SeAdtRegistryValueChangedAuditAlarm
VOID __stdcall SeAdtRegistryValueChangedAuditAlarm(
_SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
PVOID SecurityDescriptor,
_UNICODE_STRING *AbsoluteObjectName,
_UNICODE_STRING *ValueName,
PVOID Object,
PVOID HandleId,
_SE_CM_VALUE_AUDIT *ValueChangeInfo,
SeCmAuditType AuditOperationType){
_OBJECT_NAME_INFORMATION *v10;
void *ClientToken;
void *PrimaryToken;
void *v13;
__int16 v14;
VOID *v15;
_ACL *v16;
_ACL *v17;
__int64 v18;
__int64 v19;
__int16 v20;
VOID *v21;
_ACL *v22;
__int64 v23;
NTSTATUS NameString;
unsigned int v25;
unsigned int v26;
UINT64 v27;
UINT64 v28;
UINT64 v29;
_EPROCESS *CurrentThreadProcess;
unsigned __int64 UniqueProcessId;
_QWORD *v32;
__int64 v33;
_QWORD **v34;
void *v35;
int v36;
UINT8 IsKernelHandle;
unsigned __int64 v38;
_SE_ADT_PARAMETER_TYPE v39;
_SE_ADT_PARAMETER_TYPE v40;
unsigned int v41;
__int64 v42;
unsigned __int64 v43;
unsigned int v44;
UINT8 pFreeWhenDone[8];
PVOID P;
_OBJECT_NAME_INFORMATION *ObjectNameInfo;
_UNICODE_STRING ObjectNameInfo_8;
_UNICODE_STRING ResultantString_8;
_UNICODE_STRING v50;
_UNICODE_STRING pResultantString;
_UNICODE_STRING v52;
_UNICODE_STRING DestinationString;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
_SE_ADT_PARAMETER_ARRAY AuditParameters;
char v56;
char v57;
char v58;
memset(&AuditParameters, 0i64, sizeof(AuditParameters));
ObjectNameInfo = 0i64;
pFreeWhenDone[2] = 0;
v10 = 0i64;
pFreeWhenDone[3] = 0;
pResultantString = 0i64;
P = 0i64;
v52 = 0i64;
pFreeWhenDone[1] = 0;
ObjectNameInfo_8 = 0i64;
ResultantString_8 = 0i64;
v50 = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
DestinationString = 0i64;
SeCaptureSubjectContext((INT64)&SubjectContext);
ClientToken = SubjectContext.ClientToken;
PrimaryToken = SubjectContext.PrimaryToken;
v13 = SubjectContext.PrimaryToken;
if( SubjectContext.ClientToken )
v13 = SubjectContext.ClientToken;
pFreeWhenDone[0] = SeAuditingWithTokenForSubcategory(117i64, (INT64)v13);
if( pFreeWhenDone[0] )
{
v14 = *((_WORD *)SecurityDescriptor + 1);
v15 = PrimaryToken;
if( ClientToken )
v15 = ClientToken;
if( (v14 & 0x10) == 0 )
{
v16 = 0i64;
LABEL_8:
v17 = 0i64;
goto LABEL_18;
}
if( v14 >= 0 )
{
v16 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v18 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v18 )
v16 = (_ACL *)((char *)SecurityDescriptor + v18);
else
v16 = 0i64;
}
if( v14 >= 0 )
{
v17 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v19 = *((unsigned int *)SecurityDescriptor + 3);
if( !(_DWORD)v19 )
goto LABEL_8;
v17 = (_ACL *)((char *)SecurityDescriptor + v19);
}
LABEL_18:
SeExamineSacl(v17, v16, v15, 2ui64, 1u, pFreeWhenDone, &pFreeWhenDone[1]);
RtlInitUnicodeString(&DestinationString, L"Key");
v20 = *((_WORD *)SecurityDescriptor + 1);
v21 = PrimaryToken;
if( ClientToken )
v21 = ClientToken;
if( (v20 & 0x10) == 0 )
goto LABEL_21;
if( v20 >= 0 )
{
v22 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v23 = *((unsigned int *)SecurityDescriptor + 3);
if( !(_DWORD)v23 )
{
LABEL_21:
v22 = 0i64;
goto LABEL_26;
}
v22 = (_ACL *)((char *)SecurityDescriptor + v23);
}
LABEL_26:
SeExamineGlobalSacl(&DestinationString, v22, v21, 2ui64, 1u, pFreeWhenDone, &pFreeWhenDone[1]);
if( !pFreeWhenDone[0] )
goto LABEL_52;
if( Object )
{
NameString = SepQueryNameString(Object, (PVOID *)&ObjectNameInfo);
if( NameString < 0 )
goto LABEL_43;
if( ObjectNameInfo )
v10 = ObjectNameInfo;
}
v25 = 4096;
if( AuditOperationType )
{
v26 = ValueChangeInfo[1];
v27 = 4096i64;
if( v26 < 0x1000 )
v27 = v26;
NameString = AdtpBuildRegistryValueString(
(unsigned int)*ValueChangeInfo,
v27,
*((VOID **)ValueChangeInfo + 1),
&pResultantString,
&pFreeWhenDone[2]);
if( NameString < 0 )
goto LABEL_43;
v28 = (unsigned int)(*ValueChangeInfo + 1872);
ObjectNameInfo_8.MaximumLength = 26;
ObjectNameInfo_8.Buffer = (wchar_t *)&v56;
NameString = AdtpBuildReplacementString(v28, &ObjectNameInfo_8);
if( NameString < 0 )
goto LABEL_43;
}
else
{
RtlInitUnicodeString(&pResultantString, L"-");
RtlInitUnicodeString(&ObjectNameInfo_8, L"-");
}
if( AuditOperationType == AuditDeleteRegValue )
{
RtlInitUnicodeString(&v52, L"-");
RtlInitUnicodeString(&ResultantString_8, L"-");
}
else
{
if( (unsigned int)ValueChangeInfo[5] < 0x1000 )
v25 = ValueChangeInfo[5];
NameString = AdtpBuildRegistryValueString(
(unsigned int)ValueChangeInfo[4],
v25,
*((VOID **)ValueChangeInfo + 3),
&v52,
&pFreeWhenDone[3]);
if( NameString < 0 )
goto LABEL_43;
v29 = (unsigned int)(ValueChangeInfo[4] + 1872);
ResultantString_8.MaximumLength = 26;
ResultantString_8.Buffer = (wchar_t *)&v57;
NameString = AdtpBuildReplacementString(v29, &ResultantString_8);
if( NameString < 0 )
goto LABEL_43;
}
v50.MaximumLength = 26;
v50.Buffer = (wchar_t *)&v58;
NameString = AdtpBuildReplacementString((unsigned int)(AuditOperationType + 1904), &v50);
if( NameString >= 0 )
{
CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
NameString = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, (_UNICODE_STRING **)&P);
if( NameString >= 0 )
{
AuditParameters.CategoryId = 3;
v32 = PrimaryToken;
*(_DWORD *)&AuditParameters.FlatSubCategoryId = 524405;
if( ClientToken )
v32 = ClientToken;
AuditParameters.AuditId = 4657;
AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
AuditParameters.Parameters[1].Length = 32;
AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
v33 = v32[19];
AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
AuditParameters.Parameters[2].Length = 8;
AuditParameters.Parameters[0].Length = 4 * *(unsigned __int8 *)(*(_QWORD *)v33 + 1i64) + 8;
v34 = (_QWORD **)PrimaryToken;
if( ClientToken )
{
v34 = (_QWORD **)ClientToken;
PrimaryToken = ClientToken;
}
v35 = (void *)*v34[19];
AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
AuditParameters.Parameters[2].Data[0] = *((_QWORD *)PrimaryToken + 3);
AuditParameters.Parameters[0].Address = v35;
if( v10 )
{
v36 = *(_WORD *)v10;
AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
AuditParameters.Parameters[3].Length = v36 + 16;
AuditParameters.Parameters[3].Address = v10;
}
AuditParameters.Parameters[4].Length = ValueName->Length + 16;
AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
AuditParameters.Parameters[4].Address = ValueName;
AuditParameters.Parameters[5].Type = SeAdtParmTypePtr;
AuditParameters.Parameters[5].Length = 8;
IsKernelHandle = ObpIsKernelHandle(HandleId, 0);
v43 = v42 ^ 0xFFFFFFFF80000000ui64;
AuditParameters.Parameters[6].Type = v40;
AuditParameters.Parameters[7].Type = v40;
if( !IsKernelHandle )
v43 = v38;
AuditParameters.Parameters[8].Type = v40;
AuditParameters.Parameters[9].Type = v40;
AuditParameters.Parameters[6].Length = v50.Length + 16;
AuditParameters.Parameters[5].Data[0] = v43 & 0xFFFFFFFFFFFFFFFCui64;
AuditParameters.Parameters[6].Address = &v50;
AuditParameters.Parameters[12].Address = P;
AuditParameters.Parameters[7].Length = ObjectNameInfo_8.Length + 16;
AuditParameters.Parameters[7].Address = &ObjectNameInfo_8;
AuditParameters.Parameters[10].Type = v40;
AuditParameters.Parameters[8].Length = pResultantString.Length + 16;
AuditParameters.Parameters[8].Address = &pResultantString;
AuditParameters.Parameters[11].Type = v39;
AuditParameters.Parameters[9].Length = ResultantString_8.Length + 16;
AuditParameters.Parameters[9].Address = &ResultantString_8;
AuditParameters.Parameters[11].Length = v41;
AuditParameters.Parameters[10].Length = v52.Length + 16;
AuditParameters.Parameters[10].Address = &v52;
v44 = *(unsigned __int16 *)P + 16;
AuditParameters.Parameters[11].Data[0] = UniqueProcessId;
AuditParameters.Parameters[12].Length = v44;
AuditParameters.Parameters[12].Type = SeAdtParmTypeFileSpec;
AuditParameters.ParameterCount = 13;
SepAdtLogAuditRecord(&AuditParameters);
goto LABEL_44;
}
}
LABEL_43:
SepAuditFailed((unsigned int)NameString);
LABEL_44:
if( pFreeWhenDone[2] )
ExFreePoolWithTag(pResultantString.Buffer, 0);
if( pFreeWhenDone[3] )
ExFreePoolWithTag(v52.Buffer, 0);
if( P )
ExFreePoolWithTag(P, 0);
if( ObjectNameInfo )
ExFreePoolWithTag(ObjectNameInfo, 0);
}
LABEL_52:
SeReleaseSubjectContext(&SubjectContext);
}Referenced by:
CmDeleteValueKey
CmSetValueKey