RtlValidSecurityDescriptor
UINT8 __fastcall RtlValidSecurityDescriptor(VOID *SecurityDescriptor){
__int16 v2;
__int64 v3;
__int64 v4;
__int64 v5;
ACL *v6;
__int16 v7;
char *v9;
char *v10;
__int64 v11;
ACL *v12;
if( *(_BYTE *)SecurityDescriptor != 1 )
return 0;
v2 = *((_WORD *)SecurityDescriptor + 1);
if( v2 >= 0 )
{
v9 = (char *)*((_QWORD *)SecurityDescriptor + 1);
}
else
{
v3 = *((unsigned int *)SecurityDescriptor + 1);
if( !(_DWORD)v3 )
goto LABEL_4;
v9 = (char *)SecurityDescriptor + v3;
}
if( v9 && !RtlValidSid(v9) )
return 0;
LABEL_4:
if( v2 >= 0 )
{
v10 = (char *)*((_QWORD *)SecurityDescriptor + 2);
}
else
{
v4 = *((unsigned int *)SecurityDescriptor + 2);
if( !(_DWORD)v4 )
goto LABEL_6;
v10 = (char *)SecurityDescriptor + v4;
}
if( v10 && !RtlValidSid(v10) )
return 0;
LABEL_6:
if( (v2 & 4) != 0 )
{
if( v2 >= 0 )
{
v6 = (ACL *)*((_QWORD *)SecurityDescriptor + 4);
goto LABEL_10;
}
v5 = *((unsigned int *)SecurityDescriptor + 4);
if( (_DWORD)v5 )
{
v6 = (ACL *)((char *)SecurityDescriptor + v5);
LABEL_10:
if( v6 && !RtlValidAcl(v6) )
return 0;
}
}
v7 = *((_WORD *)SecurityDescriptor + 1);
if( (v7 & 0x10) == 0 )
return 1;
if( v7 >= 0 )
{
v12 = (ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v11 = *((unsigned int *)SecurityDescriptor + 3);
if( !(_DWORD)v11 )
return 1;
v12 = (ACL *)((char *)SecurityDescriptor + v11);
}
return !v12 || RtlValidAcl(v12);
}Referenced by:
AdtpIsSDValidSelfRelative
CMFCreateSecurityDescriptor
CmGetRegKeySecurityDescriptor
DrvDbGetSecurityDescriptor
ObInsertObjectEx
ObOpenObjectByNameEx
ObpAdjustAccessMask
ObpSetObjectAuditInfo
PiAuCreateLocalSystemSecurityObject
PiAuCreateStandardSecurityObject
PiAuGetDriverDataDirectorySecurityObject
PiAuGetServiceStateSecurityObject
PiAuGetStateDirectorySecurityObject
PiDevCfgGetKeySecurityDescriptor
PnpGetEnumSecurityDescriptor
PnpGetPropertiesSecurityDescriptor
PnpOpenPropertiesKey