SeSecurityDescriptorChangedAuditAlarm
VOID __stdcall SeSecurityDescriptorChangedAuditAlarm(
VOID *Object,
UNICODE_STRING *ObjectTypeName,
VOID *HandleId,
UINT64 DesiredAccess,
UINT64 ChangedSecurityInfo,
VOID *OldSecurityDescriptorDaclOwner,
VOID *OldSecurityDescriptorAudit,
VOID *OldSecurityDescriptorAttribute,
VOID *OldSecurityDescriptorScope,
VOID *NewSecurityDescriptor){
int v10;
int v11;
char *v12;
void *PrimaryToken;
UINT8 v15;
VOID *v16;
unsigned int *v17;
__int16 v18;
__int64 v19;
char *v20;
unsigned int *v21;
char *v22;
__int16 v23;
char *v24;
char *v25;
__int16 v26;
__int64 v27;
_WORD *v28;
__int16 v29;
unsigned __int16 *v30;
unsigned __int16 *v31;
__int16 v32;
_WORD *v33;
unsigned __int16 *v34;
__int16 v35;
unsigned int v36;
int v37;
__int64 v38;
__int16 v39;
__int64 v40;
char *v41;
__int16 v42;
__int64 v43;
__int16 v44;
__int64 v45;
__int16 v46;
__int16 v47;
SIZE_T v48;
SIZE_T v49;
SIZE_T v50;
SIZE_T v51;
SIZE_T v52;
SIZE_T v53;
bool v54;
SIZE_T v55;
SIZE_T v56;
DWORD v57;
__int64 v58;
char *v59;
__int64 v60;
char *v61;
__int64 v62;
char *v63;
__int64 v64;
char *v65;
__int16 v66;
__int64 v67;
_ACL *v68;
__int16 v69;
__int64 v70;
_ACL *v71;
UNICODE_STRING *v72;
void *UserSid;
UNICODE_STRING *v74;
unsigned int v75;
PVOID OldSecurityDescriptor;
UINT64 SecurityInformation;
unsigned __int16 *v78;
char *v79;
int v80;
DWORD AuditMask;
INT64 AuditStatus;
UNICODE_STRING *ObjectTypeNamea;
unsigned int v84;
PACCESS_TOKEN Token;
PVOID P;
PVOID v87;
VOID *v88;
void *Source2;
UNICODE_STRING *v90;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
__int16 v92;
__int16 v94;
__int16 OldSecurityDescriptorDaclOwnera;
_WORD *v96;
_WORD *v97;
unsigned int *v98;
AuditMask = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v10 = 0;
P = 0i64;
v87 = 0i64;
v11 = 0;
v90 = 0i64;
v12 = 0i64;
ObjectTypeNamea = 0i64;
LODWORD(AuditStatus) = 0;
v84 = 0;
v80 = 0;
v88 = 0i64;
v92 = 0;
v78 = 0i64;
v94 = 0;
Source2 = 0i64;
OldSecurityDescriptorDaclOwnera = 0;
SeCaptureSubjectContext(&SubjectContext);
PrimaryToken = SubjectContext.PrimaryToken;
if( SubjectContext.ClientToken )
PrimaryToken = SubjectContext.ClientToken;
Token = PrimaryToken;
if( !PrimaryToken )
{
SepAuditFailed(3221225596i64);
return;
}
v15 = SepAdtAuditThisEventWithContext(0x8Dui64, 1u, 0, &SubjectContext);
if( v15 && v96 )
v11 = (unsigned __int8)OldSecurityDescriptorAttribute & 0x20;
if( ((unsigned int)OldSecurityDescriptorAudit & 0x1000000) != 0 )
{
if( SepAdtAuditThisEventWithContext(0x8Bui64, 1u, 0, &SubjectContext) )
v11 |= (unsigned __int8)OldSecurityDescriptorAttribute & 8;
if( v15 && v97 )
v11 |= (unsigned __int8)OldSecurityDescriptorAttribute & 0x40;
}
if( !HandleId || !*(_WORD *)HandleId )
{
if( !ObjectTypeName )
{
HandleId = 0i64;
goto LABEL_9;
}
LODWORD(AuditStatus) = SepQueryTypeString(ObjectTypeName, (UNICODE_STRING **)&v87);
if( (int)AuditStatus < 0 )
goto LABEL_210;
HandleId = 0i64;
if( v87 )
HandleId = v87;
}
ObjectTypeNamea = (UNICODE_STRING *)HandleId;
LABEL_9:
v16 = NewSecurityDescriptor;
if( ((unsigned int)OldSecurityDescriptorAudit & 0xFEFFFFFF) == 0 )
goto LABEL_10;
v39 = *((_WORD *)NewSecurityDescriptor + 1);
if( (v39 & 0x10) == 0 )
goto LABEL_87;
if( v39 >= 0 )
{
v41 = (char *)*((_QWORD *)NewSecurityDescriptor + 3);
goto LABEL_89;
}
v40 = *((unsigned int *)NewSecurityDescriptor + 3);
if( (_DWORD)v40 )
v41 = (char *)NewSecurityDescriptor + v40;
else
LABEL_87:
v41 = 0i64;
LABEL_89:
SeMaximumAuditMask((INT64)v41);
SeMaximumAuditMaskFromGlobalSacl(
(_UNICODE_STRING *)HandleId,
(unsigned int)OldSecurityDescriptorAudit & 0xFEFFFFFF,
Token,
(UINT64 *)&AuditMask);
if( (AuditMask & 0x80000) != 0 && v15 )
v11 |= (unsigned __int8)OldSecurityDescriptorAttribute & 0x10;
LABEL_10:
v17 = v98;
v18 = *((_WORD *)v98 + 1);
if( (v18 & 0x10) == 0 )
{
LABEL_69:
v20 = 0i64;
goto LABEL_14;
}
if( v18 < 0 )
{
v19 = v98[3];
if( (_DWORD)v19 )
{
v20 = (char *)v98 + v19;
goto LABEL_14;
}
goto LABEL_69;
}
v20 = (char *)*((_QWORD *)v98 + 3);
LABEL_14:
v79 = v20;
if( !NewSecurityDescriptor )
goto LABEL_15;
v26 = *((_WORD *)NewSecurityDescriptor + 1);
if( (v26 & 0x10) == 0 )
{
LABEL_44:
v12 = 0i64;
goto LABEL_15;
}
if( v26 < 0 )
{
v27 = *((unsigned int *)NewSecurityDescriptor + 3);
if( (_DWORD)v27 )
{
v12 = (char *)NewSecurityDescriptor + v27;
goto LABEL_15;
}
goto LABEL_44;
}
v12 = (char *)*((_QWORD *)NewSecurityDescriptor + 3);
LABEL_15:
v21 = (unsigned int *)OldSecurityDescriptorScope;
if( !OldSecurityDescriptorScope )
{
v22 = 0i64;
goto LABEL_17;
}
v42 = *((_WORD *)OldSecurityDescriptorScope + 1);
if( (v42 & 0x10) == 0 )
{
LABEL_98:
v22 = 0i64;
goto LABEL_17;
}
if( v42 < 0 )
{
v43 = *((unsigned int *)OldSecurityDescriptorScope + 3);
if( (_DWORD)v43 )
{
v22 = (char *)OldSecurityDescriptorScope + v43;
goto LABEL_17;
}
goto LABEL_98;
}
v22 = (char *)*((_QWORD *)OldSecurityDescriptorScope + 3);
LABEL_17:
if( v96 )
{
v23 = v96[1];
if( (v23 & 0x10) == 0 )
{
LABEL_19:
v24 = 0i64;
goto LABEL_20;
}
if( v23 >= 0 )
{
v24 = (char *)*((_QWORD *)v96 + 3);
}
else
{
v38 = *((unsigned int *)v96 + 3);
if( !(_DWORD)v38 )
goto LABEL_19;
v24 = (char *)v96 + v38;
}
}
else
{
v24 = 0i64;
}
LABEL_20:
if( !v97 )
{
v25 = 0i64;
goto LABEL_22;
}
v44 = v97[1];
if( (v44 & 0x10) == 0 )
{
LABEL_105:
v25 = 0i64;
goto LABEL_22;
}
if( v44 < 0 )
{
v45 = *((unsigned int *)v97 + 3);
if( (_DWORD)v45 )
{
v25 = (char *)v97 + v45;
goto LABEL_22;
}
goto LABEL_105;
}
v25 = (char *)*((_QWORD *)v97 + 3);
LABEL_22:
if( !v20 || !*((_WORD *)v20 + 2) )
{
if( v12 && *((_WORD *)v12 + 2) )
v10 = v11 & 8;
if( v22 && *((_WORD *)v22 + 2) )
v10 |= v11 & 0x10;
if( v24 && *((_WORD *)v24 + 2) )
v10 |= v11 & 0x20;
if( v25 && *((_WORD *)v25 + 2) )
{
v37 = v11 & 0x40;
LABEL_152:
v10 |= v37;
}
goto LABEL_28;
}
if( !v11 )
goto LABEL_28;
v28 = v20 + 8;
if( v12 && (v46 = *((_WORD *)v12 + 2)) != 0 )
{
v30 = (unsigned __int16 *)(v12 + 8);
v92 = v46;
v29 = v46;
}
else
{
v29 = 0;
v30 = 0i64;
}
if( v22 && *((_WORD *)v22 + 2) )
{
v80 = *((unsigned __int16 *)v22 + 2);
v88 = v22 + 8;
}
if( v24 && *((_WORD *)v24 + 2) )
{
v31 = (unsigned __int16 *)(v24 + 8);
v94 = *((_WORD *)v24 + 2);
v78 = (unsigned __int16 *)(v24 + 8);
}
else
{
v31 = 0i64;
}
if( v25 && (v47 = *((_WORD *)v25 + 2)) != 0 )
{
OldSecurityDescriptorDaclOwnera = *((_WORD *)v25 + 2);
Source2 = v25 + 8;
v32 = v47;
}
else
{
v32 = 0;
}
v33 = v88;
v34 = (unsigned __int16 *)Source2;
do
{
if( *(_BYTE *)v28 != 17 )
{
if( *(_BYTE *)v28 == 18 )
{
if( (v11 & 0x20) == 0 )
goto LABEL_56;
if( v31 && v28[1] == v31[1] )
{
v52 = v31[1];
v53 = RtlCompareMemory(v28, v31, v52);
v20 = v79;
if( v53 == v52 )
{
v35 = v94 - 1;
v29 = v92;
v32 = OldSecurityDescriptorDaclOwnera;
v54 = v94-- != 1;
v31 = (unsigned __int16 *)(((unsigned __int64)v78 + v52) & -(__int64)v54);
v78 = v31;
goto LABEL_57;
}
v31 = v78;
}
v10 |= 0x20u;
v11 &= ~0x20u;
goto LABEL_128;
}
if( *(_BYTE *)v28 == 19 )
{
if( (v11 & 0x40) == 0 )
goto LABEL_56;
if( v34 )
{
if( v28[1] == v34[1] )
{
v50 = v34[1];
v51 = RtlCompareMemory(v28, v34, v50);
v20 = v79;
if( v51 == v50 )
{
v31 = v78;
v29 = v92;
v32 = --OldSecurityDescriptorDaclOwnera;
v34 = (unsigned __int16 *)(((unsigned __int64)v34 + v50) & -(__int64)(OldSecurityDescriptorDaclOwnera != 0));
goto LABEL_56;
}
}
}
v10 |= 0x40u;
v11 &= ~0x40u;
}
else
{
if( (v11 & 8) == 0 )
goto LABEL_56;
if( v30 )
{
if( *(_BYTE *)v30 == *(_BYTE *)v28 && v28[1] == v30[1] )
{
v48 = v30[1];
v49 = RtlCompareMemory(v28, v30, v48);
v20 = v79;
if( v49 == v48 )
{
v29 = --v92;
v30 = (unsigned __int16 *)(((unsigned __int64)v30 + v48) & -(__int64)(v92 != 0));
LABEL_144:
v31 = v78;
goto LABEL_145;
}
}
}
v10 |= 8u;
v11 &= ~8u;
}
LABEL_125:
v31 = v78;
LABEL_128:
v29 = v92;
LABEL_145:
v32 = OldSecurityDescriptorDaclOwnera;
goto LABEL_56;
}
if( (v11 & 0x10) != 0 )
{
if( !v33
|| v28[1] != v33[1]
|| (v55 = (unsigned __int16)v33[1], v56 = RtlCompareMemory(v28, v33, v55), v20 = v79, v56 != v55) )
{
v29 = v92;
v10 |= 0x10u;
v11 &= ~0x10u;
goto LABEL_144;
}
v33 = (_WORD *)(((unsigned __int64)v33 + v55) & -(__int64)(--v80 != 0));
goto LABEL_125;
}
LABEL_56:
v35 = v94;
LABEL_57:
v28 = (_WORD *)((char *)v28 + (unsigned __int16)v28[1]);
v36 = *((unsigned __int16 *)v20 + 2);
++v84;
}
while( v84 < v36 && v11 );
v21 = (unsigned int *)OldSecurityDescriptorScope;
v17 = v98;
if( v29 )
v10 |= v11 & 8;
if( v35 )
v10 |= v11 & 0x20;
if( v32 )
v10 |= v11 & 0x40;
v16 = NewSecurityDescriptor;
if( v80 )
{
v37 = v11 & 0x10;
goto LABEL_152;
}
LABEL_28:
if( v21 )
{
v57 = AuditMask;
if( (AuditMask & 0x80000) != 0 )
{
if( ((unsigned __int8)OldSecurityDescriptorAttribute & 1) != 0 )
{
if( *((__int16 *)v17 + 1) >= 0 )
{
v59 = (char *)*((_QWORD *)v17 + 1);
}
else
{
v58 = v17[1];
v59 = (_DWORD)v58 ? (char *)v17 + v58 : 0i64;
}
if( *((__int16 *)v21 + 1) >= 0 )
{
v61 = (char *)*((_QWORD *)v21 + 1);
}
else
{
v60 = v21[1];
v61 = (_DWORD)v60 ? (char *)v21 + v60 : 0i64;
}
if( !SepIsSidEqual(v61, v59) )
v10 |= 1u;
}
if( ((unsigned __int8)OldSecurityDescriptorAttribute & 2) != 0 )
{
if( *((__int16 *)v17 + 1) >= 0 )
{
v63 = (char *)*((_QWORD *)v17 + 2);
}
else
{
v62 = v17[2];
v63 = (_DWORD)v62 ? (char *)v17 + v62 : 0i64;
}
if( *((__int16 *)v21 + 1) >= 0 )
{
v65 = (char *)*((_QWORD *)v21 + 2);
}
else
{
v64 = v21[2];
v65 = (_DWORD)v64 ? (char *)v21 + v64 : 0i64;
}
if( !SepIsSidEqual(v65, v63) )
v10 |= 2u;
}
}
if( (v57 & 0x40000) != 0 )
{
v66 = *((_WORD *)v17 + 1);
if( (v66 & 4) == 0 )
goto LABEL_185;
if( v66 >= 0 )
{
v68 = (_ACL *)*((_QWORD *)v17 + 4);
}
else
{
v67 = v17[4];
if( (_DWORD)v67 )
{
v68 = (_ACL *)((char *)v17 + v67);
goto LABEL_187;
}
LABEL_185:
v68 = 0i64;
}
LABEL_187:
v69 = *((_WORD *)v21 + 1);
if( (v69 & 4) == 0 )
goto LABEL_191;
if( v69 >= 0 )
{
v71 = (_ACL *)*((_QWORD *)v21 + 4);
goto LABEL_193;
}
v70 = v21[4];
if( (_DWORD)v70 )
v71 = (_ACL *)((char *)v21 + v70);
else
LABEL_191:
v71 = 0i64;
LABEL_193:
if( !SepIsAclEqual(v71, v68) )
v10 |= 4u;
}
}
if( v10 )
{
if( !ObjectTypeName )
{
v72 = v90;
LABEL_201:
UserSid = (void *)**((_QWORD **)Token + 19);
if( (v10 & 8) != 0 )
{
LODWORD(SecurityInformation) = 8;
OldSecurityDescriptor = v16;
v74 = ObjectTypeNamea;
SepAdtSecurityDescriptorChangedAuditAlarm(
&SubjectContext,
(UNICODE_STRING *)&SeSubsystemName,
ObjectTypeNamea,
v72,
(PVOID)ChangedSecurityInfo,
UserSid,
OldSecurityDescriptor,
SecurityInformation,
v17);
}
else
{
v74 = ObjectTypeNamea;
}
if( (v10 & 0x20) != 0 )
{
LODWORD(SecurityInformation) = 32;
SepAdtSecurityDescriptorChangedAuditAlarm(
&SubjectContext,
(UNICODE_STRING *)&SeSubsystemName,
v74,
v72,
(PVOID)ChangedSecurityInfo,
UserSid,
v96,
SecurityInformation,
v17);
}
if( (v10 & 0x40) != 0 )
{
LODWORD(SecurityInformation) = 64;
SepAdtSecurityDescriptorChangedAuditAlarm(
&SubjectContext,
(UNICODE_STRING *)&SeSubsystemName,
v74,
v72,
(PVOID)ChangedSecurityInfo,
UserSid,
v97,
SecurityInformation,
v17);
}
v75 = v10 & 0xFFFFFF97;
if( v75 )
{
LODWORD(SecurityInformation) = v75;
SepAdtSecurityDescriptorChangedAuditAlarm(
&SubjectContext,
(UNICODE_STRING *)&SeSubsystemName,
v74,
v72,
(PVOID)ChangedSecurityInfo,
UserSid,
v21,
SecurityInformation,
v17);
}
goto LABEL_210;
}
LODWORD(AuditStatus) = SepQueryNameString(ObjectTypeName, (_OBJECT_NAME_INFORMATION **)&P);
if( (int)AuditStatus >= 0 )
{
v72 = v90;
if( P )
v72 = (UNICODE_STRING *)P;
goto LABEL_201;
}
LABEL_210:
if( P )
ExFreePoolWithTag(P, 0);
if( v87 )
ExFreePoolWithTag(v87, 0);
}
if( (int)AuditStatus < 0 )
SepAuditFailed((unsigned int)AuditStatus);
SeReleaseSubjectContext(&SubjectContext);
}Referenced by:
NtSetSecurityObject