SepFilterToken

NTSTATUS __stdcall SepFilterToken(
        VOID *ExistingToken,
        INT8 RequestorMode,
        UINT64 Flags,
        UINT64 GroupCount,
        _SID_AND_ATTRIBUTES *GroupsToDisable,
        UINT64 PrivilegeCount,
        _LUID_AND_ATTRIBUTES *PrivilegesToDelete,
        UINT64 SidCount,
        _SID_AND_ATTRIBUTES *RestrictedSids,
        UINT64 SidLength,
        _TOKEN **FilteredToken){
  VOID **v13; 
  unsigned int v14; 
  _SID_AND_ATTRIBUTES *v15; 
  VOID **PoolWithTag; 
  VOID **v17; 
  VOID **v18; 
  VOID **v20; 
  int v21; 
  VOID *v22; 
  VOID **v23; 
  _QWORD *v24; 
  _QWORD *v25; 
  char *v26; 
  unsigned int v27; 
  __int128 v28; 
  unsigned int v29; 
  _DWORD *v30; 
  unsigned int v31; 
  int v32; 
  _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *v33; 
  __int64 v34; 
  _KPROCESS *CurrentProcess; 
  __int64 v36; 
  _EPROCESS *v37; 
  _ADAPTER_OBJECT *v38; 
  _SID_AND_ATTRIBUTES *v39; 
  int v40; 
  int v41; 
  _SID_AND_ATTRIBUTES *v42; 
  VOID *v43; 
  NTSTATUS v44; 
  unsigned int v45; 
  _SID_AND_ATTRIBUTES *v46; 
  _SID_AND_ATTRIBUTES *v47; 
  UINT64 v48; 
  NTSTATUS v49; 
  _DWORD *v50; 
  __int64 v51; 
  unsigned int v52; 
  size_t v53; 
  VOID **v54; 
  unsigned int *v55; 
  char v56; 
  _DWORD *v57; 
  unsigned int v58; 
  UINT64 v59; 
  VOID *v60; 
  INT64 v61; 
  INT64 v62; 
  INT64 v63; 
  NTSTATUS v64; 
  _ERESOURCE *v65; 
  int v66; 
  UINT64 *PrimaryToken; 
  __int64 v68; 
  __int64 v69; 
  VOID *ParseContext; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  UINT8 IsSystemCode; 
  UINT8 NewTokenAsRestrictedAsProcessToken; 
  UINT64 puResult; 
  VOID *Object; 
  UINT64 v78; 
  VOID *NextTargetSid; 
  int v80; 
  _DWORD *v81; 
  char *v82; 
  _DWORD *v83; 
  VOID ***v84; 
  _QWORD *v85; 
  _QWORD *v86; 
  _QWORD *v87; 
  _SID_AND_ATTRIBUTES **v88; 
  _SID_AND_ATTRIBUTES_HASH *SidAttrHash; 
  unsigned int *v90; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  int v92; 
  int v93; 
  VOID *v94; 
  VOID *v95; 
  int v96; 
  int v97; 
  __int128 v98; 
  _KNOWN_CONTROLLER_TYPE v99[4]; 
  __int128 v100; 
  unsigned int Flagsa; 
  unsigned int GroupCounta; 

  GroupCounta = GroupCount;
  Flagsa = Flags;
  Object = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  LODWORD(v78) = 0;
  *(_OWORD *)v99 = 0i64;
  LODWORD(puResult) = 0;
  v13 = 0i64;
  v100 = 0i64;
  v93 = 0;
  v97 = 0;
  IsSystemCode = 0;
  BYTE4(puResult) = KeGetCurrentThread()->PreviousMode;
  NewTokenAsRestrictedAsProcessToken = 0;
  v80 = Flags & 8;
  if( (Flags & 8) != 0 && (*((_DWORD *)ExistingToken + 50) & 0x58) != 0 )
    return -1073741811;
  v14 = 0;
  if( (_DWORD)SidCount )
  {
    v15 = RestrictedSids;
    while( !RtlIsPackageSid(v15->Sid) && !RtlIsCapabilitySid(v15->Sid) )
    {
      ++v14;
      ++v15;
      if( v14 >= (unsigned int)SidCount )
        goto LABEL_8;
    }
    return -1073741811;
  }
LABEL_8:
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x30ui64, 1950442835i64);
  v17 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  *(_DWORD *)PoolWithTag = 0;
  PoolWithTag[2] = PoolWithTag + 1;
  PoolWithTag[1] = PoolWithTag + 1;
  PoolWithTag[5] = PoolWithTag + 4;
  PoolWithTag[4] = PoolWithTag + 4;
  *((_DWORD *)PoolWithTag + 6) = 0;
  if( SeTokenLeakTracking )
  {
    v13 = ExAllocatePoolWithTag(1ui64, 0x120ui64, 1950442835i64);
    if( !v13 )
    {
      v18 = v17;
      goto LABEL_16;
    }
  }
  v20 = ExAllocatePoolWithTag(0x200ui64, 0x68ui64, 1817470291i64);
  if( !v20 )
  {
    ExFreePoolWithTag(v17, 0);
    if( !SeTokenLeakTracking )
      return -1073741670;
    v18 = v13;
LABEL_16:
    ExFreePoolWithTag(v18, 0);
    return -1073741670;
  }
  v21 = RtlULongAdd(*((unsigned int *)ExistingToken + 33), (unsigned int)SidLength, &puResult);
  if( v21 < 0
    || (v21 = RtlULongAdd((unsigned int)puResult, 4ui64, &puResult), v21 < 0)
    || (v21 = RtlULongAdd(0x490ui64, (unsigned int)puResult, &v78), v21 < 0) )
  {
    v23 = v20;
LABEL_101:
    ExFreePoolWithTag(v23, 0);
    ExFreePoolWithTag(v17, 0);
    if( SeTokenLeakTracking )
      ExFreePoolWithTag(v13, 0);
    return v21;
  }
  LODWORD(NonPagedPoolCharge) = v78;
  LODWORD(PagedPoolCharge) = *((_DWORD *)ExistingToken + 34);
  LODWORD(ObjectBodySize) = v78;
  v94 = v22;
  v96 = (int)v22;
  v95 = v22;
  v92 = 48;
  v98 = 0i64;
  v21 = ObCreateObject(
          RequestorMode,
          (_OBJECT_TYPE *)SeTokenObjectType,
          0i64,
          RequestorMode,
          v22,
          ObjectBodySize,
          PagedPoolCharge,
          NonPagedPoolCharge,
          &Object);
  v23 = v20;
  if( v21 < 0 )
    goto LABEL_101;
  v24 = Object;
  *((_QWORD *)Object + 6) = v20;
  ExInitializeResourceLite((INT64)v20);
  v25 = Object;
  v24[7] = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
  v26 = (char *)Object;
  v27 = puResult;
  v25[2] = ExpLuidIncrement + _InterlockedExchangeAdd64(&ExpLuid, ExpLuidIncrement);
  v26[204] = 0;
  *((_QWORD *)v26 + 3) = *((_QWORD *)ExistingToken + 3);
  v28 = *(_OWORD *)ExistingToken;
  v81 = v26 + 128;
  *(_OWORD *)v26 = v28;
  *((_DWORD *)v26 + 35) = 0;
  *((_DWORD *)v26 + 32) = 0;
  *((_DWORD *)v26 + 33) = v27;
  *((_QWORD *)v26 + 4) = *((_QWORD *)ExistingToken + 2);
  *((_DWORD *)v26 + 48) = *((_DWORD *)ExistingToken + 48);
  *((_DWORD *)v26 + 49) = *((_DWORD *)ExistingToken + 49);
  *((_QWORD *)v26 + 5) = *((_QWORD *)ExistingToken + 5);
  *((_QWORD *)v26 + 28) = *((_QWORD *)ExistingToken + 28);
  *((_QWORD *)v26 + 140) = 0i64;
  *((_QWORD *)v26 + 141) = 0i64;
  *((_QWORD *)v26 + 137) = 0i64;
  *((_QWORD *)v26 + 143) = v13;
  *((_DWORD *)v26 + 30) = 0;
  *((_QWORD *)v26 + 145) = 0i64;
  v82 = v26 + 1144;
  if( SeTokenLeakTracking )
  {
    v29 = RtlWalkFrameChain(*((_QWORD *)v26 + 143) + 40i64, 30i64, 0i64);
    if( KeGetCurrentIrql() < 2u )
      RtlWalkFrameChain(*(_QWORD *)v82 + 40i64 + 8i64 * v29, 30 - v29, 1ui64);
  }
  KeEnterCriticalRegion();
  ExAcquireResourceSharedLite(*((_QWORD *)ExistingToken + 6), 1);
  *((_DWORD *)v26 + 34) = *((_DWORD *)ExistingToken + 34);
  *((_DWORD *)v26 + 36) = *((_DWORD *)ExistingToken + 36);
  SepSetTokenSessionById((__int64)v26, *((_DWORD *)ExistingToken + 30), 0, 0i64, 0i64);
  *((_DWORD *)v26 + 30) = *((_DWORD *)ExistingToken + 30);
  v30 = v26 + 200;
  v31 = *((_DWORD *)ExistingToken + 50) & 0xFFFFFBD7;
  v83 = v26 + 200;
  *((_DWORD *)v26 + 50) = v31;
  *(_OWORD *)(v26 + 88) = *(_OWORD *)((char *)ExistingToken + 88);
  *((_QWORD *)v26 + 13) = *((_QWORD *)ExistingToken + 13);
  *((_DWORD *)v26 + 28) = *((_DWORD *)ExistingToken + 28);
  *((_WORD *)v26 + 58) = *((_WORD *)ExistingToken + 58);
  v26[118] = *((_BYTE *)ExistingToken + 118);
  *((_DWORD *)v26 + 52) = *((_DWORD *)ExistingToken + 52);
  *((_DWORD *)v26 + 53) = *((_DWORD *)ExistingToken + 53);
  *((_OWORD *)v26 + 4) = *((_OWORD *)ExistingToken + 4);
  *((_QWORD *)v26 + 10) = *((_QWORD *)ExistingToken + 10);
  *((_QWORD *)v26 + 97) = v17;
  if( v26[118] == 2 )
    SepModifyTokenPolicyCounter((_SEP_AUDIT_POLICY *)(v26 + 88), 1u);
  *((_QWORD *)v26 + 135) = 0i64;
  v85 = v26 + 1080;
  *((_QWORD *)v26 + 136) = 0i64;
  v86 = v26 + 1088;
  *((_QWORD *)v26 + 144) = 0i64;
  v87 = v26 + 1152;
  *((_QWORD *)v26 + 99) = 0i64;
  v88 = (_SID_AND_ATTRIBUTES **)(v26 + 792);
  *((_QWORD *)v26 + 98) = 0i64;
  v90 = (unsigned int *)(v26 + 800);
  *((_DWORD *)v26 + 200) = 0;
  SidAttrHash = (_SID_AND_ATTRIBUTES_HASH *)(v26 + 808);
  memset(v26 + 808, 0i64, 0x110u);
  *((_QWORD *)v26 + 22) = 0i64;
  *((_QWORD *)v26 + 138) = 0i64;
  *((_QWORD *)v26 + 139) = 0i64;
  *((_QWORD *)v26 + 142) = 0i64;
  v84 = (VOID ***)(v26 + 176);
  SepDuplicateLogonSessionReference((_TOKEN *)v26, (_TOKEN *)ExistingToken);
  v21 = v32;
  if( v32 < 0 )
    goto LABEL_28;
  SepRefDerefLuidToIndexEntryIfNecessary(ExistingToken, 0);
  *((_QWORD *)v26 + 142) = *((_QWORD *)ExistingToken + 142);
  v33 = (_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION *)*((_QWORD *)ExistingToken + 97);
  if( *(_DWORD *)v33 )
  {
    v21 = AuthzBasepDuplicateSecurityAttributes(v33, *((_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION **)v26 + 97), 0);
    if( v21 < 0 )
      goto LABEL_28;
  }
  if( *((_QWORD *)ExistingToken + 137) )
  {
    v21 = SepDuplicateTokenClaims((_TOKEN *)ExistingToken, (_TOKEN *)v26);
    if( v21 < 0 )
      goto LABEL_28;
  }
  if( SeTokenLeakTracking )
  {
    v34 = (__int64)v82;
    **(_QWORD **)v82 = KeGetCurrentThread()[1].CycleTime;
    *(_QWORD *)(*(_QWORD *)v34 + 8i64) = *(_QWORD *)&KeGetCurrentThread()[1].CurrentRunTime;
    *(_DWORD *)(*(_QWORD *)v34 + 32i64) = 15;
    *(_DWORD *)(*(_QWORD *)v34 + 280i64) = 0;
    *(_DWORD *)(*(_QWORD *)v34 + 284i64) = 0;
    CurrentProcess = (_EPROCESS *)PsGetCurrentProcess();
    v36 = *(_QWORD *)v34;
    v26 = (char *)Object;
    *(_QWORD *)(v36 + 16) = *(_QWORD *)CurrentProcess->ImageFileName;
    *(_DWORD *)(v36 + 24) = *(_DWORD *)&CurrentProcess->ImageFileName[8];
    *(_WORD *)(v36 + 28) = *(_WORD *)&CurrentProcess->ImageFileName[12];
    *(_BYTE *)(v36 + 30) = CurrentProcess->ImageFileName[14];
    SepAddTokenLogonSession((_TOKEN *)v26);
    v27 = puResult;
  }
  if( (Flagsa & 2) != 0 )
  {
    v37 = (_EPROCESS *)PsGetCurrentProcess();
    v38 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(v37);
    if( SeIsSystemContext(v38, &IsSystemCode) >= 0 && IsSystemCode )
      *v30 |= 0x40u;
    HalPutDmaAdapter(v38);
  }
  v39 = (_SID_AND_ATTRIBUTES *)(v26 + 1168);
  v40 = ((_BYTE)v26 - 112) & 7;
  if( (((_BYTE)v26 - 112) & 7) != 0 )
  {
    v39 = (_SID_AND_ATTRIBUTES *)((char *)v39 + (unsigned int)(8 - v40));
    v27 -= 8 - v40;
    LODWORD(puResult) = v27;
  }
  v41 = SidCount;
  if( *((_DWORD *)ExistingToken + 32) > (unsigned int)SidCount )
    v41 = *((_DWORD *)ExistingToken + 32);
  v42 = &v39[*((_DWORD *)ExistingToken + 31) + v41];
  *((_QWORD *)v26 + 19) = v39;
  NextTargetSid = v42;
  if( SepTokenSidSharingEnabled )
  {
    v21 = SepDuplicateTokenUserAndGroups((_TOKEN *)ExistingToken, (_TOKEN *)v26);
    if( v21 < 0 )
    {
      *((_QWORD *)v26 + 19) = 0i64;
LABEL_28:
      ExReleaseResourceLite(*((PERESOURCE *)ExistingToken + 6));
LABEL_29:
      KeLeaveCriticalRegion();
      HalPutDmaAdapter((PADAPTER_OBJECT)v26);
      return v21;
    }
  }
  else
  {
    *((_DWORD *)v26 + 31) = *((_DWORD *)ExistingToken + 31);
    v44 = RtlCopySidAndAttributesArray(
            *((unsigned int *)ExistingToken + 31),
            *((_SID_AND_ATTRIBUTES **)ExistingToken + 19),
            v27,
            v39,
            v42,
            &NextTargetSid,
            &puResult);
    v42 = (_SID_AND_ATTRIBUTES *)NextTargetSid;
    v21 = v44;
  }
  v45 = 0;
  v46 = (_SID_AND_ATTRIBUTES *)((char *)v39 + (unsigned int)(16 * *((_DWORD *)ExistingToken + 31)));
  *((_QWORD *)v26 + 20) = v46;
  if( (_DWORD)SidCount )
  {
    v47 = RestrictedSids;
    do
    {
      v48 = *((unsigned int *)ExistingToken + 32);
      if( !(_DWORD)v48 || SepSidInSidAndAttributes(*((_SID_AND_ATTRIBUTES **)ExistingToken + 20), v48, v43, v47->Sid) )
      {
        v49 = RtlCopySidAndAttributesArray(
                1ui64,
                &RestrictedSids[v45],
                (unsigned int)puResult,
                v46,
                v42,
                &NextTargetSid,
                &puResult);
        v50 = v81;
        v21 = v49;
        ++v46;
        v42 = (_SID_AND_ATTRIBUTES *)NextTargetSid;
        *(_DWORD *)(*((_QWORD *)v26 + 20) + 16i64 * (unsigned int)*v81 + 8) = 7;
        ++*v50;
      }
      ++v45;
      ++v47;
    }
    while( v45 < (unsigned int)SidCount );
  }
  v51 = *((_QWORD *)ExistingToken + 23);
  v52 = 4 * *(unsigned __int8 *)(*((_QWORD *)ExistingToken + 21) + 1i64) + 8;
  if( v51 )
    v52 += *(unsigned __int16 *)(v51 + 2);
  v53 = v52;
  v54 = ExAllocatePoolWithTag(1ui64, v52, 1683252563i64);
  *v84 = v54;
  if( !v54 )
  {
    v21 = -1073741670;
    goto LABEL_28;
  }
  v55 = v81;
  if( *((_DWORD *)ExistingToken + 32) && !*v81 )
  {
    v21 = -1073741811;
    goto LABEL_28;
  }
  v56 = 0;
  v57 = v83;
  if( *v81 )
  {
    *v83 |= 0x810u;
    v56 = 1;
  }
  else
  {
    *((_QWORD *)v26 + 20) = 0i64;
  }
  if( v80 )
  {
    *v57 |= 0x18u;
    v56 = 1;
  }
  if( v56 )
    SepSetLogonSessionToken((_TOKEN *)ExistingToken);
  memmove(v54, *((const VOID **)ExistingToken + 22), v53);
  if( *((_QWORD *)ExistingToken + 23) )
    *((_QWORD *)v26 + 23) = (char *)v54
                          + (unsigned int)(*((_DWORD *)ExistingToken + 46) - *((_DWORD *)ExistingToken + 44));
  else
    *((_QWORD *)v26 + 23) = 0i64;
  v58 = *((_DWORD *)ExistingToken + 42) - *((_DWORD *)ExistingToken + 44);
  v59 = *((unsigned int *)ExistingToken + 200);
  if( (_DWORD)v59 )
    v21 = SepSetTokenCapabilities(v26, *((VOID **)ExistingToken + 98), *((VOID **)ExistingToken + 99), v59);
  if( v21 < 0 )
    goto LABEL_28;
  v60 = (VOID *)*((_QWORD *)ExistingToken + 98);
  if( v60 )
    v21 = SepSetTokenPackage((_TOKEN *)v26, v60);
  if( v21 < 0 )
    goto LABEL_28;
  v61 = *((_QWORD *)ExistingToken + 135);
  if( v61 )
  {
    SepReferenceLowBoxNumberEntry(v61);
    *v85 = *((_QWORD *)ExistingToken + 135);
  }
  v62 = *((_QWORD *)ExistingToken + 136);
  if( v62 )
  {
    SepReferenceLowBoxNumberEntry(v62);
    *v86 = *((_QWORD *)ExistingToken + 136);
  }
  v63 = *((_QWORD *)ExistingToken + 144);
  if( v63 )
  {
    SepReferenceLowBoxNumberEntry(v63);
    *v87 = *((_QWORD *)ExistingToken + 144);
  }
  v64 = SepSetTokenTrust((_TOKEN *)v26, *((VOID **)ExistingToken + 138));
  v65 = (_ERESOURCE *)*((_QWORD *)ExistingToken + 6);
  v66 = v64;
  if( v64 < 0 )
  {
    ExReleaseResourceLite(v65);
    v21 = v66;
    goto LABEL_29;
  }
  ExReleaseResourceLite(v65);
  KeLeaveCriticalRegion();
  *((_QWORD *)v26 + 21) = (char *)v54 + v58;
  LODWORD(ParseContext) = PrivilegeCount;
  SepRemoveDisabledGroupsAndPrivileges(
    (_TOKEN *)v26,
    Flagsa,
    GroupCounta,
    GroupsToDisable,
    (UINT64)ParseContext,
    PrivilegesToDelete);
  RtlSidHashInitialize(
    *((_SID_AND_ATTRIBUTES **)v26 + 19),
    *((unsigned int *)v26 + 31),
    (_SID_AND_ATTRIBUTES_HASH *)(v26 + 232));
  RtlSidHashInitialize(*((_SID_AND_ATTRIBUTES **)v26 + 20), *v55, (_SID_AND_ATTRIBUTES_HASH *)(v26 + 504));
  SeCaptureSubjectContext((INT64)&SubjectContext);
  *(_QWORD *)&v100 = SubjectContext.PrimaryToken;
  if( (unsigned __int8)RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)&SubjectContext)
    && (unsigned __int8)RtlIsSandboxedToken((_KNOWN_CONTROLLER_TYPE)v99)
    && ((PrimaryToken = (UINT64 *)SubjectContext.PrimaryToken,
         KeEnterCriticalRegion(),
         ExAcquireResourceSharedLite(PrimaryToken[6], 1),
         v66 = SepNewTokenAsRestrictedAsProcessToken(v26, PrimaryToken, &NewTokenAsRestrictedAsProcessToken),
         ExReleaseResourceLite((PERESOURCE)PrimaryToken[6]),
         KeLeaveCriticalRegion(),
         v66 < 0)
     || !NewTokenAsRestrictedAsProcessToken) )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)v26);
    SeReleaseSubjectContext(&SubjectContext);
  }
  else
  {
    SeReleaseSubjectContext(&SubjectContext);
    if( *v88 )
      RtlSidHashInitialize(*v88, *v90, SidAttrHash);
    if( SeTokenLeakTracking
      && SepTokenLeakMethodWatch == 15
      && *(_QWORD *)&PsGetCurrentProcess()[1].gap0[8] == SepTokenLeakProcessCid )
    {
      v68 = (__int64)v82;
      v26 = (char *)Object;
      *(_DWORD *)(*(_QWORD *)v82 + 280i64) = _InterlockedIncrement(&SepTokenLeakMethodCount);
      v69 = *(unsigned int *)(*(_QWORD *)v68 + 280i64);
      if( (int)v69 >= SepTokenLeakBreakCount )
      {
        DbgPrint("\nToken number 0x%x = 0x%p\n", v69, v26);
        __debugbreak();
      }
    }
    *FilteredToken = (_TOKEN *)v26;
  }
  return v66;
}

Referenced by: