NtOpenObjectAuditAlarm
NTSTATUS __stdcall NtOpenObjectAuditAlarm(
_UNICODE_STRING *SubsystemName,
VOID *HandleId,
_UNICODE_STRING *ObjectTypeName,
_UNICODE_STRING *ObjectName,
VOID *SecurityDescriptor,
VOID *ClientToken,
UINT64 DesiredAccess,
UINT64 GrantedAccess,
PRIVILEGE_SET *Privileges,
UINT8 ObjectCreation,
UINT8 AccessGranted,
UINT8 *GenerateOnClose){
_UNICODE_STRING *v12;
char PreviousMode;
int v15;
_ADAPTER_OBJECT *v16;
int v17;
INT64 v18;
INT64 v19;
__int64 v20;
unsigned int PrivilegeCount;
unsigned int v22;
char *v23;
VOID **PoolWithTag;
_DWORD *v25;
INT64 v26;
INT64 v27;
INT64 v28;
INT64 v29;
_UNICODE_STRING *v31;
UINT8 v32;
VOID *v33;
bool v34;
NTSTATUS v35;
INT64 v36;
__int16 v37;
__int64 v38;
_ACL *v39;
__int64 v40;
_ACL *v41;
PVOID *Object;
PVOID *Objecta;
PVOID *Objectb;
POBJECT_HANDLE_INFORMATION HandleInformation;
POBJECT_HANDLE_INFORMATION HandleInformationa;
POBJECT_HANDLE_INFORMATION HandleInformationb;
POBJECT_HANDLE_INFORMATION HandleInformationc;
UINT16 *FlatSubCategoryId;
UINT16 *FlatSubCategoryIda;
UINT16 *FlatSubCategoryIdb;
UINT16 *FlatSubCategoryIdc;
UINT64 v53;
__int16 GenerateAudit;
CHAR RequestorMode;
char v56;
int v57;
UINT16 v58;
VOID *OutputSecurityDescriptor;
PVOID Token;
_UNICODE_STRING *ObjectTypeNamea;
_UNICODE_STRING *DestString;
_UNICODE_STRING *AbsoluteObjectName;
PVOID P;
VOID *HandleIda;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
unsigned int v67;
unsigned int v68;
size_t Size[2];
v12 = ObjectTypeName;
DestString = 0i64;
ObjectTypeNamea = 0i64;
AbsoluteObjectName = 0i64;
OutputSecurityDescriptor = 0i64;
P = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
GenerateAudit = 0;
HandleIda = 0i64;
v58 = 0;
PreviousMode = KeGetCurrentThread()->PreviousMode;
RequestorMode = PreviousMode;
v56 = PreviousMode;
SeCaptureSubjectContext((INT64)&SubjectContext);
if( !SeCheckAuditPrivilege(&SubjectContext, PreviousMode) )
{
v35 = -1073741727;
LABEL_53:
SeReleaseSubjectContext(&SubjectContext);
return v35;
}
Token = 0i64;
v15 = ObReferenceObjectByHandle(ClientToken, 8ui64, (_OBJECT_TYPE *)SeTokenObjectType, PreviousMode, &Token, 0i64);
if( v15 < 0 )
{
SeReleaseSubjectContext(&SubjectContext);
if( v15 != -1073741816 )
{
v36 = (unsigned int)v15;
LABEL_49:
SepAuditFailed(v36);
}
return v15;
}
v16 = (_ADAPTER_OBJECT *)Token;
if( *((_DWORD *)Token + 48) == 2 && *((int *)Token + 49) < 1 )
{
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
v35 = -1073741659;
goto LABEL_53;
}
if( !SecurityDescriptor )
{
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
v35 = -1073741703;
goto LABEL_53;
}
v17 = SeCaptureSecurityDescriptor(
SecurityDescriptor,
PreviousMode,
PagedPool,
0,
&OutputSecurityDescriptor,
(INT64)HandleInformation,
(INT64)FlatSubCategoryId);
v57 = v17;
if( v17 >= 0 && OutputSecurityDescriptor )
{
if( AccessGranted && Privileges )
{
if( ((unsigned __int8)Privileges & 3) != 0 )
goto LABEL_29;
v20 = 0x7FFFFFFF0000i64;
PrivilegeCount = Privileges->PrivilegeCount;
v67 = PrivilegeCount;
if( PrivilegeCount >= 0x43 )
{
v15 = -1073741811;
v57 = -1073741811;
goto LABEL_30;
}
v22 = 12 * PrivilegeCount + 8;
v68 = v22;
if( 12 * PrivilegeCount != -8 )
{
v23 = (char *)Privileges + v22;
if( (unsigned __int64)v23 > 0x7FFFFFFF0000i64 || v23 < (char *)Privileges )
MEMORY[0x7FFFFFFF0000] = 0;
}
*(_QWORD *)Size = v22;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v22, 1917871443i64);
v25 = PoolWithTag;
P = PoolWithTag;
if( !PoolWithTag )
{
SeReleaseSecurityDescriptor(OutputSecurityDescriptor, RequestorMode, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
v57 = -1073741670;
SepAuditFailed(3221225626i64);
return -1073741670;
}
memmove(PoolWithTag, Privileges, Size[0]);
*v25 = PrivilegeCount;
PreviousMode = RequestorMode;
v12 = ObjectTypeName;
}
else
{
v20 = 0x7FFFFFFF0000i64;
}
if( !HandleId )
{
LABEL_20:
if( (unsigned __int64)GenerateOnClose < 0x7FFFFFFF0000i64 )
v20 = (__int64)GenerateOnClose;
*(_BYTE *)v20 = *(_BYTE *)v20;
v15 = SepProbeAndCaptureString_U(
SubsystemName,
&DestString,
v18,
v19,
(INT64)Object,
(INT64)HandleInformationa,
(INT64)FlatSubCategoryIda,
v53);
v57 = v15;
if( v15 >= 0 )
{
v15 = SepProbeAndCaptureString_U(
v12,
&ObjectTypeNamea,
v26,
v27,
(INT64)Objecta,
(INT64)HandleInformationb,
(INT64)FlatSubCategoryIdb,
v53);
v57 = v15;
if( v15 >= 0 )
{
v15 = SepProbeAndCaptureString_U(
ObjectName,
&AbsoluteObjectName,
v28,
v29,
(INT64)Objectb,
(INT64)HandleInformationc,
(INT64)FlatSubCategoryIdc,
v53);
v57 = v15;
}
}
LABEL_30:
if( v15 >= 0 )
{
v31 = ObjectTypeNamea;
v32 = SepAdtAuditObjectAccessWithContext(
0i64,
ObjectTypeNamea,
AccessGranted,
AccessGranted == 0,
&SubjectContext,
0,
&v58);
v33 = OutputSecurityDescriptor;
if( !v32 )
goto LABEL_32;
v37 = *((_WORD *)OutputSecurityDescriptor + 1);
if( (v37 & 0x10) != 0 )
{
if( v37 >= 0 )
{
v39 = (_ACL *)*((_QWORD *)OutputSecurityDescriptor + 3);
LABEL_70:
if( (v37 & 0x10) != 0 )
{
if( v37 >= 0 )
{
v41 = (_ACL *)*((_QWORD *)OutputSecurityDescriptor + 3);
LABEL_76:
SeExamineSacl(
v41,
v39,
Token,
(unsigned int)GrantedAccess | (unsigned int)DesiredAccess,
AccessGranted,
(UINT8 *)&GenerateAudit,
(UINT8 *)&GenerateAudit + 1);
if( GenerateAudit )
{
v33 = OutputSecurityDescriptor;
v31 = ObjectTypeNamea;
v34 = SepAdtOpenObjectAuditAlarm(
v58,
(__int64)DestString,
(PVOID *)((unsigned __int64)&HandleIda & -(__int64)(HandleId != 0i64)),
&ObjectTypeNamea->Length,
(__int64)AbsoluteObjectName,
OutputSecurityDescriptor,
(__int64)Token,
(__int64)SubjectContext.PrimaryToken,
DesiredAccess,
GrantedAccess,
(__int64)P,
AccessGranted,
(__int64)KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
2,
0i64,
0,
0i64,
0i64,
0i64);
LABEL_33:
if( !GenerateAudit && Privileges && AccessGranted )
{
LODWORD(v53) = DesiredAccess;
v31 = ObjectTypeNamea;
SepAdtPrivilegeObjectAuditAlarm(
DestString,
ObjectTypeNamea,
AbsoluteObjectName,
HandleIda,
(_TOKEN *)Token,
(_TOKEN *)SubjectContext.PrimaryToken,
KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
v53,
(_PRIVILEGE_SET *)P,
AccessGranted);
v34 = 0;
v33 = OutputSecurityDescriptor;
}
SeReleaseSecurityDescriptor(v33, PreviousMode, 0);
if( DestString )
ExFreePoolWithTag(DestString, 0);
if( v31 )
ExFreePoolWithTag(v31, 0);
if( AbsoluteObjectName )
ExFreePoolWithTag(AbsoluteObjectName, 0);
if( P )
ExFreePoolWithTag(P, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
*GenerateOnClose = v34;
return 0;
}
LABEL_32:
v34 = 0;
goto LABEL_33;
}
v40 = *((unsigned int *)OutputSecurityDescriptor + 3);
if( (_DWORD)v40 )
{
v41 = (_ACL *)((char *)OutputSecurityDescriptor + v40);
goto LABEL_76;
}
}
v41 = 0i64;
goto LABEL_76;
}
v38 = *((unsigned int *)OutputSecurityDescriptor + 3);
if( (_DWORD)v38 )
{
v39 = (_ACL *)((char *)OutputSecurityDescriptor + v38);
goto LABEL_70;
}
}
v39 = 0i64;
goto LABEL_70;
}
if( DestString )
ExFreePoolWithTag(DestString, 0);
if( ObjectTypeNamea )
ExFreePoolWithTag(ObjectTypeNamea, 0);
if( AbsoluteObjectName )
ExFreePoolWithTag(AbsoluteObjectName, 0);
if( P )
ExFreePoolWithTag(P, 0);
SeReleaseSecurityDescriptor(OutputSecurityDescriptor, PreviousMode, 0);
HalPutDmaAdapter((PADAPTER_OBJECT)Token);
SeReleaseSubjectContext(&SubjectContext);
if( v15 == -1073741670 )
{
v36 = 3221225626i64;
goto LABEL_49;
}
return v15;
}
if( ((unsigned __int8)HandleId & 7) == 0 )
{
HandleIda = *(VOID **)HandleId;
goto LABEL_20;
}
LABEL_29:
ExRaiseDatatypeMisalignment();
}
HalPutDmaAdapter(v16);
SeReleaseSubjectContext(&SubjectContext);
if( v17 == -1073741670 )
SepAuditFailed(3221225626i64);
return v17;
}Referenced by:
No references.