winsecdesc.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINSECDESC_H_
#define _WINSECDESC_H_

#include "intro_types.h"

#define INT_STD_ACE_MAX_SIZE    0x14

#define COPY_ACL_TO_INTRO_ACL(Acl, IntroAcl) do {                                           \
                                                 IntroAcl.AclRevision = Acl.AclRevision;    \
                                                 IntroAcl.AclSize = Acl.AclSize;            \
                                                 IntroAcl.AceCount = Acl.AceCount;          \
                                             } while(0);

typedef struct _WIN_PROCESS_OBJECT WIN_PROCESS_OBJECT, *PWIN_PROCESS_OBJECT;

typedef struct _SID_INTERNAL
{
    UCHAR                       Revision;
    UCHAR                       SubAuthorityCount;
    SID_IDENTIFIER_AUTHORITY    IdentifierAuthority;
} SID_INTERNAL, *PSID_INTERNAL;

typedef struct _ACE_BODY
{
    DWORD           Mask;
    SID_INTERNAL    Sid;
} ACE_BODY, *PACE_BODY;

INTSTATUS
IntWinSDProtectSecDesc(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinSDCheckIntegrity(
    void
    );

_Success_(return == TRUE)
BOOLEAN
IntWinSDIsSecDescPtrAltered(
    _In_ WIN_PROCESS_OBJECT *Process,
    _Inout_opt_ WIN_PROCESS_OBJECT **VictimProcess,
    _Out_opt_ QWORD *OldValue,
    _Out_opt_ QWORD *NewValue
    );

_Success_(return == TRUE)
BOOLEAN
IntWinSDIsAclEdited(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ DWORD BufferSize,
    _Out_writes_bytes_(BufferSize) BYTE *SecurityDescriptorBuffer,
    _Out_ DWORD *ReadSize,
    _Out_ ACL **NewSacl,
    _Out_ ACL **NewDacl
    );

INTSTATUS
IntWinSDReadSecDesc(
    _In_ QWORD SecurityDescriptorGva,
    _In_ DWORD BufferSize,
    _Out_writes_bytes_(BufferSize) BYTE *SecurityDescriptorBuffer,
    _Out_ DWORD *ReadSize,
    _Out_ ACL **Sacl,
    _Out_ ACL **Dacl
    );

#endif //_WINSECDESC_H_