SepFilterToken
INT64 __fastcall SepFilterToken(
_TOKEN *ExistingToken,
UINT64 RequestorMode,
UINT64 Flags,
UINT64 GroupCount,
_SID_AND_ATTRIBUTES *GroupsToDisable,
UINT64 PrivilegeCount,
_LUID_AND_ATTRIBUTES *PrivilegesToDelete,
UINT64 SidCount,
_SID_AND_ATTRIBUTES *RestrictedSids,
UINT64 SidLength,
_TOKEN **FilteredToken){
char v11;
_DMA_OPERATIONS *v13;
unsigned int v14;
_SID_AND_ATTRIBUTES *v15;
_DMA_OPERATIONS *PoolWithTag;
_DMA_OPERATIONS *v17;
_DMA_OPERATIONS *v18;
struct _ERESOURCE *v20;
int v21;
__int64 v22;
struct _ERESOURCE *v23;
PADAPTER_OBJECT v24;
PADAPTER_OBJECT v25;
PADAPTER_OBJECT v26;
ULONG v27;
_TOKEN_SOURCE TokenSource;
unsigned int v29;
BOOL v30;
_DWORD *v31;
unsigned int v32;
INT64 v33;
RTL_DYNAMIC_HASH_TABLE_ENUMERATOR **v34;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pSecurityAttributes;
__int64 v36;
__int64 CurrentProcess;
__int64 v38;
_EPROCESS *v39;
struct _DMA_ADAPTER *v40;
SID_AND_ATTRIBUTES *v41;
int v42;
int RestrictedSidCount;
SID_AND_ATTRIBUTES *v44;
VOID *v45;
int v46;
unsigned int v47;
SID_AND_ATTRIBUTES *v48;
_SID_AND_ATTRIBUTES *v49;
UINT64 v50;
int v51;
struct _DMA_ADAPTER *v52;
_ACL *DefaultDacl;
unsigned int v54;
UINT64 v55;
UINT8 *v56;
struct _DMA_ADAPTER *v57;
char v58;
_DWORD *v59;
unsigned int v60;
UINT64 CapabilityCount;
UINT8 *Package;
_SEP_LOWBOX_NUMBER_ENTRY *LowboxNumberEntry;
_SEP_CACHED_HANDLES_ENTRY *LowboxHandlesEntry;
_SEP_CACHED_HANDLES_ENTRY *BnoIsolationHandlesEntry;
int v66;
struct _ERESOURCE *TokenLock;
int v68;
CHAR v69;
_TOKEN *PrimaryToken;
BOOL v71;
__int64 v72;
__int64 v73;
RTL_DYNAMIC_HASH_TABLE_ENUMERATOR **SidArea;
int RemainingSidAreaSize;
UINT8 IsSystemCode;
char NewTokenAsRestrictedAsProcessToken[3];
ULONG pulResult;
CHAR PreviousMode[8];
PADAPTER_OBJECT DmaAdapter;
ULONG v81[2];
PSID NextTargetSid;
int v83;
struct _DMA_ADAPTER *v84;
_DMA_OPERATIONS **p_DmaOperations;
_DWORD *v86;
_QWORD *v87;
_QWORD *v88;
_QWORD *p_Version;
_QWORD *v90;
SID_AND_ATTRIBUTES **v91;
SID_AND_ATTRIBUTES_HASH *SidAttrHash;
struct _DMA_ADAPTER *v93;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
int v95;
int v96;
__int64 v97;
__int64 v98;
int v99;
int v100;
__int128 v101;
struct _SECURITY_SUBJECT_CONTEXT Context;
unsigned int Flagsa;
unsigned int GroupCounta;
GroupCounta = GroupCount;
Flagsa = Flags;
DmaAdapter = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v11 = RequestorMode;
v81[0] = 0;
memset(&Context, 0, sizeof(Context));
pulResult = 0;
v13 = 0i64;
v96 = 0;
v100 = 0;
IsSystemCode = 0;
PreviousMode[0] = *((_BYTE *)KeGetCurrentThread() + 562);
NewTokenAsRestrictedAsProcessToken[0] = 0;
v83 = Flags & 8;
if( (Flags & 8) != 0 && (ExistingToken->TokenFlags & 0x58) != 0 )
return 3221225485i64;
v14 = 0;
if( (_DWORD)SidCount )
{
v15 = RestrictedSids;
while( !RtlIsPackageSid(v15->Sid) && !RtlIsCapabilitySid(v15->Sid) )
{
++v14;
++v15;
if( v14 >= (unsigned int)SidCount )
goto LABEL_8;
}
return 3221225485i64;
}
LABEL_8:
PoolWithTag = (_DMA_OPERATIONS *)ExAllocatePoolWithTag(PagedPool, 0x30ui64, 0x74416553ui64);
v17 = PoolWithTag;
if( !PoolWithTag )
return 3221225626i64;
PoolWithTag->Size = 0;
PoolWithTag->AllocateCommonBuffer = (void *(__fastcall *)(_DMA_ADAPTER *, unsigned int, _LARGE_INTEGER *, unsigned __int8))&PoolWithTag->PutDmaAdapter;
PoolWithTag->PutDmaAdapter = (void(__fastcall *)(_DMA_ADAPTER *))&PoolWithTag->PutDmaAdapter;
PoolWithTag->FlushAdapterBuffers = (unsigned __int8(__fastcall *)(_DMA_ADAPTER *, _MDL *, void *, void *, unsigned int, unsigned __int8))&PoolWithTag->AllocateAdapterChannel;
PoolWithTag->AllocateAdapterChannel = (int(__fastcall *)(_DMA_ADAPTER *, _DEVICE_OBJECT *, unsigned int, _IO_ALLOCATION_ACTION(__fastcall *)(_DEVICE_OBJECT *, _IRP *, void *, void *), void *))&PoolWithTag->AllocateAdapterChannel;
LODWORD(PoolWithTag->FreeCommonBuffer) = 0;
if( SeTokenLeakTracking )
{
v13 = (_DMA_OPERATIONS *)ExAllocatePoolWithTag(PagedPool, 0x120ui64, 0x74416553ui64);
if( !v13 )
{
v18 = v17;
goto LABEL_16;
}
}
v20 = (struct _ERESOURCE *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x68ui64, 0x6C546553ui64);
if( !v20 )
{
ExFreePoolWithTag(v17, 0);
if( !SeTokenLeakTracking )
return 3221225626i64;
v18 = v13;
LABEL_16:
ExFreePoolWithTag(v18, 0);
return 3221225626i64;
}
v21 = RtlULongAdd(ExistingToken->VariableLength, (unsigned int)SidLength, (UINT64 *)&pulResult);
if( v21 < 0
|| (v21 = RtlULongAdd(pulResult, 4ui64, (UINT64 *)&pulResult), v21 < 0)
|| (v21 = RtlULongAdd(0x490ui64, pulResult, (UINT64 *)v81), v21 < 0) )
{
v23 = v20;
LABEL_101:
ExFreePoolWithTag(v23, 0);
ExFreePoolWithTag(v17, 0);
if( SeTokenLeakTracking )
ExFreePoolWithTag(v13, 0);
return(unsigned int)v21;
}
RemainingSidAreaSize = ExistingToken->DynamicCharged;
v97 = v22;
v99 = v22;
v98 = v22;
v95 = 48;
v101 = 0i64;
v21 = ObCreateObject(v11, SeTokenObjectType, 0i64, v11, v22, v81[0], RemainingSidAreaSize, v81[0], &DmaAdapter);
v23 = v20;
if( v21 < 0 )
goto LABEL_101;
v24 = DmaAdapter;
*(_QWORD *)&DmaAdapter[3].Version = v20;
ExInitializeResourceLite(v20);
v25 = DmaAdapter;
v24[3].DmaOperations = (_DMA_OPERATIONS *)(ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement));
v26 = DmaAdapter;
v27 = pulResult;
*(_QWORD *)&v25[1].Version = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
BYTE4(v26[12].DmaOperations) = 0;
v26[1].DmaOperations = (_DMA_OPERATIONS *)ExistingToken->AuthenticationId;
TokenSource = ExistingToken->TokenSource;
v84 = v26 + 8;
*(_TOKEN_SOURCE *)v26 = TokenSource;
HIDWORD(v26[8].DmaOperations) = 0;
*(_DWORD *)&v26[8].Version = 0;
*(_DWORD *)(&v26[8].Size + 1) = v27;
*(_LUID *)&v26[2].Version = ExistingToken->TokenId;
*(_DWORD *)&v26[12].Version = ExistingToken->TokenType;
*(_DWORD *)(&v26[12].Size + 1) = ExistingToken->ImpersonationLevel;
v26[2].DmaOperations = (_DMA_OPERATIONS *)ExistingToken->ExpirationTime.QuadPart;
*(_LUID *)&v26[14].Version = ExistingToken->OriginatingLogonSession;
*(_QWORD *)&v26[70].Version = 0i64;
v26[70].DmaOperations = 0i64;
v26[68].DmaOperations = 0i64;
v26[71].DmaOperations = v13;
LODWORD(v26[7].DmaOperations) = 0;
v26[72].DmaOperations = 0i64;
p_DmaOperations = &v26[71].DmaOperations;
if( SeTokenLeakTracking )
{
v29 = RtlWalkFrameChain((VOID **)&v26[71].DmaOperations->FlushAdapterBuffers, 0x1Eui64, 0i64);
if( KeGetCurrentIrql() < 2u )
RtlWalkFrameChain((VOID **)&(*p_DmaOperations)->FlushAdapterBuffers + v29, 30 - v29, 1ui64);
}
KeEnterCriticalRegion();
LOBYTE(v30) = 1;
ExAcquireResourceSharedLite(ExistingToken->TokenLock, v30);
LODWORD(v26[8].DmaOperations) = ExistingToken->DynamicCharged;
*(_DWORD *)&v26[9].Version = ExistingToken->DefaultOwnerIndex;
SepSetTokenSessionById((INT64)v26, ExistingToken->SessionId, 0, 0i64, 0i64);
LODWORD(v26[7].DmaOperations) = ExistingToken->SessionId;
v31 = &v26[12].DmaOperations;
v32 = ExistingToken->TokenFlags & 0xFFFFFBD7;
v86 = &v26[12].DmaOperations;
LODWORD(v26[12].DmaOperations) = v32;
*(PADAPTER_OBJECT)((char *)v26 + 88) = *(PADAPTER_OBJECT)ExistingToken->AuditPolicy.AdtTokenPolicy.PerUserPolicy;
v26[6].DmaOperations = *(_DMA_OPERATIONS **)&ExistingToken->AuditPolicy.AdtTokenPolicy.PerUserPolicy[16];
*(_DWORD *)&v26[7].Version = *(_DWORD *)&ExistingToken->AuditPolicy.AdtTokenPolicy.PerUserPolicy[24];
*(&v26[7].Size + 1) = *(_WORD *)&ExistingToken->AuditPolicy.AdtTokenPolicy.PerUserPolicy[28];
*((_BYTE *)&v26[7].Size + 4) = ExistingToken->AuditPolicy.PolicySetStatus;
*(_DWORD *)&v26[13].Version = ExistingToken->IntegrityLevelIndex;
*(_DWORD *)(&v26[13].Size + 1) = ExistingToken->MandatoryPolicy;
v26[4] = *(PADAPTER_OBJECT)&ExistingToken->Privileges.Present;
*(_QWORD *)&v26[5].Version = ExistingToken->Privileges.EnabledByDefault;
v26[48].DmaOperations = v17;
if( *((_BYTE *)&v26[7].Size + 4) == 2 )
SepModifyTokenPolicyCounter((_SEP_AUDIT_POLICY *)&v26[5].DmaOperations, 1u);
v26[67].DmaOperations = 0i64;
v88 = &v26[67].DmaOperations;
*(_QWORD *)&v26[68].Version = 0i64;
p_Version = &v26[68].Version;
*(_QWORD *)&v26[72].Version = 0i64;
v90 = &v26[72].Version;
v26[49].DmaOperations = 0i64;
v91 = (SID_AND_ATTRIBUTES **)&v26[49].DmaOperations;
*(_QWORD *)&v26[49].Version = 0i64;
v93 = v26 + 50;
*(_DWORD *)&v26[50].Version = 0;
SidAttrHash = (SID_AND_ATTRIBUTES_HASH *)&v26[50].DmaOperations;
memset((INT64)&v26[50].DmaOperations, 0i64);
*(_QWORD *)&v26[11].Version = 0i64;
*(_QWORD *)&v26[69].Version = 0i64;
v26[69].DmaOperations = 0i64;
*(_QWORD *)&v26[71].Version = 0i64;
v87 = &v26[11].Version;
v21 = SepDuplicateLogonSessionReference((INT64)v26, (INT64)ExistingToken);
if( v21 < 0 )
goto LABEL_28;
SepRefDerefLuidToIndexEntryIfNecessary(ExistingToken, 0);
*(_QWORD *)&v26[71].Version = ExistingToken->IndexEntry;
pSecurityAttributes = ExistingToken->pSecurityAttributes;
if( pSecurityAttributes->SecurityAttributeCount )
{
v21 = AuthzBasepDuplicateSecurityAttributes(
pSecurityAttributes,
(_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v26[48].DmaOperations,
0i64);
if( v21 < 0 )
goto LABEL_28;
}
if( ExistingToken->pClaimAttributes )
{
v21 = SepDuplicateTokenClaims((RTL_DYNAMIC_HASH_TABLE *)ExistingToken, (INT64)v26, v33, v34, SidArea);
if( v21 < 0 )
goto LABEL_28;
}
if( SeTokenLeakTracking )
{
v36 = (__int64)p_DmaOperations;
*(_QWORD *)&(*p_DmaOperations)->Size = *((_QWORD *)KeGetCurrentThread() + 143);
*(_QWORD *)(*(_QWORD *)v36 + 8i64) = *((_QWORD *)KeGetCurrentThread() + 144);
*(_DWORD *)(*(_QWORD *)v36 + 32i64) = 15;
*(_DWORD *)(*(_QWORD *)v36 + 280i64) = 0;
*(_DWORD *)(*(_QWORD *)v36 + 284i64) = 0;
CurrentProcess = PsGetCurrentProcess();
v38 = *(_QWORD *)v36;
v26 = DmaAdapter;
*(_QWORD *)(v38 + 16) = *(_QWORD *)(CurrentProcess + 1448);
*(_DWORD *)(v38 + 24) = *(_DWORD *)(CurrentProcess + 1456);
*(_WORD *)(v38 + 28) = *(_WORD *)(CurrentProcess + 1460);
*(_BYTE *)(v38 + 30) = *(_BYTE *)(CurrentProcess + 1462);
SepAddTokenLogonSession((INT64)v26);
v27 = pulResult;
}
if( (Flagsa & 2) != 0 )
{
v39 = (_EPROCESS *)PsGetCurrentProcess();
v40 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)v39);
if( SeIsSystemContext(v40, &IsSystemCode) >= 0 && IsSystemCode )
*v31 |= 0x40u;
HalPutDmaAdapter(v40);
}
v41 = (SID_AND_ATTRIBUTES *)&v26[73];
v42 = ((_BYTE)v26 - 112) & 7;
if( (((_BYTE)v26 - 112) & 7) != 0 )
{
v41 = (SID_AND_ATTRIBUTES *)((char *)v41 + (unsigned int)(8 - v42));
v27 -= 8 - v42;
pulResult = v27;
}
RestrictedSidCount = SidCount;
if( ExistingToken->RestrictedSidCount > (unsigned int)SidCount )
RestrictedSidCount = ExistingToken->RestrictedSidCount;
v44 = &v41[ExistingToken->UserAndGroupCount + RestrictedSidCount];
v26[9].DmaOperations = (_DMA_OPERATIONS *)v41;
NextTargetSid = v44;
if( SepTokenSidSharingEnabled )
{
v21 = SepDuplicateTokenUserAndGroups(ExistingToken, (_TOKEN *)v26);
if( v21 < 0 )
{
v26[9].DmaOperations = 0i64;
LABEL_28:
ExReleaseResourceLite(ExistingToken->TokenLock);
LABEL_29:
KeLeaveCriticalRegion();
HalPutDmaAdapter(v26);
return(unsigned int)v21;
}
}
else
{
HIDWORD(v26[7].DmaOperations) = ExistingToken->UserAndGroupCount;
v46 = RtlCopySidAndAttributesArray(
ExistingToken->UserAndGroupCount,
ExistingToken->UserAndGroups,
v27,
v41,
v44,
&NextTargetSid,
(UINT64 *)&pulResult);
v44 = (SID_AND_ATTRIBUTES *)NextTargetSid;
v21 = v46;
}
v47 = 0;
v48 = (SID_AND_ATTRIBUTES *)((char *)v41 + 16 * ExistingToken->UserAndGroupCount);
*(_QWORD *)&v26[10].Version = v48;
if( (_DWORD)SidCount )
{
v49 = RestrictedSids;
do
{
v50 = ExistingToken->RestrictedSidCount;
if( !(_DWORD)v50 || SepSidInSidAndAttributes(ExistingToken->RestrictedSids, v50, v45, v49->Sid) )
{
v51 = RtlCopySidAndAttributesArray(
1ui64,
&RestrictedSids[v47],
pulResult,
v48,
v44,
&NextTargetSid,
(UINT64 *)&pulResult);
v52 = v84;
v21 = v51;
++v48;
v44 = (SID_AND_ATTRIBUTES *)NextTargetSid;
*(_DWORD *)(*(_QWORD *)&v26[10].Version + 16i64 * *(unsigned int *)&v84->Version + 8) = 7;
++*(_DWORD *)&v52->Version;
}
++v47;
++v49;
}
while( v47 < (unsigned int)SidCount );
}
DefaultDacl = ExistingToken->DefaultDacl;
v54 = 4 * *((unsigned __int8 *)ExistingToken->PrimaryGroup + 1) + 8;
if( DefaultDacl )
v54 += DefaultDacl->AclSize;
v55 = v54;
v56 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v54, 0x64546553ui64);
*v87 = v56;
if( !v56 )
{
v21 = -1073741670;
goto LABEL_28;
}
v57 = v84;
if( ExistingToken->RestrictedSidCount && !*(_DWORD *)&v84->Version )
{
v21 = -1073741811;
goto LABEL_28;
}
v58 = 0;
v59 = v86;
if( *(_DWORD *)&v84->Version )
{
*v86 |= 0x810u;
v58 = 1;
}
else
{
*(_QWORD *)&v26[10].Version = 0i64;
}
if( v83 )
{
*v59 |= 0x18u;
v58 = 1;
}
if( v58 )
SepSetLogonSessionToken(ExistingToken);
memmove(v56, (UINT8 *)ExistingToken->DynamicPart, v55);
if( ExistingToken->DefaultDacl )
v26[11].DmaOperations = (_DMA_OPERATIONS *)&v56[LODWORD(ExistingToken->DefaultDacl)
- LODWORD(ExistingToken->DynamicPart)];
else
v26[11].DmaOperations = 0i64;
v60 = LODWORD(ExistingToken->PrimaryGroup) - LODWORD(ExistingToken->DynamicPart);
CapabilityCount = ExistingToken->CapabilityCount;
if( (_DWORD)CapabilityCount )
v21 = SepSetTokenCapabilities((_TOKEN *)v26, ExistingToken->Package, ExistingToken->Capabilities, CapabilityCount);
if( v21 < 0 )
goto LABEL_28;
Package = (UINT8 *)ExistingToken->Package;
if( Package )
v21 = SepSetTokenPackage((INT64)v26, Package);
if( v21 < 0 )
goto LABEL_28;
LowboxNumberEntry = ExistingToken->LowboxNumberEntry;
if( LowboxNumberEntry )
{
SepReferenceLowBoxNumberEntry((INT64)LowboxNumberEntry);
*v88 = ExistingToken->LowboxNumberEntry;
}
LowboxHandlesEntry = ExistingToken->LowboxHandlesEntry;
if( LowboxHandlesEntry )
{
SepReferenceLowBoxNumberEntry((INT64)LowboxHandlesEntry);
*p_Version = ExistingToken->LowboxHandlesEntry;
}
BnoIsolationHandlesEntry = ExistingToken->BnoIsolationHandlesEntry;
if( BnoIsolationHandlesEntry )
{
SepReferenceLowBoxNumberEntry((INT64)BnoIsolationHandlesEntry);
*v90 = ExistingToken->BnoIsolationHandlesEntry;
}
v66 = SepSetTokenTrust((_TOKEN *)v26, ExistingToken->TrustLevelSid);
TokenLock = ExistingToken->TokenLock;
v68 = v66;
if( v66 < 0 )
{
ExReleaseResourceLite(TokenLock);
v21 = v68;
goto LABEL_29;
}
ExReleaseResourceLite(TokenLock);
KeLeaveCriticalRegion();
v26[10].DmaOperations = (_DMA_OPERATIONS *)&v56[v60];
LODWORD(SidArea) = PrivilegeCount;
SepRemoveDisabledGroupsAndPrivileges(
(_TOKEN *)v26,
Flagsa,
(VOID *)GroupCounta,
GroupsToDisable,
(UINT64)SidArea,
PrivilegesToDelete);
RtlSidHashInitialize(
(SID_AND_ATTRIBUTES *)v26[9].DmaOperations,
HIDWORD(v26[7].DmaOperations),
(SID_AND_ATTRIBUTES_HASH *)&v26[14].DmaOperations);
RtlSidHashInitialize(
*(SID_AND_ATTRIBUTES **)&v26[10].Version,
*(unsigned int *)&v57->Version,
(SID_AND_ATTRIBUTES_HASH *)&v26[31].DmaOperations);
SeCaptureSubjectContext(&SubjectContext);
v69 = PreviousMode[0];
Context.PrimaryToken = SubjectContext.PrimaryToken;
if( (unsigned __int8)RtlIsSandboxedToken(&SubjectContext, PreviousMode[0])
&& (unsigned __int8)RtlIsSandboxedToken(&Context, v69)
&& ((PrimaryToken = (_TOKEN *)SubjectContext.PrimaryToken,
KeEnterCriticalRegion(),
LOBYTE(v71) = 1,
ExAcquireResourceSharedLite(PrimaryToken->TokenLock, v71),
v68 = SepNewTokenAsRestrictedAsProcessToken(
(_TOKEN *)v26,
PrimaryToken,
(UINT8 *)NewTokenAsRestrictedAsProcessToken),
ExReleaseResourceLite(PrimaryToken->TokenLock),
KeLeaveCriticalRegion(),
v68 < 0)
|| !NewTokenAsRestrictedAsProcessToken[0]) )
{
HalPutDmaAdapter(v26);
SeReleaseSubjectContext(&SubjectContext);
}
else
{
SeReleaseSubjectContext(&SubjectContext);
if( *v91 )
RtlSidHashInitialize(*v91, *(unsigned int *)&v93->Version, SidAttrHash);
if( SeTokenLeakTracking
&& SepTokenLeakMethodWatch == 15
&& *(_QWORD *)(PsGetCurrentProcess() + 1088) == SepTokenLeakProcessCid )
{
v72 = (__int64)p_DmaOperations;
v26 = DmaAdapter;
LODWORD((*p_DmaOperations)->AllocateCommonBufferVector) = _InterlockedIncrement(&SepTokenLeakMethodCount);
v73 = *(unsigned int *)(*(_QWORD *)v72 + 280i64);
if( (int)v73 >= SepTokenLeakBreakCount )
{
DbgPrint("\nToken number 0x%x = 0x%p\n", v73, v26);
__debugbreak();
}
}
*FilteredToken = (_TOKEN *)v26;
}
return(unsigned int)v68;
}Referenced by:
NtFilterToken
SeFilterToken