922 lines
27 KiB
C
922 lines
27 KiB
C
/*++
|
|
|
|
Copyright (c) 1992 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
sddump.c
|
|
|
|
Abstract:
|
|
|
|
Debugger Extension Api
|
|
|
|
Author:
|
|
|
|
Baskar Kothandaraman (baskark) 26-Jan-1998
|
|
|
|
Environment:
|
|
|
|
Kernel Mode
|
|
|
|
Revision History:
|
|
|
|
Kshitiz K. Sharma (kksharma)
|
|
|
|
Using debugger type info : SID and ACL have exactly same type definitions on
|
|
all platforms - No change.
|
|
|
|
--*/
|
|
|
|
|
|
#include "precomp.h"
|
|
#pragma hdrstop
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: sid_successfully_read
|
|
|
|
FUNCTION: Tries to read in a SID from the specified address.
|
|
It first reads in the minimal structure, then
|
|
allocates a buffer big enough to hold the whole sid
|
|
& reads in the whole SID....
|
|
|
|
ARGS: Address -- Address from which to read it from
|
|
sid_buffer -- variable to receive the ptr to the
|
|
allocated buffer with the SID.
|
|
|
|
RETURN: TRUE on success, FALSE otherwise.
|
|
|
|
NOTE***: The caller has to call free(*sid_buffer) to free
|
|
up the memory upon a successful call to this
|
|
function.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
BOOLEAN sid_successfully_read(
|
|
ULONG64 Address,
|
|
PSID *sid_buffer
|
|
)
|
|
{
|
|
ULONG result;
|
|
SID minimum; /* minimum we need to read to get the details */
|
|
|
|
|
|
*sid_buffer = NULL;
|
|
|
|
if ( !ReadMemory( Address,
|
|
&minimum,
|
|
sizeof(minimum),
|
|
&result) )
|
|
{
|
|
dprintf("%08p: Unable to get MIN SID header\n", Address);
|
|
return FALSE;
|
|
}
|
|
|
|
/* Now of read-in any extra sub-authorities necessary */
|
|
|
|
if (minimum.SubAuthorityCount > SID_MAX_SUB_AUTHORITIES)
|
|
{
|
|
dprintf("SID has an invalid sub-authority_count, 0x%x\n", minimum.SubAuthorityCount);
|
|
return FALSE;
|
|
}
|
|
else
|
|
{
|
|
ULONG size_to_read = RtlLengthRequiredSid(minimum.SubAuthorityCount);
|
|
|
|
*sid_buffer = malloc(size_to_read);
|
|
|
|
if (! *sid_buffer)
|
|
{
|
|
dprintf("SID: can't allocate memory to read\n");
|
|
return FALSE;
|
|
}
|
|
|
|
if ( !ReadMemory( Address,
|
|
*sid_buffer,
|
|
size_to_read,
|
|
&result) )
|
|
{
|
|
dprintf("%08p: Unable to get The Whole SID\n", Address);
|
|
free(*sid_buffer);
|
|
*sid_buffer = NULL;
|
|
return FALSE;
|
|
}
|
|
|
|
if (! RtlValidSid(*sid_buffer))
|
|
{
|
|
dprintf("%08p: SID pointed to by this address is invalid\n", Address);
|
|
free(*sid_buffer);
|
|
*sid_buffer = NULL;
|
|
return FALSE;
|
|
}
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: acl_successfully_read
|
|
|
|
FUNCTION: Tries to read in a ACL from the specified address.
|
|
It first reads in the minimal structure, then
|
|
allocates a buffer big enough to hold the whole acl
|
|
& reads in the whole ACL....
|
|
|
|
ARGS: Address -- Address from which to read it from
|
|
acl_buffer -- variable to receive the ptr to the
|
|
allocated buffer with the ACL.
|
|
|
|
RETURN: TRUE on success, FALSE otherwise.
|
|
|
|
NOTE***: The caller has to call free(*acl_buffer) to free
|
|
up the memory upon a successful call to this
|
|
function.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
BOOLEAN acl_successfully_read(
|
|
ULONG64 Address,
|
|
PACL *acl_buffer
|
|
)
|
|
{
|
|
ULONG result;
|
|
ACL minimum; /* minimum we need to read to get the details */
|
|
|
|
|
|
*acl_buffer = NULL;
|
|
|
|
if ( !ReadMemory( Address,
|
|
&minimum,
|
|
sizeof(minimum),
|
|
&result) )
|
|
{
|
|
dprintf("%08p: Unable to get MIN ACL header\n", Address);
|
|
return FALSE;
|
|
}
|
|
|
|
*acl_buffer = malloc(minimum.AclSize);
|
|
|
|
if (! *acl_buffer)
|
|
{
|
|
dprintf("ACL: can't allocate memory to read\n");
|
|
return FALSE;
|
|
}
|
|
|
|
if ( !ReadMemory( Address,
|
|
*acl_buffer,
|
|
minimum.AclSize,
|
|
&result) )
|
|
{
|
|
dprintf("%08p: Unable to get The Whole ACL\n", Address);
|
|
free(*acl_buffer);
|
|
*acl_buffer = NULL;
|
|
return FALSE;
|
|
}
|
|
|
|
if (! RtlValidAcl(*acl_buffer))
|
|
{
|
|
dprintf("%08p: ACL pointed to by this address is invalid\n", Address);
|
|
free(*acl_buffer);
|
|
*acl_buffer = NULL;
|
|
return FALSE;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: DumpSID
|
|
|
|
FUNCTION: Prints out a SID, with the padding provided.
|
|
|
|
ARGS: pad -- Padding to print before the SID.
|
|
sid_to_dump -- Pointer to the SID to print.
|
|
Flag -- To control options.
|
|
|
|
RETURN: N/A
|
|
|
|
NOTE***: It right now, doesn't lookup the sid.
|
|
In future, you might want ot use the Flag
|
|
parameter to make that optional.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
|
|
VOID DumpSID(
|
|
CHAR *pad,
|
|
PSID sid_to_dump,
|
|
ULONG Flag
|
|
)
|
|
{
|
|
NTSTATUS ntstatus;
|
|
UNICODE_STRING us;
|
|
|
|
if (sid_to_dump)
|
|
{
|
|
ntstatus = RtlConvertSidToUnicodeString(&us, sid_to_dump, TRUE);
|
|
|
|
if (NT_SUCCESS(ntstatus))
|
|
{
|
|
dprintf("%s%wZ\n", pad, &us);
|
|
RtlFreeUnicodeString(&us);
|
|
}
|
|
else
|
|
{
|
|
dprintf("0x%08lx: Can't Convert SID to UnicodeString\n", ntstatus);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
dprintf("%s is NULL\n", pad);
|
|
}
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: DumpACL
|
|
|
|
FUNCTION: Prints out a ACL, with the padding provided.
|
|
|
|
ARGS: pad -- Padding to print before the ACL.
|
|
acl_to_dump -- Pointer to the ACL to print.
|
|
Flag -- To control options.
|
|
Start -- Actual start address of the Acl
|
|
|
|
RETURN: N/A
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
BOOL
|
|
DumpACL (
|
|
IN char *pad,
|
|
IN ACL *pacl,
|
|
IN ULONG Flags,
|
|
IN ULONG64 Start
|
|
)
|
|
{
|
|
USHORT x;
|
|
|
|
if (pacl == NULL)
|
|
{
|
|
dprintf("%s is NULL\n", pad);
|
|
return FALSE;
|
|
}
|
|
|
|
dprintf("%s\n", pad);
|
|
dprintf("%s->AclRevision: 0x%x\n", pad, pacl->AclRevision);
|
|
dprintf("%s->Sbz1 : 0x%x\n", pad, pacl->Sbz1);
|
|
dprintf("%s->AclSize : 0x%x\n", pad, pacl->AclSize);
|
|
dprintf("%s->AceCount : 0x%x\n", pad, pacl->AceCount);
|
|
dprintf("%s->Sbz2 : 0x%x\n", pad, pacl->Sbz2);
|
|
|
|
for (x = 0; x < pacl->AceCount; x ++)
|
|
{
|
|
PACE_HEADER ace;
|
|
CHAR temp_pad[MAX_PATH];
|
|
NTSTATUS result;
|
|
|
|
sprintf(temp_pad, "%s->Ace[%u]: ", pad, x);
|
|
|
|
result = RtlGetAce(pacl, x, &ace);
|
|
if (! NT_SUCCESS(result))
|
|
{
|
|
dprintf("%sCan't GetAce, 0x%08lx\n", temp_pad, result);
|
|
return FALSE;
|
|
}
|
|
|
|
dprintf("%s->AceType: ", temp_pad);
|
|
|
|
#define BRANCH_AND_PRINT(x) case x: dprintf(#x "\n"); break
|
|
|
|
switch (ace->AceType)
|
|
{
|
|
BRANCH_AND_PRINT(ACCESS_ALLOWED_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_DENIED_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_AUDIT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_ALARM_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_ALLOWED_COMPOUND_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_ALLOWED_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_DENIED_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_AUDIT_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_ALARM_OBJECT_ACE_TYPE);
|
|
|
|
BRANCH_AND_PRINT(ACCESS_ALLOWED_CALLBACK_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_DENIED_CALLBACK_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_AUDIT_CALLBACK_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_ALARM_CALLBACK_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE);
|
|
BRANCH_AND_PRINT(SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE);
|
|
|
|
default:
|
|
dprintf("0x%08lx <-- *** Unknown AceType\n", ace->AceType);
|
|
continue; // With the next ace
|
|
}
|
|
|
|
#undef BRANCH_AND_PRINT
|
|
|
|
dprintf("%s->AceFlags: 0x%x\n", temp_pad, ace->AceFlags);
|
|
|
|
#define BRANCH_AND_PRINT(x) if (ace->AceFlags & x){ dprintf("%s %s\n", temp_pad, #x); }
|
|
|
|
BRANCH_AND_PRINT(OBJECT_INHERIT_ACE)
|
|
BRANCH_AND_PRINT(CONTAINER_INHERIT_ACE)
|
|
BRANCH_AND_PRINT(NO_PROPAGATE_INHERIT_ACE)
|
|
BRANCH_AND_PRINT(INHERIT_ONLY_ACE)
|
|
BRANCH_AND_PRINT(INHERITED_ACE)
|
|
BRANCH_AND_PRINT(SUCCESSFUL_ACCESS_ACE_FLAG)
|
|
BRANCH_AND_PRINT(FAILED_ACCESS_ACE_FLAG)
|
|
|
|
#undef BRANCH_AND_PRINT
|
|
|
|
dprintf("%s->AceSize: 0x%x\n", temp_pad, ace->AceSize);
|
|
|
|
/*
|
|
From now on it is ace specific stuff.
|
|
Fortunately ACEs can be split into 3 groups,
|
|
with the ACE structure being the same within the group
|
|
|
|
Added 8 more ace types for callback support.
|
|
*/
|
|
|
|
switch (ace->AceType)
|
|
{
|
|
case ACCESS_ALLOWED_ACE_TYPE:
|
|
case ACCESS_DENIED_ACE_TYPE:
|
|
case SYSTEM_AUDIT_ACE_TYPE:
|
|
case SYSTEM_ALARM_ACE_TYPE:
|
|
{
|
|
CHAR more_pad[MAX_PATH];
|
|
SYSTEM_AUDIT_ACE *tace = (SYSTEM_AUDIT_ACE *) ace;
|
|
|
|
dprintf("%s->Mask : 0x%08lx\n", temp_pad, tace->Mask);
|
|
|
|
sprintf(more_pad, "%s->SID: ", temp_pad);
|
|
DumpSID(more_pad, &(tace->SidStart), Flags);
|
|
}
|
|
break;
|
|
|
|
case ACCESS_ALLOWED_CALLBACK_ACE_TYPE:
|
|
case ACCESS_DENIED_CALLBACK_ACE_TYPE:
|
|
case SYSTEM_AUDIT_CALLBACK_ACE_TYPE:
|
|
case SYSTEM_ALARM_CALLBACK_ACE_TYPE:
|
|
|
|
{
|
|
CHAR more_pad[MAX_PATH];
|
|
SYSTEM_AUDIT_ACE *tace = (SYSTEM_AUDIT_ACE *) ace;
|
|
|
|
dprintf("%s->Mask : 0x%08lx\n", temp_pad, tace->Mask);
|
|
|
|
sprintf(more_pad, "%s->SID: ", temp_pad);
|
|
DumpSID(more_pad, &(tace->SidStart), Flags);
|
|
dprintf("%s->Address : %08p\n", temp_pad, Start + (ULONG) (((PUCHAR) ace) - ((PUCHAR) pacl)));
|
|
}
|
|
break;
|
|
|
|
case ACCESS_ALLOWED_COMPOUND_ACE_TYPE:
|
|
{
|
|
CHAR more_pad[MAX_PATH];
|
|
COMPOUND_ACCESS_ALLOWED_ACE *tace = (COMPOUND_ACCESS_ALLOWED_ACE *) ace;
|
|
PBYTE ptr;
|
|
|
|
dprintf("%s->Mask : 0x%08lx\n", temp_pad, tace->Mask);
|
|
dprintf("%s->CompoundAceType : 0x%08lx\n", temp_pad, tace->CompoundAceType);
|
|
dprintf("%s->Reserved : 0x%08lx\n", temp_pad, tace->Reserved);
|
|
|
|
sprintf(more_pad, "%s->SID(1) : ", temp_pad);
|
|
DumpSID(more_pad, &(tace->SidStart), Flags);
|
|
|
|
ptr = (PBYTE)&(tace->SidStart);
|
|
ptr += RtlLengthSid((PSID)ptr); /* Skip this & get to next sid */
|
|
|
|
sprintf(more_pad, "%s->SID(2) : ", temp_pad);
|
|
DumpSID(more_pad, ptr, Flags);
|
|
}
|
|
break;
|
|
|
|
case ACCESS_ALLOWED_OBJECT_ACE_TYPE:
|
|
case ACCESS_DENIED_OBJECT_ACE_TYPE:
|
|
case SYSTEM_AUDIT_OBJECT_ACE_TYPE:
|
|
case SYSTEM_ALARM_OBJECT_ACE_TYPE:
|
|
{
|
|
CHAR more_pad[MAX_PATH];
|
|
ACCESS_ALLOWED_OBJECT_ACE *tace = (ACCESS_ALLOWED_OBJECT_ACE *) ace;
|
|
PBYTE ptr;
|
|
GUID *obj_guid = NULL, *inh_obj_guid = NULL;
|
|
|
|
dprintf("%s->Mask : 0x%08lx\n", temp_pad, tace->Mask);
|
|
dprintf("%s->Flags : 0x%08lx\n", temp_pad, tace->Flags);
|
|
|
|
ptr = (PBYTE)&(tace->ObjectType);
|
|
|
|
if (tace->Flags & ACE_OBJECT_TYPE_PRESENT)
|
|
{
|
|
dprintf("%s : ACE_OBJECT_TYPE_PRESENT\n", temp_pad);
|
|
obj_guid = &(tace->ObjectType);
|
|
ptr = (PBYTE)&(tace->InheritedObjectType);
|
|
}
|
|
|
|
if (tace->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)
|
|
{
|
|
dprintf("%s : ACE_INHERITED_OBJECT_TYPE_PRESENT\n", temp_pad);
|
|
inh_obj_guid = &(tace->InheritedObjectType);
|
|
ptr = (PBYTE)&(tace->SidStart);
|
|
}
|
|
|
|
if (obj_guid)
|
|
{
|
|
dprintf("%s->ObjectType : (in HEX)", temp_pad);
|
|
dprintf("(%08lx-%04x-%04x-%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x)\n",
|
|
obj_guid->Data1,
|
|
obj_guid->Data2,
|
|
obj_guid->Data3,
|
|
obj_guid->Data4[0],
|
|
obj_guid->Data4[1],
|
|
obj_guid->Data4[2],
|
|
obj_guid->Data4[3],
|
|
obj_guid->Data4[4],
|
|
obj_guid->Data4[5],
|
|
obj_guid->Data4[6],
|
|
obj_guid->Data4[7]
|
|
);
|
|
}
|
|
|
|
if (inh_obj_guid)
|
|
{
|
|
dprintf("%s->InhObjTYpe : (in HEX)", temp_pad);
|
|
dprintf("(%08lx-%04x-%04x-%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x)\n",
|
|
inh_obj_guid->Data1,
|
|
inh_obj_guid->Data2,
|
|
inh_obj_guid->Data3,
|
|
inh_obj_guid->Data4[0],
|
|
inh_obj_guid->Data4[1],
|
|
inh_obj_guid->Data4[2],
|
|
inh_obj_guid->Data4[3],
|
|
inh_obj_guid->Data4[4],
|
|
inh_obj_guid->Data4[5],
|
|
inh_obj_guid->Data4[6],
|
|
inh_obj_guid->Data4[7]
|
|
);
|
|
}
|
|
|
|
sprintf(more_pad, "%s->SID : ", temp_pad);
|
|
DumpSID(more_pad, ptr, Flags);
|
|
}
|
|
break;
|
|
|
|
case ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE:
|
|
case ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE:
|
|
case SYSTEM_AUDIT_CALLBACK_OBJECT_ACE_TYPE:
|
|
case SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE:
|
|
{
|
|
CHAR more_pad[MAX_PATH];
|
|
ACCESS_ALLOWED_OBJECT_ACE *tace = (ACCESS_ALLOWED_OBJECT_ACE *) ace;
|
|
PBYTE ptr;
|
|
GUID *obj_guid = NULL, *inh_obj_guid = NULL;
|
|
|
|
dprintf("%s->Mask : 0x%08lx\n", temp_pad, tace->Mask);
|
|
dprintf("%s->Flags : 0x%08lx\n", temp_pad, tace->Flags);
|
|
|
|
ptr = (PBYTE)&(tace->ObjectType);
|
|
|
|
if (tace->Flags & ACE_OBJECT_TYPE_PRESENT)
|
|
{
|
|
dprintf("%s : ACE_OBJECT_TYPE_PRESENT\n", temp_pad);
|
|
obj_guid = &(tace->ObjectType);
|
|
ptr = (PBYTE)&(tace->InheritedObjectType);
|
|
}
|
|
|
|
if (tace->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)
|
|
{
|
|
dprintf("%s : ACE_INHERITED_OBJECT_TYPE_PRESENT\n", temp_pad);
|
|
inh_obj_guid = &(tace->InheritedObjectType);
|
|
ptr = (PBYTE)&(tace->SidStart);
|
|
}
|
|
|
|
if (obj_guid)
|
|
{
|
|
dprintf("%s->ObjectType : (in HEX)", temp_pad);
|
|
dprintf("(%08lx-%04x-%04x-%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x)\n",
|
|
obj_guid->Data1,
|
|
obj_guid->Data2,
|
|
obj_guid->Data3,
|
|
obj_guid->Data4[0],
|
|
obj_guid->Data4[1],
|
|
obj_guid->Data4[2],
|
|
obj_guid->Data4[3],
|
|
obj_guid->Data4[4],
|
|
obj_guid->Data4[5],
|
|
obj_guid->Data4[6],
|
|
obj_guid->Data4[7]
|
|
);
|
|
}
|
|
|
|
if (inh_obj_guid)
|
|
{
|
|
dprintf("%s->InhObjTYpe : (in HEX)", temp_pad);
|
|
dprintf("(%08lx-%04x-%04x-%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x)\n",
|
|
inh_obj_guid->Data1,
|
|
inh_obj_guid->Data2,
|
|
inh_obj_guid->Data3,
|
|
inh_obj_guid->Data4[0],
|
|
inh_obj_guid->Data4[1],
|
|
inh_obj_guid->Data4[2],
|
|
inh_obj_guid->Data4[3],
|
|
inh_obj_guid->Data4[4],
|
|
inh_obj_guid->Data4[5],
|
|
inh_obj_guid->Data4[6],
|
|
inh_obj_guid->Data4[7]
|
|
);
|
|
}
|
|
|
|
sprintf(more_pad, "%s->SID : ", temp_pad);
|
|
DumpSID(more_pad, ptr, Flags);
|
|
dprintf("%s->Address : %08p\n", temp_pad, Start + (ULONG) (((PUCHAR) ace) - ((PUCHAR) pacl)));
|
|
}
|
|
break;
|
|
}
|
|
dprintf("\n");
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: DumpSD
|
|
|
|
FUNCTION: Prints out a Security Descriptor,
|
|
with the padding provided.
|
|
|
|
ARGS: pad -- Padding to print before the ACL.
|
|
sd_to_dump -- Pointer to the ACL to print.
|
|
owner -- Ptr to Owner SID
|
|
group -- Ptr to Group SID
|
|
dacl -- Ptr to DACL
|
|
sacl -- Ptr to SACL
|
|
Flag -- To control options.
|
|
dacl_address -- Actual start address of the dacl
|
|
sacl_address -- Actual start address of the sacl
|
|
|
|
RETURN: N/A
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
BOOL
|
|
DumpSD (
|
|
IN char *pad,
|
|
IN ULONG64 sd_to_dump,
|
|
IN PSID owner,
|
|
IN PSID group,
|
|
IN PACL dacl,
|
|
IN PACL sacl,
|
|
IN ULONG Flags,
|
|
IN ULONG64 dacl_address,
|
|
IN ULONG64 sacl_address
|
|
)
|
|
{
|
|
ULONG Control;
|
|
|
|
InitTypeRead(sd_to_dump, SECURITY_DESCRIPTOR);
|
|
Control = (ULONG) ReadField(Control);
|
|
|
|
#define CHECK_SD_CONTROL_FOR(x)\
|
|
if (Control & x)\
|
|
{\
|
|
dprintf("%s %s\n", pad, #x);\
|
|
}\
|
|
|
|
dprintf("%s->Revision: 0x%x\n", pad, (ULONG) ReadField(Revision));
|
|
dprintf("%s->Sbz1 : 0x%x\n", pad, (ULONG) ReadField(Sbz1));
|
|
dprintf("%s->Control : 0x%x\n", pad, (ULONG) ReadField(Control));
|
|
|
|
CHECK_SD_CONTROL_FOR(SE_OWNER_DEFAULTED)
|
|
CHECK_SD_CONTROL_FOR(SE_GROUP_DEFAULTED)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_PRESENT)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_DEFAULTED)
|
|
CHECK_SD_CONTROL_FOR(SE_SACL_PRESENT)
|
|
CHECK_SD_CONTROL_FOR(SE_SACL_DEFAULTED)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_UNTRUSTED)
|
|
CHECK_SD_CONTROL_FOR(SE_SERVER_SECURITY)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_AUTO_INHERIT_REQ)
|
|
CHECK_SD_CONTROL_FOR(SE_SACL_AUTO_INHERIT_REQ)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_AUTO_INHERITED)
|
|
CHECK_SD_CONTROL_FOR(SE_SACL_AUTO_INHERITED)
|
|
CHECK_SD_CONTROL_FOR(SE_DACL_PROTECTED)
|
|
CHECK_SD_CONTROL_FOR(SE_SACL_PROTECTED)
|
|
CHECK_SD_CONTROL_FOR(SE_SELF_RELATIVE)
|
|
|
|
{
|
|
CHAR temp_pad[MAX_PATH];
|
|
|
|
sprintf(temp_pad, "%s->Owner : ", pad);
|
|
|
|
DumpSID(temp_pad, owner, Flags);
|
|
|
|
sprintf(temp_pad, "%s->Group : ", pad);
|
|
|
|
DumpSID(temp_pad, group, Flags);
|
|
|
|
sprintf(temp_pad, "%s->Dacl : ", pad);
|
|
|
|
DumpACL(temp_pad, dacl, Flags, dacl_address);
|
|
|
|
sprintf(temp_pad, "%s->Sacl : ", pad);
|
|
|
|
DumpACL(temp_pad, sacl, Flags, sacl_address);
|
|
}
|
|
|
|
#undef CHECK_SD_CONTROL_FOR
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: sd
|
|
|
|
FUNCTION: Reads in & prints the security descriptor, from
|
|
the address specified. !sd command's workhorse.
|
|
|
|
ARGS: Standard Debugger extensions, refer to DECLARE_API
|
|
macro in the header files.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
|
|
|
|
DECLARE_API( sd )
|
|
{
|
|
ULONG64 Address;
|
|
ULONG Flags;
|
|
ULONG result;
|
|
PACL dacl = NULL, sacl = NULL;
|
|
ULONG64 dacl_address;
|
|
ULONG64 sacl_address;
|
|
// SECURITY_DESCRIPTOR sd_to_dump;
|
|
PSID owner_sid = NULL, group_sid = NULL;
|
|
ULONG Control;
|
|
|
|
Address = 0;
|
|
Flags = 6;
|
|
sscanf(args,"%lx %lx",&Address,&Flags);
|
|
Address = GetExpression(args);
|
|
|
|
if (Address == 0) {
|
|
dprintf("usage: !sd <SecurityDescriptor-address>\n");
|
|
goto CLEANUP;
|
|
}
|
|
|
|
if ( GetFieldValue( Address,
|
|
"SECURITY_DESCRIPTOR",
|
|
"Control",
|
|
Control) ) {
|
|
dprintf("%08p: Unable to get SD contents\n", Address);
|
|
goto CLEANUP;
|
|
}
|
|
|
|
if (Control & SE_SELF_RELATIVE)
|
|
{
|
|
ULONG dacl_offset, sacl_offset;
|
|
|
|
InitTypeRead(Address, SECURITY_DESCRIPTOR_RELATIVE);
|
|
|
|
dacl_offset = (ULONG) ReadField(Dacl);
|
|
sacl_offset = (ULONG) ReadField(Sacl);
|
|
|
|
if (!(Control & SE_OWNER_DEFAULTED)) /* read in the owner */
|
|
{
|
|
ULONG owner_offset = (ULONG) ReadField(Owner);
|
|
ULONG64 owner_address = Address + owner_offset;
|
|
|
|
if (! sid_successfully_read(owner_address, & owner_sid))
|
|
{
|
|
dprintf("%08p: Unable to read in Owner in SD\n", owner_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
if (!(Control & SE_GROUP_DEFAULTED)) /* read in the group */
|
|
{
|
|
ULONG group_offset = (ULONG) ReadField(Group);
|
|
ULONG64 group_address = Address + group_offset;
|
|
|
|
if (! sid_successfully_read(group_address, & group_sid))
|
|
{
|
|
dprintf("%08p: Unable to read in Group in SD\n", group_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
if ((Control & SE_DACL_PRESENT) &&
|
|
(dacl_offset != 0))
|
|
{
|
|
dacl_address = Address + dacl_offset;
|
|
|
|
if (! acl_successfully_read(dacl_address, & dacl))
|
|
{
|
|
dprintf("%08p: Unable to read in Dacl in SD\n", dacl_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
|
|
if ((Control & SE_SACL_PRESENT) &&
|
|
(sacl_offset != 0))
|
|
{
|
|
sacl_address = Address + sacl_offset;
|
|
|
|
if (! acl_successfully_read(sacl_address, & sacl))
|
|
{
|
|
dprintf("%08p: Unable to read in Sacl in SD\n", sacl_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
ULONG64 Dacl, Sacl;
|
|
InitTypeRead(Address, SECURITY_DESCRIPTOR);
|
|
|
|
Dacl = ReadField(Dacl);
|
|
Sacl = ReadField(Sacl);
|
|
|
|
if (!(Control & SE_OWNER_DEFAULTED)) /* read in the owner */
|
|
{
|
|
ULONG64 owner_address = ReadField(Owner);
|
|
|
|
if (! sid_successfully_read(owner_address, & owner_sid))
|
|
{
|
|
dprintf("%08p: Unable to read in Owner in SD\n", owner_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
if (!(Control & SE_GROUP_DEFAULTED)) /* read in the group */
|
|
{
|
|
ULONG64 group_address = ReadField(Group);
|
|
|
|
if (! sid_successfully_read(group_address, & group_sid))
|
|
{
|
|
dprintf("%08p: Unable to read in Group in SD\n", group_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
if ((Control & SE_DACL_PRESENT) &&
|
|
(Dacl != 0))
|
|
{
|
|
dacl_address = Dacl;
|
|
|
|
if (! acl_successfully_read(dacl_address, & dacl))
|
|
{
|
|
dprintf("%08p: Unable to read in Dacl in SD\n", dacl_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
|
|
if ((Control & SE_SACL_PRESENT) &&
|
|
(Sacl != 0))
|
|
{
|
|
sacl_address = (Sacl);
|
|
|
|
if (! acl_successfully_read(sacl_address, & sacl))
|
|
{
|
|
dprintf("%08p: Unable to read in Sacl in SD\n", sacl_address);
|
|
goto CLEANUP;
|
|
}
|
|
}
|
|
}
|
|
|
|
DumpSD("", Address, owner_sid, group_sid, dacl, sacl, Flags, dacl_address, sacl_address);
|
|
|
|
|
|
CLEANUP:
|
|
|
|
if (owner_sid)
|
|
{
|
|
free(owner_sid);
|
|
}
|
|
|
|
if (group_sid)
|
|
{
|
|
free(group_sid);
|
|
}
|
|
|
|
if (dacl)
|
|
{
|
|
free(dacl);
|
|
}
|
|
|
|
if (sacl)
|
|
{
|
|
free(sacl);
|
|
}
|
|
return S_OK;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: sid
|
|
|
|
FUNCTION: Reads in & prints the SID, from
|
|
the address specified. !sid command's workhorse.
|
|
|
|
ARGS: Standard Debugger extensions, refer to DECLARE_API
|
|
macro in the header files.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
DECLARE_API( sid )
|
|
{
|
|
ULONG64 Address;
|
|
ULONG Flags;
|
|
ULONG result;
|
|
PSID sid_to_dump;
|
|
NTSTATUS ntstatus;
|
|
UNICODE_STRING us;
|
|
|
|
|
|
Address = 0;
|
|
Flags = 6;
|
|
sscanf(args,"%lx %lx",&Address,&Flags);
|
|
Address = GetExpression(args);
|
|
|
|
if (Address == 0) {
|
|
dprintf("usage: !sid <SID-address>\n");
|
|
return E_INVALIDARG;
|
|
}
|
|
|
|
if (! sid_successfully_read(Address, & sid_to_dump))
|
|
{
|
|
dprintf("%08p: Unable to read in SID\n", Address);
|
|
return E_INVALIDARG;
|
|
}
|
|
|
|
DumpSID("SID is: ", sid_to_dump, Flags);
|
|
|
|
return S_OK;
|
|
}
|
|
|
|
/*
|
|
+-------------------------------------------------------------------+
|
|
|
|
NAME: acl
|
|
|
|
FUNCTION: Reads in & prints the ACL, from
|
|
the address specified. !acl command's workhorse.
|
|
|
|
ARGS: Standard Debugger extensions, refer to DECLARE_API
|
|
macro in the header files.
|
|
|
|
+-------------------------------------------------------------------+
|
|
*/
|
|
|
|
DECLARE_API( acl )
|
|
{
|
|
ULONG64 Address;
|
|
ULONG Flags;
|
|
ULONG result;
|
|
PACL acl_to_dump;
|
|
NTSTATUS ntstatus;
|
|
UNICODE_STRING us;
|
|
|
|
|
|
Address = 0;
|
|
Flags = 6;
|
|
sscanf(args,"%lx %lx",&Address,&Flags);
|
|
Address = GetExpression (args);
|
|
if (Address == 0) {
|
|
dprintf("usage: !acl <ACL-address>\n");
|
|
return E_INVALIDARG;
|
|
}
|
|
|
|
if (! acl_successfully_read(Address, & acl_to_dump))
|
|
{
|
|
dprintf("%08p: Unable to read in ACL\n", Address);
|
|
return E_INVALIDARG;
|
|
}
|
|
|
|
DumpACL("ACL is: ", acl_to_dump, Flags, Address);
|
|
|
|
return S_OK;
|
|
}
|