SepNormalAccessCheckEx
VOID __stdcall SepNormalAccessCheckEx(
UINT64 Remaining,
_TOKEN *EToken,
_TOKEN *PrimaryToken,
_ACL *Dacl,
_ACL *Sacl,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **ResourceInfo,
UINT64 LocalTypeListLength,
_IOBJECT_TYPE_LIST *LocalTypeList,
UINT64 ObjectTypeListLength,
UINT8 Restricted,
UINT8 TokenIsOwner,
UINT8 AppLocker,
_SE_PACKAGE_CAPABILITY_INFO *PackageCapabilityInfo,
UINT8 a14,
_SE_PACKAGE_CAPABILITY_INFO *a15){
unsigned int TokenFlags;
int v17;
int v18;
unsigned int v19;
int v20;
UINT64 v21;
_DWORD *v22;
__int64 v23;
__int64 v24;
UINT8 v25;
unsigned int v26;
_ACL *v27;
bool v28;
int v29;
unsigned __int8 AclRevision;
bool v31;
unsigned __int16 *p_AceCount;
_TOKEN *v33;
_ACCESS_REASONS **v34;
__int64 v35;
_DWORD *v36;
int v37;
int v38;
__int64 v39;
_GUID *v40;
_GUID *v41;
bool v42;
unsigned int v43;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *pClaimAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pDeviceSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pRestrictedUserSecurityAttributes;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *pUserSecurityAttributes;
int v49;
__int64 v50;
unsigned int v51;
_AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION *v52;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v53;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v54;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v55;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v56;
int v57;
__int64 v58;
UINT64 OverWrite;
UINT64 OverWritea;
UINT64 ConditionSize;
unsigned int AceCount;
int v63;
UINT64 ReturnedIndex;
_TOKEN *v65;
UINT64 DesiredAccess;
v65 = PrimaryToken;
LODWORD(ReturnedIndex) = 0;
TokenFlags = EToken->TokenFlags;
v17 = 0;
LODWORD(LocalTypeListLength) = 0;
v18 = TokenFlags & 0x2000;
v19 = (unsigned int)LocalTypeList;
v20 = Remaining;
v21 = ObjectTypeListLength;
v63 = v18;
AceCount = Dacl->AceCount;
if( (_DWORD)LocalTypeList )
{
v22 = (_DWORD *)(ObjectTypeListLength + 24);
v23 = (unsigned int)LocalTypeList;
do
{
*v22 = v20;
v22 += 12;
--v23;
}
while( v23 );
}
v24 = a14;
v25 = TokenIsOwner;
if( !v18 && !TokenIsOwner )
v17 = v20 | *(_DWORD *)a14;
v26 = 0;
LODWORD(DesiredAccess) = v17;
v27 = Dacl + 1;
v28 = AceCount == 0;
if( AceCount )
{
while( 1 )
{
v29 = *(_DWORD *)(v21 + 24);
if( !v29 && !v17 )
{
LABEL_27:
v28 = v26 == AceCount;
break;
}
if( (v27->Sbz1 & 8) == 0 )
{
if( !v29 )
{
if( !v27->AclRevision )
{
LABEL_12:
v31 = v18 == 0;
LABEL_13:
if( v31 && !v25 && v17 )
{
if( SepIsPackageSid(&v27[1]) )
{
ConditionSize = v24 + 24;
v36 = (_DWORD *)(v24 + 4);
SepMatchPackage(
EToken,
(unsigned int)DesiredAccess,
&v27[1],
*(unsigned int *)&v27->AceCount,
(UINT8 *)(v24 + 21),
(UINT64 *)(v24 + 4),
(UINT8 *)(v24 + 20));
LABEL_41:
v37 = ~*v36;
v17 &= v37;
*(_DWORD *)v24 &= v37;
LABEL_42:
v25 = TokenIsOwner;
goto LABEL_24;
}
if( SepIsCapabilitySid(&v27[1]) )
{
v36 = (_DWORD *)(v24 + 8);
SepMatchCapability(
EToken,
(unsigned int)DesiredAccess,
&v27[1],
*(unsigned int *)&v27->AceCount,
(UINT8 *)(v24 + 22),
(UINT64 *)(v24 + 8));
goto LABEL_41;
}
v19 = (unsigned int)LocalTypeList;
}
if( !*(_DWORD *)(v21 + 24) )
goto LABEL_24;
p_AceCount = (unsigned __int16 *)&v27[1];
LABEL_21:
v33 = EToken;
LABEL_22:
if( SepSidInToken(v33, 0i64, p_AceCount, 0, v25, AppLocker) )
{
LODWORD(OverWrite) = *(_DWORD *)&v27->AceCount;
AuthzBasepAddAccessTypeList((_IOBJECT_TYPE_LIST *)v21, v19, 0i64, v26, OverWrite, 0);
}
goto LABEL_24;
}
if( v27->AclRevision != 9 )
goto LABEL_24;
}
AclRevision = v27->AclRevision;
if( !v27->AclRevision )
goto LABEL_12;
switch( AclRevision )
{
case 5u:
v38 = *(_DWORD *)&v27[1].AclRevision;
v39 = v38 & 1;
v40 = (_GUID *)((unsigned __int64)&v27[1].AceCount & -(__int64)((v38 & 1) != 0));
if( v40 )
{
if( Restricted
&& SepSidInToken(
EToken,
0i64,
(char *)&v27[2 * v39] + ((8i64 * (v38 & 2)) | 0xC),
0,
TokenIsOwner,
AppLocker)
&& AuthzBasepObjectInTypeList(v40, (_IOBJECT_TYPE_LIST *)v21, v19, &ReturnedIndex) )
{
LODWORD(OverWritea) = *(_DWORD *)&v27->AceCount;
AuthzBasepAddAccessTypeList(
(_IOBJECT_TYPE_LIST *)v21,
v19,
(unsigned int)ReturnedIndex,
v26,
OverWritea,
0);
}
goto LABEL_42;
}
v25 = TokenIsOwner;
p_AceCount = (unsigned __int16 *)((char *)&v27[2 * v39] + ((8i64 * (v38 & 2)) | 0xC));
goto LABEL_21;
case 4u:
if( !SepSidInToken(EToken, 0i64, &v27[2].AceCount + 2 * HIBYTE(v27[1].AceCount), 0, v25, AppLocker) )
break;
v33 = v65;
p_AceCount = &v27[1].AceCount;
goto LABEL_22;
case 1u:
LABEL_60:
if( SepSidInToken(EToken, 0i64, &v27[1], 1u, v25, AppLocker)
&& (*(_DWORD *)(v21 + 24) & *(_DWORD *)&v27->AceCount) != 0 )
{
AuthzBasepSetAccessReasons(
(unsigned int)(*(_DWORD *)(v21 + 24) & *(_DWORD *)&v27->AceCount),
0x20000ui64,
v26,
*(_ACCESS_REASONS **)(v21 + 40),
0);
goto LABEL_27;
}
break;
case 6u:
if( !SepSidInToken(
EToken,
0i64,
(char *)&v27[2 * (*(_DWORD *)&v27[1].AclRevision & 1)]
+ ((8i64 * (*(_DWORD *)&v27[1].AclRevision & 2)) | 0xC),
1u,
v25,
AppLocker) )
break;
v41 = (_GUID *)((unsigned __int64)&v27[1].AceCount & -(__int64)((*(_DWORD *)&v27[1].AclRevision & 1) != 0));
if( v41 && Restricted )
{
if( !AuthzBasepObjectInTypeList(v41, (_IOBJECT_TYPE_LIST *)v21, v19, &ReturnedIndex) )
break;
v42 = (*(_DWORD *)(v21 + 48i64 * (unsigned int)ReturnedIndex + 24) & *(_DWORD *)&v27->AceCount) == 0;
}
else
{
v42 = (*(_DWORD *)&v27->AceCount & *(_DWORD *)(v21 + 24)) == 0;
}
if( !v42 )
goto LABEL_27;
break;
case 9u:
v43 = 4 * v27[1].Sbz1 + 8;
if( v27->AclSize - v43 == 8 )
goto LABEL_42;
if( Sacl && !*ResourceInfo )
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
pClaimAttributes = EToken->pClaimAttributes;
if( pClaimAttributes )
pRestrictedDeviceSecurityAttributes = pClaimAttributes->pRestrictedDeviceSecurityAttributes;
else
pRestrictedDeviceSecurityAttributes = 0i64;
if( pClaimAttributes )
pDeviceSecurityAttributes = pClaimAttributes->pDeviceSecurityAttributes;
else
pDeviceSecurityAttributes = 0i64;
if( pClaimAttributes )
pRestrictedUserSecurityAttributes = pClaimAttributes->pRestrictedUserSecurityAttributes;
else
pRestrictedUserSecurityAttributes = 0i64;
if( pClaimAttributes )
pUserSecurityAttributes = pClaimAttributes->pUserSecurityAttributes;
else
pUserSecurityAttributes = 0i64;
v49 = v27->AclSize - v43 - 8;
v50 = v43;
v25 = TokenIsOwner;
LODWORD(ConditionSize) = v49;
AuthzBasepEvaluateAceCondition(
EToken,
EToken->pSecurityAttributes,
*ResourceInfo,
pUserSecurityAttributes,
pRestrictedUserSecurityAttributes,
pDeviceSecurityAttributes,
pRestrictedDeviceSecurityAttributes,
(UINT8 *)&v27[1] + v50,
ConditionSize,
0,
TokenIsOwner,
(INT64 *)&LocalTypeListLength);
if( (_DWORD)LocalTypeListLength == 1 )
{
v31 = v63 == 0;
goto LABEL_13;
}
break;
default:
if( (_BYTE)PackageCapabilityInfo && AclRevision == 10 && KeGetCurrentIrql() < 2u )
{
v51 = 4 * v27[1].Sbz1 + 8;
if( v27->AclSize - v51 == 8 )
goto LABEL_42;
if( Sacl && !*ResourceInfo )
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
v52 = EToken->pClaimAttributes;
v53 = v52 ? v52->pRestrictedDeviceSecurityAttributes : 0i64;
v54 = v52 ? v52->pDeviceSecurityAttributes : 0i64;
v55 = v52 ? v52->pRestrictedUserSecurityAttributes : 0i64;
v56 = v52 ? v52->pUserSecurityAttributes : 0i64;
v57 = v27->AclSize - v51 - 8;
v58 = v51;
v25 = TokenIsOwner;
LODWORD(ConditionSize) = v57;
AuthzBasepEvaluateAceCondition(
EToken,
EToken->pSecurityAttributes,
*ResourceInfo,
v56,
v55,
v54,
v53,
(UINT8 *)&v27[1] + v58,
ConditionSize,
1u,
TokenIsOwner,
(INT64 *)&LocalTypeListLength);
if( (((_DWORD)LocalTypeListLength + 1) & 0xFFFFFFFD) == 0 )
goto LABEL_60;
}
break;
}
}
LABEL_24:
++v26;
v19 = (unsigned int)LocalTypeList;
v27 = (_ACL *)((char *)v27 + v27->AclSize);
v28 = v26 == AceCount;
if( v26 >= AceCount )
break;
v18 = v63;
}
}
if( v28 )
{
v34 = (_ACCESS_REASONS **)(v21 + 24);
if( *(_DWORD *)(v21 + 24) )
{
if( v19 )
{
v35 = v19;
do
{
AuthzBasepSetAccessReasons(*(unsigned int *)v34, 0x800000ui64, 0i64, v34[2], 0);
v34 += 6;
--v35;
}
while( v35 );
}
}
}
}Referenced by:
SepAccessCheckEx