visibility.h File Reference

#include "introcore.h"

Go to the source code of this file.

Macros
#define	PRIV_CREATE_TOKEN   BIT(2)
#define	PRIV_ASSIGN_PRIMARY_TOKEN   BIT(3)
#define	PRIV_LOCK_MEMORY   BIT(4)
#define	PRIV_INCREASE_QUOTA   BIT(5)
#define	PRIV_MACHINE_ACCOUNT   BIT(6)
#define	PRIV_TCB   BIT(7)
#define	PRIV_SECURITY   BIT(8)
#define	PRIV_TAKE_OWNERSHIP   BIT(9)
#define	PRIV_LOAD_DRIVER   BIT(10)
#define	PRIV_SYSTEM_PROFILE   BIT(11)
#define	PRIV_SYSTEM_TIME   BIT(12)
#define	PRIV_PROFILE_SINGLE_PROCESS   BIT(13)
#define	PRIV_INCREASE_BASE_PRIORITY   BIT(14)
#define	PRIV_CREATE_PAGEFILE   BIT(15)
#define	PRIV_CREATE_PERMANENT   BIT(16)
#define	PRIV_BACKUP   BIT(17)
#define	PRIV_RESTORE   BIT(18)
#define	PRIV_SHUTDOWN   BIT(19)
#define	PRIV_DEBUG   BIT(20)
#define	PRIV_AUDOT   BIT(21)
#define	PRIV_SYSTEM_ENVIRONMENT   BIT(22)
#define	PRIV_CHANGE_NOTIFY   BIT(23)
#define	PRIV_REMOTE_SHUTDOWN   BIT(24)
#define	PRIV_UNDOCK   BIT(25)
#define	PRIV_SYNC_AGENT   BIT(26)
#define	PRIV_ENABLE_DELEGATION   BIT(27)
#define	PRIV_MANAGE_VOLUME   BIT(28)
#define	PRIV_IMPERSONATE   BIT(29)
#define	PRIV_CREATE_GLOBAL   BIT(30)
#define	PRIV_TRUSTED_CRED_MAN_ACCESS   BIT(31)
#define	PRIV_RELABLE   BIT(32)
#define	PRIV_INCREASE_WORKING_SET   BIT(33)
#define	PRIV_TIMEZONE   BIT(34)
#define	PRIV_CREATE_SYMBOLIC_LINK   BIT(35)
#define	FIRST_KNOWN_PRIVILEGE   02
#define	LAST_KNOWN_PRIVILEGE   35

Functions
INTSTATUS	IntWinGetStartUpTime (QWORD *StartUpTime)
	Gets the system startup time. More...
INTSTATUS	IntWinDumpPrivileges (INTRO_TOKEN_PRIVILEGES const *Privileges)
	Prints a INTRO_TOKEN_PRIVILEGES structure. More...
INTSTATUS	IntWinReadSid (QWORD SidAndAttributesGva, INTRO_SID_ATTRIBUTES *Sid)
	Reads the contents of a _SID_AND_ATTRIBUTES Windows structure. More...
INTSTATUS	IntWinReadToken (QWORD TokenGva, INTRO_WIN_TOKEN *Token)
	Reads the contents of a _TOKEN Windows structure. More...
INTSTATUS	IntWinGetAccessTokenFromProcess (DWORD ProcessId, QWORD EprocessGva, INTRO_WIN_TOKEN *Token)
	Reads the contents of a _TOKEN Windows structure assigned to a process. More...
INTSTATUS	IntWinGetAccesTokenFromThread (QWORD EthreadGva, INTRO_WIN_TOKEN *Token)
	Reads the contents of a _TOKEN Windows structure assigned to a thread. More...
void	IntWinDumpToken (INTRO_WIN_TOKEN const *Token)
	Prints a INTRO_WIN_TOKEN structure. More...
void	IntWinDumpSid (INTRO_SID_ATTRIBUTES const *Sid)
	Prints a INTRO_SID_ATTRIBUTES structure. More...

Macro Definition Documentation

FIRST_KNOWN_PRIVILEGE

#define FIRST_KNOWN_PRIVILEGE   02

Definition at line 54 of file visibility.h.

LAST_KNOWN_PRIVILEGE

#define LAST_KNOWN_PRIVILEGE   35

Definition at line 55 of file visibility.h.

PRIV_ASSIGN_PRIMARY_TOKEN

#define PRIV_ASSIGN_PRIMARY_TOKEN   BIT(3)

Definition at line 20 of file visibility.h.

PRIV_AUDOT

#define PRIV_AUDOT   BIT(21)

Definition at line 38 of file visibility.h.

PRIV_BACKUP

#define PRIV_BACKUP   BIT(17)

Definition at line 34 of file visibility.h.

PRIV_CHANGE_NOTIFY

#define PRIV_CHANGE_NOTIFY   BIT(23)

Definition at line 40 of file visibility.h.

PRIV_CREATE_GLOBAL

#define PRIV_CREATE_GLOBAL   BIT(30)

Definition at line 47 of file visibility.h.

PRIV_CREATE_PAGEFILE

#define PRIV_CREATE_PAGEFILE   BIT(15)

Definition at line 32 of file visibility.h.

PRIV_CREATE_PERMANENT

#define PRIV_CREATE_PERMANENT   BIT(16)

Definition at line 33 of file visibility.h.

PRIV_CREATE_SYMBOLIC_LINK

#define PRIV_CREATE_SYMBOLIC_LINK   BIT(35)

Definition at line 52 of file visibility.h.

PRIV_CREATE_TOKEN

#define PRIV_CREATE_TOKEN   BIT(2)

Definition at line 19 of file visibility.h.

PRIV_DEBUG

#define PRIV_DEBUG   BIT(20)

Definition at line 37 of file visibility.h.

PRIV_ENABLE_DELEGATION

#define PRIV_ENABLE_DELEGATION   BIT(27)

Definition at line 44 of file visibility.h.

PRIV_IMPERSONATE

#define PRIV_IMPERSONATE   BIT(29)

Definition at line 46 of file visibility.h.

PRIV_INCREASE_BASE_PRIORITY

#define PRIV_INCREASE_BASE_PRIORITY   BIT(14)

Definition at line 31 of file visibility.h.

PRIV_INCREASE_QUOTA

#define PRIV_INCREASE_QUOTA   BIT(5)

Definition at line 22 of file visibility.h.

PRIV_INCREASE_WORKING_SET

#define PRIV_INCREASE_WORKING_SET   BIT(33)

Definition at line 50 of file visibility.h.

PRIV_LOAD_DRIVER

#define PRIV_LOAD_DRIVER   BIT(10)

Definition at line 27 of file visibility.h.

PRIV_LOCK_MEMORY

#define PRIV_LOCK_MEMORY   BIT(4)

Definition at line 21 of file visibility.h.

PRIV_MACHINE_ACCOUNT

#define PRIV_MACHINE_ACCOUNT   BIT(6)

Definition at line 23 of file visibility.h.

PRIV_MANAGE_VOLUME

#define PRIV_MANAGE_VOLUME   BIT(28)

Definition at line 45 of file visibility.h.

PRIV_PROFILE_SINGLE_PROCESS

#define PRIV_PROFILE_SINGLE_PROCESS   BIT(13)

Definition at line 30 of file visibility.h.

PRIV_RELABLE

#define PRIV_RELABLE   BIT(32)

Definition at line 49 of file visibility.h.

PRIV_REMOTE_SHUTDOWN

#define PRIV_REMOTE_SHUTDOWN   BIT(24)

Definition at line 41 of file visibility.h.

PRIV_RESTORE

#define PRIV_RESTORE   BIT(18)

Definition at line 35 of file visibility.h.

PRIV_SECURITY

#define PRIV_SECURITY   BIT(8)

Definition at line 25 of file visibility.h.

PRIV_SHUTDOWN

#define PRIV_SHUTDOWN   BIT(19)

Definition at line 36 of file visibility.h.

PRIV_SYNC_AGENT

#define PRIV_SYNC_AGENT   BIT(26)

Definition at line 43 of file visibility.h.

PRIV_SYSTEM_ENVIRONMENT

#define PRIV_SYSTEM_ENVIRONMENT   BIT(22)

Definition at line 39 of file visibility.h.

PRIV_SYSTEM_PROFILE

#define PRIV_SYSTEM_PROFILE   BIT(11)

Definition at line 28 of file visibility.h.

PRIV_SYSTEM_TIME

#define PRIV_SYSTEM_TIME   BIT(12)

Definition at line 29 of file visibility.h.

PRIV_TAKE_OWNERSHIP

#define PRIV_TAKE_OWNERSHIP   BIT(9)

Definition at line 26 of file visibility.h.

PRIV_TCB

#define PRIV_TCB   BIT(7)

Definition at line 24 of file visibility.h.

PRIV_TIMEZONE

#define PRIV_TIMEZONE   BIT(34)

Definition at line 51 of file visibility.h.

PRIV_TRUSTED_CRED_MAN_ACCESS

#define PRIV_TRUSTED_CRED_MAN_ACCESS   BIT(31)

Definition at line 48 of file visibility.h.

PRIV_UNDOCK

#define PRIV_UNDOCK   BIT(25)

Definition at line 42 of file visibility.h.

Function Documentation

IntWinDumpPrivileges()

INTSTATUS IntWinDumpPrivileges

(

INTRO_TOKEN_PRIVILEGES const *

Privileges

)

Prints a INTRO_TOKEN_PRIVILEGES structure.

Parameters

[in]

Privileges

Pointer to a structure to dump. This is obtained from a INTRO_WIN_TOKEN structure.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_INVALID_PARAMETER_1	if Privileges is NULL.

Definition at line 164 of file visibility.c.

Referenced by IntWinDumpToken().

IntWinDumpSid()

void IntWinDumpSid

(

INTRO_SID_ATTRIBUTES const *

Sid

)

Prints a INTRO_SID_ATTRIBUTES structure.

Parameters

[in]

Sid

Pointer to a INTRO_SID_ATTRIBUTES structure to print.

Definition at line 583 of file visibility.c.

Referenced by IntWinDumpToken().

IntWinDumpToken()

void IntWinDumpToken

(

INTRO_WIN_TOKEN const *

Token

)

Prints a INTRO_WIN_TOKEN structure.

Parameters

[in]

Token

Pointer to a INTRO_WIN_TOKEN structure to print.

Definition at line 626 of file visibility.c.

Referenced by DbgDumpEthreadToken(), and DbgDumpProcToken().

IntWinGetAccessTokenFromProcess()

INTSTATUS IntWinGetAccessTokenFromProcess	(	DWORD	ProcessId,
		QWORD	EprocessGva,
		INTRO_WIN_TOKEN *	Token
	)

Reads the contents of a _TOKEN Windows structure assigned to a process.

This function obtains the address of the _TOKEN structure associated with the given process and then uses IntWinReadToken to read it. Note that the pointer saved inside _EPROCESS is a _EX_FAST_REF (see EX_FAST_REF_TO_PTR).

Parameters

[in]	ProcessId	The ID of the process. If EprocessGva is 0 will search the process by this ID; ignored if EprocessGva is not 0.
[in]	EprocessGva	The guest virtual address of the _EPROCESS structure from which to obtain the token. If 0 will use ProcessId to find the process.
[out]	Token	On success, will contain the _TOKEN structure.

Returns

INT_STATUS_SUCCESS if successful, or an appropriate INTSTATUS error value

Definition at line 458 of file visibility.c.

Referenced by DbgDumpProcToken(), and IntAlertFillWinProcess().

IntWinGetAccesTokenFromThread()

INTSTATUS IntWinGetAccesTokenFromThread	(	QWORD	EthreadGva,
		INTRO_WIN_TOKEN *	Token
	)

Reads the contents of a _TOKEN Windows structure assigned to a thread.

This function obtains the address of the _TOKEN structure associated with the given thread and then uses IntWinReadToken to read it. Note that the pointer saved inside _ETHREAD is a _PS_CLIENT_SECURITY_CONTEXT, bits [0:2] must be cleared before using it as a pointer.

Parameters

[in]	EthreadGva	The guest virtual address of the _ETHREAD structure from which to obtain the token.
[out]	Token	On success, will contain the _TOKEN structure.

Returns

INT_STATUS_SUCCESS if successful, or an appropriate INTSTATUS error value

Definition at line 524 of file visibility.c.

Referenced by DbgDumpEthreadToken(), and IntAlertFillWinProcess().

IntWinGetStartUpTime()

INTSTATUS IntWinGetStartUpTime

(

QWORD *

StartUpTime

)

Gets the system startup time.

This will return the creation time of the system process, which is a Windows FILETIME structure (see https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime). This remains unchanged on sleep/hibernate events, as the system process remains the same. Note that the CreationTime field in _EPROCESS seems to not have the same meaning for other processes.

Parameters

[out]

StartUpTime

The startup time as a FILETIME value

Return values

INT_STATUS_SUCCESS	in case of success
INT_STATUS_INVALID_PARAMETER_1	if StartUpTime is NULL
INT_STATUS_NOT_INITIALIZED	if the system process is not yet started

Definition at line 14 of file visibility.c.

Referenced by IntGuestGetInfo().

IntWinReadSid()

INTSTATUS IntWinReadSid	(	QWORD	SidAndAttributesGva,
		INTRO_SID_ATTRIBUTES *	Sid
	)

Reads the contents of a _SID_AND_ATTRIBUTES Windows structure.

If the SubAuthority array inside the guest structure contains more than INTRO_WIN_SID_MAX_SUB_AUTHORITIES entries, only the first INTRO_WIN_SID_MAX_SUB_AUTHORITIES entries will be read.

Parameters

[in]	SidAndAttributesGva	Guest virtual address of the _SID_AND_ATTRIBUTES structure.
[out]	Sid	On success, will contain the _SID_AND_ATTRIBUTES structure.

Return values

INT_STATUS_SUCCESS	in case of success
INT_STATUS_INVALID_PARAMETER_1	if SidAndAttributesGva is not a kernel pointer.
INT_STATUS_INVALID_PARAMETER_2	if Sid is NULL.
INT_STATUS_INVALID_DATA_VALUE	if pointers inside the guest _SID_AND_ATTRIBUTES structure are not valid kernel pointers.

Definition at line 197 of file visibility.c.

Referenced by IntWinReadToken().

IntWinReadToken()

INTSTATUS IntWinReadToken	(	QWORD	TokenGva,
		INTRO_WIN_TOKEN *	Token
	)

Reads the contents of a _TOKEN Windows structure.

If the Sid or RestrictedSid arrays inside the guest have more than INTRO_SIDS_MAX_COUNT entries, only the first INTRO_SIDS_MAX_COUNT will be read and the SidsBufferTooSmall or RestrictedSidsBufferTooSmall will be set to True.

Parameters

[in]	TokenGva	Guest virtual address from which to read the _TOKEN structure.
[out]	Token	On success, will contain the _TOKEN structure.

Return values

INT_STATUS_SUCCESS	in case of success
INT_STATUS_INVALID_PARAMETER_1	if TokenGva is not a valid kernel pointer
INT_STATUS_INVALID_PARAMETER_2	if Token is NULL
INT_STATUS_NOT_FOUND	if parts of the structure could not be read

Definition at line 279 of file visibility.c.

Referenced by IntWinGetAccessTokenFromProcess(), and IntWinGetAccesTokenFromThread().