CmpQueryFileSecurityDescriptor
NTSTATUS __stdcall CmpQueryFileSecurityDescriptor(PVOID FileHandle, PVOID *SecurityDescriptor){
VOID **PoolWithTag;
int SecurityObject;
NTSTATUS result;
UINT64 NumberOfBytes;
PoolWithTag = 0i64;
LODWORD(NumberOfBytes) = 0;
SecurityObject = ZwQuerySecurityObject((UINT64)FileHandle, 4i64, 0i64, 0i64, (UINT64)&NumberOfBytes);
if( SecurityObject == -1073741789 )
{
PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1685278019i64);
if( PoolWithTag )
{
SecurityObject = ZwQuerySecurityObject(
(UINT64)FileHandle,
4i64,
(UINT64)PoolWithTag,
(unsigned int)NumberOfBytes,
(UINT64)&NumberOfBytes);
if( SecurityObject < 0 )
{
ExFreePoolWithTag(PoolWithTag, 0);
PoolWithTag = 0i64;
}
}
else
{
SecurityObject = -1073741670;
}
}
else if( !SecurityObject )
{
SecurityObject = -1073741823;
}
result = SecurityObject;
*SecurityDescriptor = PoolWithTag;
return result;
}Referenced by:
CmpInitCmRM
CmpInitHiveFromFile
CmpLogHiveFileInaccessible
CmpOpenHiveFile
CmpStartRMLog