SeCheckPrivilegedObject
UINT8 __fastcall SeCheckPrivilegedObject(_LUID a1, void *a2, unsigned int a3, INT8 a4){
UINT8 AccessGranted;
UINT8 v8;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
struct _PRIVILEGE_SET RequiredPrivileges;
RequiredPrivileges.Privilege[0].Attributes = 0;
RequiredPrivileges.Privilege[0].Luid = a1;
RequiredPrivileges.PrivilegeCount = 1;
memset(&SubjectContext, 0, sizeof(SubjectContext));
RequiredPrivileges.Control = 1;
SeCaptureSubjectContext(&SubjectContext);
AccessGranted = SePrivilegeCheck(&RequiredPrivileges, &SubjectContext, a4);
v8 = AccessGranted;
if( a4 )
SePrivilegeObjectAuditAlarm(a2, &SubjectContext, a3, &RequiredPrivileges, AccessGranted, a4);
SeReleaseSubjectContext(&SubjectContext);
return v8;
}Referenced by:
NtSetInformationJobObject
NtSetInformationProcess
NtSetInformationThread
PspAssignPrimaryToken
PspSetProcessPriorityClass