SepNormalAccessCheck
VOID __stdcall SepNormalAccessCheck(
UINT64 Remaining,
_TOKEN *EToken,
_TOKEN *PrimaryToken,
_ACL *Dacl,
_ACL *Sacl,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **ResourceInfo,
VOID *PrincipalSelfSid,
UINT64 LocalTypeListLength,
_IOBJECT_TYPE_LIST *LocalTypeList,
UINT64 ObjectTypeListLength,
UINT8 Restricted,
UINT8 TokenIsOwner,
_SE_PACKAGE_CAPABILITY_INFO *PackageCapabilityInfo){
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pUserSecurityAttributes;
unsigned int v14;
unsigned int v15;
int AceCount;
_TOKEN *v17;
_IOBJECT_TYPE_LIST v18;
unsigned int v19;
_IOBJECT_TYPE_LIST *v20;
__int64 v21;
UINT8 bRestricted;
_ACL *v23;
VOID *v24;
_IOBJECT_TYPE_LIST v25;
unsigned __int8 AclRevision;
_IOBJECT_TYPE_LIST v27;
__int64 v28;
char *v29;
unsigned __int8 *v30;
int v31;
unsigned __int8 v32;
__int64 v33;
unsigned int v34;
unsigned __int64 v35;
int v36;
__int64 v37;
int v38;
__int64 v39;
int v40;
unsigned int v41;
__int64 v42;
__int64 v43;
unsigned int *p_PackageGrantedAccess;
int v45;
unsigned __int16 AclSize;
unsigned int v47;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *pClaimAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedUserSecurityAttributes;
__int64 v52;
unsigned int v53;
int v54;
_GUID *p_AceCount;
_GUID *v56;
UINT8 *PackageMatched;
unsigned int *ConditionSize;
unsigned int AceIndex;
int AceIndex_4;
UINT64 ReturnedIndex;
unsigned int v62;
_IOBJECT_TYPE_LIST v63;
INT64 Result;
int v65;
int v66;
__int64 v67;
__int64 v68;
unsigned __int8 v71;
__int64 v72;
char v73;
pUserSecurityAttributes = 0i64;
v14 = LocalTypeListLength;
v15 = EToken->TokenFlags & 0x2000;
AceCount = Dacl->AceCount;
v17 = EToken;
v18 = Remaining;
LODWORD(ReturnedIndex) = 0;
v19 = 0;
AceIndex_4 = 0;
LODWORD(Result) = -1;
HIDWORD(Result) = AceCount;
if( (_DWORD)LocalTypeListLength )
{
v20 = LocalTypeList + 6;
v21 = (unsigned int)LocalTypeListLength;
do
{
*v20 = v18;
v20 += 12;
--v21;
}
while( v21 );
AceCount = HIDWORD(Result);
}
bRestricted = Restricted;
if( !v15 && !Restricted )
{
v19 = v18 | PackageCapabilityInfo->Remaining;
AceIndex_4 = v19;
}
HIDWORD(ReturnedIndex) = v19;
v23 = Dacl + 1;
AceIndex = 0;
if( !AceCount )
return;
v24 = PrincipalSelfSid;
do
{
v25 = LocalTypeList[6];
if( !v25 && !v19 )
return;
if( (v23->Sbz1 & 8) != 0 )
goto LABEL_34;
if( v25 )
goto LABEL_11;
if( v23->AclRevision )
{
if( v23->AclRevision != 9 )
goto LABEL_34;
LABEL_11:
AclRevision = v23->AclRevision;
if( !v23->AclRevision )
goto LABEL_12;
switch( AclRevision )
{
case 5u:
v54 = *(_DWORD *)&v23[1].AclRevision;
p_AceCount = (_GUID *)&v23[1].AceCount;
if( (v54 & 1) == 0 )
p_AceCount = 0i64;
if( p_AceCount )
{
if( (_DWORD)ObjectTypeListLength )
{
if( SepSidInToken(
v17,
v24,
(char *)&v23[2 * (v54 & 1)] + ((8i64 * (v54 & 2)) | 0xC),
0,
bRestricted,
TokenIsOwner)
&& AuthzBasepObjectInTypeList(p_AceCount, LocalTypeList, v14, &ReturnedIndex) )
{
LODWORD(PackageMatched) = *(_DWORD *)&v23->AceCount;
AuthzBasepAddAccessTypeList(
LocalTypeList,
v14,
(unsigned int)ReturnedIndex,
AceIndex,
(UINT64)PackageMatched,
0);
}
goto LABEL_32;
}
goto LABEL_34;
}
if( !SepSidInToken(
v17,
v24,
(char *)&v23[2 * (v54 & 1)] + ((8i64 * (v54 & 2)) | 0xC),
0,
bRestricted,
TokenIsOwner) )
goto LABEL_32;
v40 = *(_DWORD *)&v23->AceCount;
if( v14 == 1 )
{
LocalTypeList[6] &= ~v40;
goto LABEL_32;
}
goto LABEL_86;
case 4u:
if( !SepSidInToken(v17, v24, &v23[2].AceCount + 2 * HIBYTE(v23[1].AceCount), 0, bRestricted, TokenIsOwner)
|| !SepSidInToken(PrimaryToken, 0i64, &v23[1].AceCount, 0, bRestricted, TokenIsOwner) )
{
goto LABEL_32;
}
v40 = *(_DWORD *)&v23->AceCount;
if( v14 == 1 )
{
LocalTypeList[6] &= ~v40;
goto LABEL_32;
}
goto LABEL_86;
case 1u:
if( !SepSidInToken(v17, v24, &v23[1], 1u, bRestricted, TokenIsOwner)
|| (*(_DWORD *)&v23->AceCount & LocalTypeList[6]) == 0 )
{
goto LABEL_32;
}
return;
case 6u:
if( !SepSidInToken(
v17,
v24,
(char *)&v23[2 * (*(_DWORD *)&v23[1].AclRevision & 1)]
+ ((8i64 * (*(_DWORD *)&v23[1].AclRevision & 2)) | 0xC),
1u,
bRestricted,
TokenIsOwner) )
goto LABEL_32;
v56 = (_GUID *)&v23[1].AceCount;
pUserSecurityAttributes = 0i64;
if( (*(_DWORD *)&v23[1].AclRevision & 1) == 0 )
v56 = 0i64;
if( v56 && (_DWORD)ObjectTypeListLength )
{
if( !AuthzBasepObjectInTypeList(v56, LocalTypeList, v14, &ReturnedIndex)
|| (LocalTypeList[12 * (unsigned int)ReturnedIndex + 6] & *(_DWORD *)&v23->AceCount) == 0 )
{
goto LABEL_32;
}
}
else if( (*(_DWORD *)&v23->AceCount & LocalTypeList[6]) == 0 )
{
goto LABEL_33;
}
return;
}
if( AclRevision != 9 )
goto LABEL_34;
AclSize = v23->AclSize;
v47 = 4 * v23[1].Sbz1 + 8;
if( AclSize - v47 == 8 )
goto LABEL_34;
if( Sacl && !*ResourceInfo )
{
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
AclSize = v23->AclSize;
pUserSecurityAttributes = 0i64;
}
pClaimAttributes = v17->pClaimAttributes;
if( pClaimAttributes )
{
pRestrictedDeviceSecurityAttributes = pClaimAttributes->pRestrictedDeviceSecurityAttributes;
pDeviceSecurityAttributes = pClaimAttributes->pDeviceSecurityAttributes;
pRestrictedUserSecurityAttributes = pClaimAttributes->pRestrictedUserSecurityAttributes;
pUserSecurityAttributes = pClaimAttributes->pUserSecurityAttributes;
}
else
{
pRestrictedDeviceSecurityAttributes = 0i64;
pDeviceSecurityAttributes = 0i64;
pRestrictedUserSecurityAttributes = 0i64;
}
LODWORD(ConditionSize) = AclSize - v47 - 8;
AuthzBasepEvaluateAceCondition(
v17,
v17->pSecurityAttributes,
*ResourceInfo,
pUserSecurityAttributes,
pRestrictedUserSecurityAttributes,
pDeviceSecurityAttributes,
pRestrictedDeviceSecurityAttributes,
(UINT8 *)&v23[1] + v47,
(UINT64)ConditionSize,
0,
bRestricted,
&Result);
if( (_DWORD)Result != 1 )
goto LABEL_32;
if( !v15 && !bRestricted && v19 )
{
if( SepIsPackageSid(&v23[1]) )
{
LABEL_63:
ConditionSize = &PackageCapabilityInfo[1].PackageGrantedAccess;
p_PackageGrantedAccess = &PackageCapabilityInfo->PackageGrantedAccess;
SepMatchPackage(
EToken,
HIDWORD(ReturnedIndex),
&v23[1],
*(unsigned int *)&v23->AceCount,
(UINT8 *)&PackageCapabilityInfo[1].Remaining + 1,
(UINT64 *)&PackageCapabilityInfo->PackageGrantedAccess,
(UINT8 *)&PackageCapabilityInfo[1]);
}
else
{
if( !SepIsCapabilitySid(&v23[1]) )
{
v17 = EToken;
goto LABEL_83;
}
LABEL_88:
p_PackageGrantedAccess = &PackageCapabilityInfo->CapabilityGrantedAccess;
SepMatchCapability(
EToken,
HIDWORD(ReturnedIndex),
&v23[1],
*(unsigned int *)&v23->AceCount,
(UINT8 *)&PackageCapabilityInfo[1].Remaining + 2,
(UINT64 *)&PackageCapabilityInfo->CapabilityGrantedAccess);
}
v45 = ~*p_PackageGrantedAccess;
AceIndex_4 = v45 & v19;
PackageCapabilityInfo->Remaining &= v45;
goto LABEL_32;
}
LABEL_83:
if( !LocalTypeList[6] )
goto LABEL_32;
if( !SepSidInToken(v17, PrincipalSelfSid, &v23[1], 0, bRestricted, TokenIsOwner) )
{
v24 = PrincipalSelfSid;
LABEL_134:
pUserSecurityAttributes = 0i64;
goto LABEL_34;
}
v40 = *(_DWORD *)&v23->AceCount;
LABEL_86:
LODWORD(PackageMatched) = v40;
AuthzBasepAddAccessTypeList(LocalTypeList, v14, 0i64, AceIndex, (UINT64)PackageMatched, 0);
goto LABEL_32;
}
LABEL_12:
if( !v15 && !bRestricted && v19 )
{
v42 = SePackagePrefixSid;
if( v23[1].Sbz1 >= 2u
&& v23[1].AclRevision == *(_BYTE *)SePackagePrefixSid
&& RtlCompareMemory(&v23[1].AclSize, (const VOID *)(SePackagePrefixSid + 2), 6) == (_SIZE_T *)6
&& *(_DWORD *)&v23[2].AclRevision == *(_DWORD *)(v42 + 8) )
{
goto LABEL_63;
}
v43 = SeCapabilityPrefixSid;
if( v23[1].Sbz1 >= 2u
&& v23[1].AclRevision == *(_BYTE *)SeCapabilityPrefixSid
&& RtlCompareMemory(&v23[1].AclSize, (const VOID *)(SeCapabilityPrefixSid + 2), 6) == (_SIZE_T *)6
&& *(_DWORD *)&v23[2].AclRevision == *(_DWORD *)(v43 + 8) )
{
goto LABEL_88;
}
v17 = EToken;
}
v27 = LocalTypeList[6];
v63 = v27;
if( !v27 )
goto LABEL_32;
v28 = 504i64;
if( !bRestricted )
v28 = 232i64;
v29 = &v17->TokenSource.SourceName[v28];
v30 = (unsigned __int8 *)&v23[1];
if( v73 && v23 != (_ACL *)-8i64 && RtlEqualSid(SeAliasAdminsSid, &v23[1]) )
goto LABEL_39;
if( PrincipalSelfSid && RtlEqualSid(SePrincipalSelfSid, &v23[1]) )
v30 = (unsigned __int8 *)PrincipalSelfSid;
if( TokenIsOwner
&& *(_WORD *)SeOwnerRightsSid == *(_WORD *)v30
&& !memcmp(SeOwnerRightsSid, v30, 4 * ((unsigned __int64)*(unsigned __int16 *)SeOwnerRightsSid >> 8) + 8) )
{
LABEL_30:
v14 = LocalTypeListLength;
v40 = *(_DWORD *)&v23->AceCount;
if( (_DWORD)LocalTypeListLength == 1 )
{
LocalTypeList[6] = v27 & ~v40;
goto LABEL_32;
}
goto LABEL_86;
}
if( !v29 )
{
v14 = LocalTypeListLength;
v24 = PrincipalSelfSid;
goto LABEL_134;
}
if( !v30 )
{
v14 = LocalTypeListLength;
v24 = PrincipalSelfSid;
pUserSecurityAttributes = 0i64;
goto LABEL_34;
}
v31 = v30[1];
v32 = 0;
v33 = *(unsigned __int16 *)v30;
v67 = v33;
v71 = 0;
v34 = 4 * v31 + 8;
v62 = v34;
v35 = *(_QWORD *)&v29[8 * (v30[4 * ((unsigned __int64)(unsigned int)v33 >> 8) + 4] & 0xF) + 16] & *(_QWORD *)&v29[8 * ((unsigned __int64)v30[4 * ((unsigned __int64)(unsigned int)v33 >> 8) + 4] >> 4) + 144];
if( !v35 )
{
LABEL_38:
v41 = *(_DWORD *)v29;
if( *(_DWORD *)v29 <= 0x40u )
goto LABEL_39;
v52 = *((_QWORD *)v29 + 1);
v53 = 64;
v72 = v52;
do
{
v39 = v52 + 16i64 * v53;
if( **(_WORD **)v39 == (_WORD)v33 )
{
if( !memcmp(v30, *(const VOID **)v39, v34) )
goto LABEL_26;
v52 = v72;
LOWORD(v33) = v67;
v34 = v62;
}
++v53;
}
while( v53 < v41 );
v14 = LocalTypeListLength;
bRestricted = Restricted;
goto LABEL_32;
}
while( 1 )
{
LOBYTE(v36) = v35;
if( (_BYTE)v35 )
break;
LABEL_54:
v32 += 8;
v35 >>= 8;
v71 = v32;
if( !v35 )
{
bRestricted = Restricted;
goto LABEL_38;
}
}
v37 = *((_QWORD *)v29 + 1);
v38 = v32;
v68 = v37;
v66 = v32;
while( 1 )
{
v65 = *((unsigned __int8 *)SidHashByteToIndexLookupTable + (unsigned __int8)v36);
v39 = v37 + 16i64 * (unsigned int)(v38 + v65);
if( **(_WORD **)v39 == (_WORD)v33 )
break;
LABEL_60:
v38 = v66;
v36 = (unsigned __int8)v36 ^ (1 << v65);
if( !(_BYTE)v36 )
{
v32 = v71;
goto LABEL_54;
}
}
if( memcmp(v30, *(const VOID **)v39, v34) )
{
v37 = v68;
LOWORD(v33) = v67;
v34 = v62;
goto LABEL_60;
}
LABEL_26:
bRestricted = Restricted;
if( !Restricted && v39 == *((_QWORD *)v29 + 1) && (*(_DWORD *)(v39 + 8) & 0x10) == 0
|| (*(_DWORD *)(v39 + 8) & 4) != 0 )
{
v27 = v63;
goto LABEL_30;
}
LABEL_39:
v14 = LocalTypeListLength;
LABEL_32:
pUserSecurityAttributes = 0i64;
LABEL_33:
v24 = PrincipalSelfSid;
LABEL_34:
v19 = AceIndex_4;
v23 = (_ACL *)((char *)v23 + v23->AclSize);
v17 = EToken;
++AceIndex;
}
while( AceIndex < HIDWORD(Result) );
}Referenced by:
SepAccessCheck