SeReleaseSubjectContext
VOID *__stdcall SeReleaseSubjectContext(PSECURITY_SUBJECT_CONTEXT SubjectContext){
VOID *result;
_ADAPTER_OBJECT *ClientToken;
_QWORD *PrimaryToken;
if( SeTokenLeakTracking )
{
PrimaryToken = SubjectContext->PrimaryToken;
if( PrimaryToken )
{
_InterlockedDecrement((volatile signed __int32 *)(PrimaryToken[143] + 284i64));
if( SubjectContext->PrimaryToken == (void *)SepTokenLeakToken )
__debugbreak();
}
if( SubjectContext->ClientToken )
{
_InterlockedDecrement((volatile signed __int32 *)(*((_QWORD *)SubjectContext->ClientToken + 143) + 284i64));
if( SubjectContext->ClientToken == (void *)SepTokenLeakToken )
__debugbreak();
}
}
ObFastDereferenceObject(&KeGetCurrentThread()->ApcState.Process->Token, SubjectContext->PrimaryToken);
ClientToken = (_ADAPTER_OBJECT *)SubjectContext->ClientToken;
SubjectContext->PrimaryToken = 0i64;
if( ClientToken )
HalPutDmaAdapter(ClientToken);
SubjectContext->ClientToken = 0i64;
return result;
}Referenced by:
AlpcpCheckConnectionSecurity
CMFCheckAccess
CmFcInitSystem2
CmKeyBodyRemapToVirtualForEnum
CmQueryKey
CmQueryLayeredKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpCheckHivePrimaryFileReadWriteAccess
CmpCheckKeySecurityDescriptorAccess
CmpDoAccessCheckOnKCB
CmpFlushNotify
CmpIsSystemEntity
CmpLogHiveFileInaccessible
CmpSetKeySecurity
CmpVEExecuteParseLogic
EtwpAccessCheck
EtwpCheckProviderLoggingAccess
EtwpCoverageUserIsAdmin
EtwpRegisterUMGuid
ExCpuSetResourceManagerAccessCheck
ExIsRestrictedCaller
ExpCheckWakeTimerAccess
ExpWnfCheckCallerAccess
FsRtlCancelNotify
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterChangeDirectoryLite
IoCheckRedirectionTrustLevel
IoComputeRedirectionTrustLevel
IoGetDeviceInterfaceAlias
IopGetDeviceInterfaces
IopXxxControlFile
NtCloseObjectAuditAlarm
NtCreateUserProcess
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtDuplicateToken
NtImpersonateAnonymousToken
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtRenameKey
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationProcess
NtSetUuidSeed
NtSetValueKey
ObInsertObjectEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCaptureBoundaryDescriptor
ObpLookupObjectName
ObpVerifyCreatorAccessCheck
PiAuCheckTokenMembership
PiAuDoesClientHavePrivilege
PiAuVerifyAccessToObject
PiCMGetDeviceIdList
PiCMValidateDeviceInstance
PiDqOpenUserObjectRegKey
PiDqQueryRelease
PiPnpRtlObjectEventRelease
PiUEventFreeClientRegistrationContext
PnpGetCallerSessionId
PopBootStatAccessCheck
PsOpenProcess
PsOpenThread
PspCombineSecurityDomains
PspDeleteObjectAccessState
PspInsertThread
PspIsContextAdmin
PspIumVerifyParentSd
PspJobDelete
PspOneDirectionSecurityDomainCombine
PspSetQuotaLimits
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlIsSandboxedToken
RtlpSetSecurityObject
SeAccessCheckByTypeWithAdminlessChecks
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeAuditingWithTokenForSubcategory
SeCheckPrivilegedObject
SeCloseObjectAuditAlarm
SeDeleteAccessState
SeDeleteObjectAuditAlarmWithTransaction
SeIsAppContainerOrIdentifyLevelContext
SeOpenObjectAuditAlarmWithTransaction
SeOperationAuditAlarm
SeReportSecurityEventWithSubCategory
SeSecurityDescriptorChangedAuditAlarm
SeSinglePrivilegeCheck
SeSubProcessToken
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepAdtAuditPrivilegeUseWithContext
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepCheckCreateLowBox
SepFilterToken
VfUtilIsLocalSystem
WdipAccessCheck
WmipCreateGuidObject
sub_1405F50F8