*(_QWORD *)(v11 + 24) + 8i64), 0);
ExFreePoolWithTag(*(PVOID *)(v11 + 24), 0);
ExFreePoolWithTag((PVOID)v11, 0);
}
}Referenced by:
SeAccessCheckByTypeWithAdminlessChecks
SeAccessCheckWithHintWithAdminlessChecks
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepCommonAccessCheckExWithAdminlessChecks