SepAccessCheckEx
NTSTATUS __fastcall SepAccessCheckEx(
VOID *SecurityDescriptor,
VOID *PrincipalSelfSid,
_TOKEN *PrimaryToken,
_TOKEN *ClientToken,
UINT64 DesiredAccess,
_IOBJECT_TYPE_LIST *ObjectTypeList,
VOID *ObjectTypeListLength,
_GENERIC_MAPPING *GenericMapping,
UINT64 PreviouslyGrantedAccess,
INT8 PreviousMode,
UINT64 *GrantedAccess,
PRIVILEGE_SET **Privileges,
INT64 *AccessStatus,
_ACCESS_REASONS *AccessReason,
UINT8 ReturnResultList,
UINT8 TokenIsOwner,
UINT8 AppLocker,
_SE_PACKAGE_CAPABILITY_INFO *PackageCapabilityInfo,
_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **ResourceInfo,
UINT8 *ReturnSomeAccessGranted,
UINT8 *ReturnSomeAccessDenied){
unsigned int v21;
PRIVILEGE_SET **v22;
unsigned int *v25;
_GENERIC_MAPPING *v28;
char v29;
unsigned int v30;
unsigned int v31;
unsigned int v32;
_IOBJECT_TYPE_LIST *v33;
__int64 v34;
__int16 v35;
__int16 v36;
__int64 v37;
_ACL *v38;
unsigned int TokenFlags;
_IOBJECT_TYPE_LIST v40;
UINT64 v41;
UINT8 v42;
int v43;
NTSTATUS result;
_TOKEN *v45;
unsigned int v46;
unsigned int v47;
int v48;
unsigned int v49;
int v50;
int v51;
__int64 v52;
_LUID v53;
UINT8 v54;
_IOBJECT_TYPE_LIST *v55;
UINT64 v56;
UINT64 v57;
UINT64 v58;
UINT64 v59;
unsigned int v60;
unsigned int v61;
unsigned int v62;
unsigned int v63;
unsigned int Restricted;
int v65;
UINT64 v66;
UINT64 v67;
UINT64 TypeListCount;
UINT64 TypeListCountc;
UINT64 TypeListCounta;
UINT64 TypeListCountb;
UINT8 LocalTypeListLength;
_IOBJECT_TYPE_LIST *LocalTypeList;
_IOBJECT_TYPE_LIST *LocalTypeLista;
_IOBJECT_TYPE_LIST *v75;
_IOBJECT_TYPE_LIST *v76;
UINT64 RestrictionMask;
UINT64 RestrictionMaska;
_SE_PACKAGE_CAPABILITY_INFO *v79;
_SE_PACKAGE_CAPABILITY_INFO *v80;
_SE_PACKAGE_CAPABILITY_INFO *v81;
_SE_PACKAGE_CAPABILITY_INFO *v82;
_SE_PACKAGE_CAPABILITY_INFO *v83;
UINT8 SystemSecurity;
UINT8 Relabel;
UINT8 WriteOwner;
unsigned int PrivilegeCount;
_TOKEN *PrivilegeCount_4;
_ACL *Dacla;
_TOKEN *PrimaryTokena;
_LUID_AND_ATTRIBUTES Sacl;
_LUID_AND_ATTRIBUTES RequiredPrivileges;
UINT64 v94[2];
__int128 v95;
__int128 v96;
char v97;
v21 = 0;
v22 = Privileges;
v25 = (unsigned int *)SecurityDescriptor;
v28 = GenericMapping;
v29 = 1;
if( !ClientToken )
ClientToken = PrimaryToken;
PrimaryTokena = PrimaryToken;
v30 = DesiredAccess;
v31 = DesiredAccess;
PrivilegeCount = 0;
SystemSecurity = 0;
WriteOwner = 0;
Relabel = 0;
PrivilegeCount_4 = ClientToken;
*(_OWORD *)v94 = 0i64;
v95 = 0i64;
v96 = 0i64;
if( (_DWORD)ObjectTypeListLength )
{
v32 = (unsigned int)ObjectTypeListLength;
}
else
{
DWORD1(v95) = -1;
ObjectTypeList = (_IOBJECT_TYPE_LIST *)v94;
v32 = 1;
}
v33 = ObjectTypeList + 10;
v34 = v32;
do
{
*(_QWORD *)v33 = AccessReason++;
v33 += 12;
--v34;
}
while( v34 );
if( (DesiredAccess & 0x1000000) == 0 )
{
v21 = PreviouslyGrantedAccess;
goto LABEL_9;
}
Sacl.Luid = SeSecurityPrivilege;
Sacl.Attributes = 0;
v54 = SepPrivilegeCheck(ClientToken, &Sacl, 1ui64, 1ui64, PreviousMode);
v55 = ObjectTypeList;
v56 = 0x1000000i64;
v57 = 8i64;
if( !v54 )
{
v43 = -1073741727;
v58 = 0x100000i64;
goto LABEL_56;
}
LODWORD(TypeListCount) = v32;
v21 = PreviouslyGrantedAccess | 0x1000000;
AuthzBasepSetTypeListAccessReasons(0x1000000ui64, 0x200000ui64, 8ui64, ObjectTypeList, TypeListCount, 0);
v41 = 1i64;
v42 = 1;
PrivilegeCount = 1;
SystemSecurity = 1;
v31 = DesiredAccess & 0xFEFFFFFF;
if( (DesiredAccess & 0xFEFFFFFF) != 0 )
{
ClientToken = PrivilegeCount_4;
v25 = (unsigned int *)SecurityDescriptor;
v30 = DesiredAccess;
v28 = GenericMapping;
LABEL_9:
v35 = *((_WORD *)v25 + 1);
v36 = v35 & 4;
if( (v35 & 4) != 0 )
{
if( v35 >= 0 )
{
v38 = (_ACL *)*((_QWORD *)v25 + 4);
goto LABEL_13;
}
v37 = v25[4];
v38 = 0i64;
if( (_DWORD)v37 )
{
v38 = (_ACL *)((char *)v25 + v37);
LABEL_13:
Dacla = v38;
goto LABEL_14;
}
}
else
{
v38 = 0i64;
}
Dacla = 0i64;
LABEL_14:
if( (v35 & 0x10) == 0 )
{
LABEL_15:
Sacl.Luid = 0i64;
LABEL_16:
if( !v36 || !v38 )
{
v65 = v21 | v30;
LODWORD(TypeListCount) = v32;
v21 |= v30;
if( (v30 & 0x2000000) != 0 )
{
v21 = v65 & 0xFDFFFFFF | v28->GenericAll;
AuthzBasepSetTypeListAccessReasons(v21, 0x500000ui64, 0i64, ObjectTypeList, TypeListCount, 0);
if( (PrivilegeCount_4->TokenFlags & 0x4000) == 0 )
goto LABEL_25;
LocalTypeListLength = 1;
}
else
{
AuthzBasepSetTypeListAccessReasons(v30, 0x500000ui64, 0i64, ObjectTypeList, TypeListCount, 0);
if( (PrivilegeCount_4->TokenFlags & 0x4000) == 0 )
goto LABEL_25;
LocalTypeListLength = 0;
}
LODWORD(TypeListCountb) = v32;
v21 = 0;
AuthzBasepSetTypeListAccessReasons(0i64, v66, v67, ObjectTypeList, TypeListCountb, LocalTypeListLength);
BYTE1(PackageCapabilityInfo[1].Remaining) = 0;
PackageCapabilityInfo->PackageGrantedAccess = 0;
goto LABEL_100;
}
if( (v31 & 0x80000) == 0 )
goto LABEL_19;
RequiredPrivileges.Luid = (_LUID)SeTakeOwnershipPrivilege;
RequiredPrivileges.Attributes = 0;
if( SepPrivilegeCheck(ClientToken, &RequiredPrivileges, 1ui64, 1ui64, PreviousMode) )
{
LODWORD(TypeListCounta) = v32;
v21 |= 0x80000u;
AuthzBasepSetTypeListAccessReasons(0x80000ui64, 0x200000ui64, 9ui64, ObjectTypeList, TypeListCounta, 0);
WriteOwner = 1;
}
else
{
RequiredPrivileges.Luid = (_LUID)SeRelabelPrivilege;
RequiredPrivileges.Attributes = 0;
if( !SepPrivilegeCheck(PrivilegeCount_4, &RequiredPrivileges, v59, 1ui64, PreviousMode) )
{
LABEL_19:
if( v38->AceCount )
{
LOBYTE(v82) = v97;
LOBYTE(v79) = AppLocker;
if( (DesiredAccess & 0x2000000) != 0 )
{
LODWORD(RestrictionMask) = (_DWORD)ObjectTypeListLength;
LODWORD(LocalTypeList) = v32;
SepMaximumAccessCheckEx(
PrivilegeCount_4,
PrimaryTokena,
Dacla,
*(_ACL **)&Sacl.Luid,
ResourceInfo,
0i64,
LocalTypeList,
ObjectTypeList,
RestrictionMask,
0,
0,
TokenIsOwner,
v79,
PackageCapabilityInfo);
LODWORD(TypeListCountc) = v32;
AuthzBasepSetTypeListAccessReasons(0xFFFFFFFFui64, 0x800000ui64, 0i64, ObjectTypeList, TypeListCountc, 0);
TokenFlags = PrivilegeCount_4->TokenFlags;
if( (TokenFlags & 0x10) != 0 )
{
if( (TokenFlags & 8) != 0 )
Restricted = GenericMapping->GenericWrite & ~(GenericMapping->GenericRead | GenericMapping->GenericExecute) | 0x10D0000;
else
Restricted = GenericMapping->GenericAll | 0x1FFFFF;
LOBYTE(v80) = AppLocker;
LODWORD(RestrictionMaska) = (_DWORD)ObjectTypeListLength;
LODWORD(LocalTypeLista) = v32;
SepMaximumAccessCheckEx(
PrivilegeCount_4,
PrimaryTokena,
Dacla,
*(_ACL **)&Sacl.Luid,
ResourceInfo,
0i64,
LocalTypeLista,
ObjectTypeList,
RestrictionMaska,
Restricted,
1u,
TokenIsOwner,
v80,
PackageCapabilityInfo);
TokenFlags = PrivilegeCount_4->TokenFlags;
}
v40 = ObjectTypeList[7];
if( (TokenFlags & 0x2000) != 0 )
goto LABEL_23;
if( (TokenFlags & 0x4000) != 0 )
{
v40 &= PackageCapabilityInfo->PackageGrantedAccess | PackageCapabilityInfo->CapabilityGrantedAccess;
}
else
{
if( !LOBYTE(PackageCapabilityInfo[1].Remaining) )
{
LABEL_23:
if( (~(v40 | 0x2000000) & v31) != 0 )
{
v43 = -1073741790;
v21 = 0;
goto LABEL_30;
}
v21 |= v40;
goto LABEL_25;
}
v40 &= PackageCapabilityInfo->PackageGrantedAccess;
}
v21 &= ~PackageCapabilityInfo->Remaining;
goto LABEL_23;
}
LODWORD(v75) = v32;
SepNormalAccessCheckEx(
v31,
PrivilegeCount_4,
PrimaryTokena,
Dacla,
*(_ACL **)&Sacl.Luid,
ResourceInfo,
0i64,
v75,
(UINT64)ObjectTypeList,
(UINT8)ObjectTypeListLength,
0,
TokenIsOwner,
v79,
(UINT8)PackageCapabilityInfo,
v82);
PackageCapabilityInfo->UserGroupsRemaining = ObjectTypeList[6];
if( ObjectTypeList[6] )
goto LABEL_44;
v45 = PrivilegeCount_4;
v46 = PrivilegeCount_4->TokenFlags;
if( (v46 & 0x10) != 0 )
{
if( (v46 & 8) != 0 )
v61 = GenericMapping->GenericWrite & ~(GenericMapping->GenericRead | GenericMapping->GenericExecute) | 0x10D0000;
else
v61 = GenericMapping->GenericAll | 0x1FFFFF;
v48 = DesiredAccess;
v47 = 0;
if( (v61 & (unsigned int)DesiredAccess) == 0 )
{
LABEL_37:
PackageCapabilityInfo->UserGroupsRemaining = v47;
if( !ObjectTypeList[6] )
{
v49 = v45->TokenFlags;
if( (v49 & 0x2000) != 0 )
{
LABEL_42:
v21 |= v48;
LABEL_25:
v41 = PrivilegeCount;
LABEL_26:
v42 = SystemSecurity;
v22 = Privileges;
goto LABEL_27;
}
v50 = v48 | v31;
if( (v49 & 0x4000) != 0 )
{
v62 = ~(PackageCapabilityInfo->PackageGrantedAccess | PackageCapabilityInfo->CapabilityGrantedAccess);
v63 = v50 | PackageCapabilityInfo->Remaining;
}
else
{
v51 = 0;
if( !LOBYTE(PackageCapabilityInfo[1].Remaining) )
goto LABEL_41;
v62 = v50 | PackageCapabilityInfo->Remaining;
v63 = ~PackageCapabilityInfo->PackageGrantedAccess;
}
v51 = v63 & v62;
LABEL_41:
ObjectTypeList[6] = v51;
if( v51 )
{
v43 = -1073741790;
v21 = 0;
goto LABEL_30;
}
goto LABEL_42;
}
LABEL_44:
v43 = -1073741790;
LABEL_45:
v21 = 0;
goto LABEL_30;
}
LOBYTE(v83) = v97;
LOBYTE(v81) = AppLocker;
LODWORD(v76) = v32;
SepNormalAccessCheckEx(
v31 & v61,
PrivilegeCount_4,
PrimaryTokena,
Dacla,
*(_ACL **)&Sacl.Luid,
ResourceInfo,
0i64,
v76,
(UINT64)ObjectTypeList,
(UINT8)ObjectTypeListLength,
1u,
TokenIsOwner,
v81,
(UINT8)PackageCapabilityInfo,
v83);
v47 = ObjectTypeList[6];
v45 = PrivilegeCount_4;
}
else
{
v47 = 0;
}
v48 = DesiredAccess;
goto LABEL_37;
}
PackageCapabilityInfo->UserGroupsRemaining = v31;
v60 = PrivilegeCount_4->TokenFlags;
if( (v60 & 0x4000) != 0 )
v21 &= ~PackageCapabilityInfo->Remaining;
if( v31 == 0x2000000 )
{
if( v21 )
goto LABEL_25;
}
else if( !v31 && PackageCapabilityInfo->Remaining && v21 && (v60 & 0x6000) == 0 )
{
goto LABEL_25;
}
v21 = 0;
v43 = -1073741790;
v55 = ObjectTypeList;
v57 = 0i64;
v58 = 6291456i64;
v56 = 4261412863i64;
LABEL_56:
LODWORD(TypeListCount) = v32;
AuthzBasepSetTypeListAccessReasons(v56, v58, v57, v55, TypeListCount, 0);
goto LABEL_30;
}
v21 |= 0x80000u;
LODWORD(TypeListCount) = v32;
AuthzBasepSetTypeListAccessReasons(0x80000ui64, 0x200000ui64, 0x20ui64, ObjectTypeList, TypeListCount, 0);
Relabel = 1;
}
v41 = ++PrivilegeCount;
v31 &= ~0x80000u;
if( !v31 )
goto LABEL_26;
goto LABEL_19;
}
if( v35 >= 0 )
{
v53 = (_LUID)*((_QWORD *)v25 + 3);
}
else
{
v52 = v25[3];
if( !(_DWORD)v52 )
goto LABEL_15;
v53 = (_LUID)((char *)v25 + v52);
}
Sacl.Luid = v53;
goto LABEL_16;
}
LABEL_27:
if( !v21 )
{
LABEL_100:
v43 = -1073741790;
goto LABEL_30;
}
v43 = 0;
if( KeGetCurrentIrql() < 2u )
{
if( (_DWORD)v41 )
{
SepAssemblePrivileges(v41, v42, WriteOwner, Relabel, v22);
if( v22 )
{
if( !*v22 )
{
v29 = 0;
v43 = -1073741801;
goto LABEL_45;
}
}
}
}
LABEL_30:
*(_DWORD *)AccessStatus = v43;
*(_DWORD *)GrantedAccess = v21;
result = (int)ReturnSomeAccessGranted;
if( ReturnSomeAccessGranted )
*ReturnSomeAccessGranted = v43 >= 0;
LOBYTE(result) = v29;
return result;
}Referenced by:
SepCommonAccessCheckExWithAdminlessChecks