ExCpuSetResourceManagerAccessCheck
NTSTATUS __stdcall ExCpuSetResourceManagerAccessCheck(INT8 PreviousMode){
_ETHREAD *CurrentThread;
UINT64 DesiredAccess;
UINT64 v5;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
INT64 AccessStatus;
UINT64 GrantedAccess;
LODWORD(GrantedAccess) = 0;
LODWORD(AccessStatus) = 0;
memset(&SubjectContext, 0, sizeof(SubjectContext));
if( !PreviousMode || SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseBasePriorityPrivilege, PreviousMode) )
return 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
SeCaptureSubjectContextEx(CurrentThread, CurrentThread->Tcb.ApcState.Process, &SubjectContext);
LODWORD(v5) = 0;
LODWORD(DesiredAccess) = 1;
SeAccessCheckWithHint(
ExpCpuSetSecurityDescriptor,
7ui64,
&SubjectContext,
0i64,
DesiredAccess,
v5,
0i64,
(_GENERIC_MAPPING *)&ExpRestrictedGenericMapping,
PreviousMode,
&GrantedAccess,
&AccessStatus);
SeReleaseSubjectContext(&SubjectContext);
return AccessStatus;
}Referenced by:
ExpQuerySystemInformation
NtAcquireProcessActivityReference
NtSetInformationProcess
NtSetSystemInformation