RtlIsParentOfChildAppContainer
UINT8 __stdcall RtlIsParentOfChildAppContainer(VOID *ParentAppContainerSid, VOID *ChildAppContainerSid){
unsigned int v4;
_DWORD *v5;
_DWORD *v6;
_DWORD *v7;
_APPCONTAINER_SID_TYPE AppContainerSidType;
AppContainerSidType = NotAppContainerSidType;
if( RtlGetAppContainerSidType(ParentAppContainerSid, &AppContainerSidType) >= 0
&& AppContainerSidType == ParentAppContainerSidType
&& RtlGetAppContainerSidType(ChildAppContainerSid, &AppContainerSidType) >= 0
&& AppContainerSidType == ChildAppContainerSidType )
{
v4 = 1;
while( 1 )
{
LODWORD(v5) = RtlSubAuthoritySid((INT64)ParentAppContainerSid, v4);
v6 = v5;
LODWORD(v7) = RtlSubAuthoritySid((INT64)ChildAppContainerSid, v4);
if( *v6 != *v7 )
break;
if( ++v4 >= 8 )
return 1;
}
}
return 0;
}Referenced by:
SeTokenCanImpersonate
SepCheckCreateLowBox
SepIsParentOfChildAppContainer
SepSetTokenCapabilities
SepSetTokenPackage