SepMaximumAccessCheckEx
VOID __stdcall SepMaximumAccessCheckEx(
VOID *EToken,
VOID *PrimaryToken,
_ACL *Dacl,
_ACL *Sacl,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **ResourceInfo,
VOID *LocalTypeListLength,
_IOBJECT_TYPE_LIST *LocalTypeList,
_IOBJECT_TYPE_LIST *ObjectTypeListLength,
UINT64 RestrictionMask,
UINT8 Restricted,
UINT8 TokenIsOwner,
UINT8 AppLocker,
_SE_PACKAGE_CAPABILITY_INFO *PackageCapabilityInfo,
_SE_PACKAGE_CAPABILITY_INFO *a14){
int v15;
int v17;
UINT8 bRestricted;
_IOBJECT_TYPE_LIST *v19;
__int64 v20;
unsigned int AceCount;
unsigned int v22;
_ACL *v23;
_SE_PACKAGE_CAPABILITY_INFO *v24;
unsigned __int8 AclRevision;
UINT8 v26;
UINT64 v27;
_IOBJECT_TYPE_LIST *v28;
__int64 v29;
_IOBJECT_TYPE_LIST v30;
int v31;
_ACL *v32;
unsigned int *p_PackageGrantedAccess;
int v34;
__int64 v35;
_GUID *v36;
_ACL *v37;
UINT8 v38;
_ACCESS_REASONS *v39;
UINT64 v40;
unsigned int v41;
_QWORD *v42;
VOID *v43;
VOID *v44;
VOID *v45;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v46;
unsigned int v47;
_QWORD *v48;
VOID *v49;
VOID *v50;
VOID *v51;
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v52;
int *v53;
int v54;
__int64 v55;
UINT64 OverWrite;
_ACCESS_MASK_FIELD_TO_UPDATE v57;
UINT64 ConditionSize;
unsigned int v59;
UINT64 ReturnedIndex;
VOID *v61;
INT64 Result;
_ACL *v63;
v63 = Sacl;
v61 = PrimaryToken;
LODWORD(ReturnedIndex) = 0;
v15 = *((_DWORD *)EToken + 50);
LODWORD(Result) = 0;
v17 = v15 & 0x2000;
bRestricted = TokenIsOwner;
v19 = ObjectTypeListLength;
v20 = (unsigned int)LocalTypeList;
LODWORD(LocalTypeListLength) = v17;
if( TokenIsOwner && (_DWORD)LocalTypeList )
{
v28 = ObjectTypeListLength + 7;
v29 = (unsigned int)LocalTypeList;
do
{
AuthzBasepSetAccessReasons((unsigned int)*v28, 0x800000ui64, 0i64, *(_ACCESS_REASONS **)(v28 + 3), 1u);
v30 = *v28;
*v28 &= v31;
*(v28 - 1) = v30;
v28 += 12;
--v29;
}
while( v29 );
bRestricted = TokenIsOwner;
v17 = (int)LocalTypeListLength;
Sacl = v63;
}
AceCount = Dacl->AceCount;
v22 = 0;
v23 = Dacl + 1;
v59 = AceCount;
if( AceCount )
{
v24 = a14;
do
{
if( (v23->Sbz1 & 8) != 0 )
goto LABEL_12;
AclRevision = v23->AclRevision;
if( v23->AclRevision )
{
if( AclRevision == 5 )
{
v34 = *(_DWORD *)&v23[1].AclRevision;
v35 = v34 & 1;
v36 = (_GUID *)((unsigned __int64)&v23[1].AceCount & -(__int64)((v34 & 1) != 0));
if( v36 )
{
if( !(_DWORD)RestrictionMask
|| !SepSidInToken(
EToken,
0i64,
(char *)&v23[2 * v35] + ((8i64 * (v34 & 2)) | 0xC),
0,
bRestricted,
AppLocker)
|| !AuthzBasepObjectInTypeList(v36, v19, (unsigned int)v20, &ReturnedIndex) )
{
goto LABEL_12;
}
v57 = 1;
goto LABEL_35;
}
v37 = (_ACL *)((char *)&v23[2 * v35] + ((8i64 * (v34 & 2)) | 0xC));
LABEL_30:
v26 = SepSidInToken(EToken, 0i64, v37, 0, bRestricted, AppLocker);
goto LABEL_8;
}
if( AclRevision != 4 )
{
if( AclRevision == 1 )
goto LABEL_90;
if( AclRevision == 6 )
{
if( !SepSidInToken(
EToken,
0i64,
(char *)&v23[2 * (*(_DWORD *)&v23[1].AclRevision & 1)]
+ ((8i64 * (*(_DWORD *)&v23[1].AclRevision & 2)) | 0xC),
1u,
bRestricted,
AppLocker) )
goto LABEL_12;
if( ((unsigned __int64)&v23[1].AceCount & -(__int64)((*(_DWORD *)&v23[1].AclRevision & 1) != 0)) != 0 )
{
if( !(_DWORD)RestrictionMask )
{
v39 = (_ACCESS_REASONS *)*((_QWORD *)v19 + 5);
v40 = *(_DWORD *)&v23->AceCount & (unsigned int)~v19[7];
v19[8] |= v40;
AuthzBasepSetAccessReasons(v40, 0x20000ui64, v22, v39, 0);
goto LABEL_12;
}
if( !AuthzBasepObjectInTypeList(
(_GUID *)((unsigned __int64)&v23[1].AceCount & -(__int64)((*(_DWORD *)&v23[1].AclRevision & 1) != 0)),
v19,
(unsigned int)v20,
&ReturnedIndex) )
goto LABEL_12;
v57 = 2;
LABEL_35:
v27 = (unsigned int)ReturnedIndex;
LABEL_11:
LODWORD(OverWrite) = *(_DWORD *)&v23->AceCount;
AuthzBasepAddAccessTypeList(v19, (unsigned int)v20, v27, v22, OverWrite, v57);
goto LABEL_12;
}
LABEL_91:
v57 = 2;
LABEL_10:
v27 = 0i64;
goto LABEL_11;
}
if( AclRevision != 9 )
{
if( !(_BYTE)PackageCapabilityInfo )
goto LABEL_12;
if( AclRevision != 10 )
goto LABEL_12;
if( KeGetCurrentIrql() >= 2u )
goto LABEL_12;
v47 = 4 * v23[1].Sbz1 + 8;
if( v23->AclSize - v47 == 8 )
goto LABEL_12;
if( Sacl && !*ResourceInfo )
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
v48 = (_QWORD *)*((_QWORD *)EToken + 137);
v49 = v48 ? (VOID *)v48[75] : 0i64;
v50 = v48 ? (VOID *)v48[73] : 0i64;
v51 = v48 ? (VOID *)v48[74] : 0i64;
v52 = v48 ? (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v48[72] : 0i64;
LODWORD(ConditionSize) = v23->AclSize - v47 - 8;
AuthzBasepEvaluateAceCondition(
EToken,
*((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)EToken + 97),
*ResourceInfo,
v52,
v51,
v50,
v49,
(UINT8 *)&v23[1] + v47,
ConditionSize,
1u,
bRestricted,
&Result);
if( (((_DWORD)Result + 1) & 0xFFFFFFFD) != 0 )
goto LABEL_12;
LABEL_90:
if( !SepSidInToken(EToken, 0i64, &v23[1], 1u, bRestricted, AppLocker) )
goto LABEL_12;
goto LABEL_91;
}
v41 = 4 * v23[1].Sbz1 + 8;
if( v23->AclSize - v41 == 8 )
goto LABEL_12;
if( Sacl && !*ResourceInfo )
AuthzBasepInitializeResourceClaimsFromSacl(Sacl, ResourceInfo);
v42 = (_QWORD *)*((_QWORD *)EToken + 137);
v43 = v42 ? (VOID *)v42[75] : 0i64;
v44 = v42 ? (VOID *)v42[73] : 0i64;
v45 = v42 ? (VOID *)v42[74] : 0i64;
v46 = v42 ? (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)v42[72] : 0i64;
LODWORD(ConditionSize) = v23->AclSize - v41 - 8;
AuthzBasepEvaluateAceCondition(
EToken,
*((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)EToken + 97),
*ResourceInfo,
v46,
v45,
v44,
v43,
(UINT8 *)&v23[1] + v41,
ConditionSize,
0,
bRestricted,
&Result);
if( (_DWORD)Result != 1 )
goto LABEL_12;
if( !(_DWORD)LocalTypeListLength && !bRestricted )
{
v32 = v23 + 1;
if( SepIsPackageSid(&v23[1]) )
{
LABEL_23:
ConditionSize = (UINT64)&v24[1].PackageGrantedAccess;
p_PackageGrantedAccess = &v24->PackageGrantedAccess;
SepMatchPackage(
(_TOKEN *)EToken,
0xFFFFFFFFui64,
v32,
*(unsigned int *)&v23->AceCount,
(UINT8 *)&v24[1].Remaining + 1,
(UINT64 *)&v24->PackageGrantedAccess,
(UINT8 *)&v24[1]);
LABEL_25:
bRestricted = TokenIsOwner;
v24->Remaining &= ~*p_PackageGrantedAccess;
goto LABEL_12;
}
if( SepIsCapabilitySid(&v23[1]) )
goto LABEL_24;
bRestricted = TokenIsOwner;
}
v37 = v23 + 1;
goto LABEL_30;
}
v38 = AppLocker;
if( !SepSidInToken(EToken, 0i64, &v23[2].AceCount + 2 * HIBYTE(v23[1].AceCount), 0, bRestricted, AppLocker) )
goto LABEL_12;
v26 = SepSidInToken(v61, 0i64, &v23[1].AceCount, 0, 0, v38);
}
else
{
if( !v17 && !bRestricted )
{
v32 = v23 + 1;
if( SepIsPackageSid(&v23[1]) )
goto LABEL_23;
if( SepIsCapabilitySid(&v23[1]) )
{
LABEL_24:
p_PackageGrantedAccess = &v24->CapabilityGrantedAccess;
SepMatchCapability(
(_TOKEN *)EToken,
0xFFFFFFFFui64,
v32,
*(unsigned int *)&v23->AceCount,
(UINT8 *)&v24[1].Remaining + 2,
(UINT64 *)&v24->CapabilityGrantedAccess);
goto LABEL_25;
}
bRestricted = TokenIsOwner;
}
v26 = SepSidInToken(EToken, 0i64, &v23[1], 0, bRestricted, AppLocker);
}
LABEL_8:
if( v26 )
{
v57 = 1;
goto LABEL_10;
}
LABEL_12:
++v22;
v17 = (int)LocalTypeListLength;
v23 = (_ACL *)((char *)v23 + v23->AclSize);
Sacl = v63;
}
while( v22 < v59 );
}
if( bRestricted && (_DWORD)v20 )
{
v53 = v19 + 7;
v54 = ~Restricted;
v55 = v20;
do
{
*v53 = *(v53 - 1) & (v54 | *v53);
v53 += 12;
--v55;
}
while( v55 );
}
}Referenced by:
SepAccessCheckEx