#define TOKEN_SOURCE_LENGTH 8
#define SID_HASH_SIZE 32

#define TOKEN_MANDATORY_POLICY_OFF             0x0
#define TOKEN_MANDATORY_POLICY_NO_WRITE_UP     0x1
#define TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN 0x2

#define TOKEN_MANDATORY_POLICY_VALID_MASK      (TOKEN_MANDATORY_POLICY_NO_WRITE_UP | \
                                                TOKEN_MANDATORY_POLICY_NEW_PROCESS_MIN)

/* from ntseapi.h
 * https://github.com/PKRoma/ProcessHacker/blob/8cd2217e9ff2170096d85b0fdafd5f1e1a8c925f/phnt/include/ntseapi.h
 */

#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INVALID 0x00
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_INT64 0x01
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_UINT64 0x02
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_STRING 0x03
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_FQBN 0x04
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_SID 0x05
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_BOOLEAN 0x06
#define TOKEN_SECURITY_ATTRIBUTE_TYPE_OCTET_STRING 0x10

// Flags

#define TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE 0x0001
#define TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE 0x0002
#define TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY 0x0004
#define TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT 0x0008
#define TOKEN_SECURITY_ATTRIBUTE_DISABLED 0x0010
#define TOKEN_SECURITY_ATTRIBUTE_MANDATORY 0x0020

#define TOKEN_SECURITY_ATTRIBUTE_VALID_FLAGS ( \
    TOKEN_SECURITY_ATTRIBUTE_NON_INHERITABLE | \
    TOKEN_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE | \
    TOKEN_SECURITY_ATTRIBUTE_USE_FOR_DENY_ONLY | \
    TOKEN_SECURITY_ATTRIBUTE_DISABLED_BY_DEFAULT | \
    TOKEN_SECURITY_ATTRIBUTE_DISABLED | \
    TOKEN_SECURITY_ATTRIBUTE_MANDATORY)

#define TOKEN_SECURITY_ATTRIBUTE_CUSTOM_FLAGS 0xffff0000

#define TOKEN_ASSIGN_PRIMARY    (0x0001)
#define TOKEN_DUPLICATE         (0x0002)
#define TOKEN_IMPERSONATE       (0x0004)
#define TOKEN_QUERY             (0x0008)
#define TOKEN_QUERY_SOURCE      (0x0010)
#define TOKEN_ADJUST_PRIVILEGES (0x0020)
#define TOKEN_ADJUST_GROUPS     (0x0040)
#define TOKEN_ADJUST_DEFAULT    (0x0080)
#define TOKEN_ADJUST_SESSIONID  (0x0100)

#define TOKEN_ALL_ACCESS_P (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT)

#define TOKEN_ALL_ACCESS  (TOKEN_ALL_ACCESS_P | TOKEN_ADJUST_SESSIONID )

/* Privileges attributes */

#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L)
#define SE_PRIVILEGE_ENABLED            (0x00000002L)
#define SE_PRIVILEGE_REMOVED            (0X00000004L)
#define SE_PRIVILEGE_USED_FOR_ACCESS    (0x80000000L)

/* PRIVILEGES Names*/

#define SE_CREATE_TOKEN_NAME              ("SeCreateTokenPrivilege")
#define SE_ASSIGNPRIMARYTOKEN_NAME        ("SeAssignPrimaryTokenPrivilege")
#define SE_LOCK_MEMORY_NAME               ("SeLockMemoryPrivilege")
#define SE_INCREASE_QUOTA_NAME            ("SeIncreaseQuotaPrivilege")
#define SE_UNSOLICITED_INPUT_NAME         ("SeUnsolicitedInputPrivilege")
#define SE_MACHINE_ACCOUNT_NAME           ("SeMachineAccountPrivilege")
#define SE_TCB_NAME                       ("SeTcbPrivilege")
#define SE_SECURITY_NAME                  ("SeSecurityPrivilege")
#define SE_TAKE_OWNERSHIP_NAME            ("SeTakeOwnershipPrivilege")
#define SE_LOAD_DRIVER_NAME               ("SeLoadDriverPrivilege")
#define SE_SYSTEM_PROFILE_NAME            ("SeSystemProfilePrivilege")
#define SE_SYSTEMTIME_NAME                ("SeSystemtimePrivilege")
#define SE_PROF_SINGLE_PROCESS_NAME       ("SeProfileSingleProcessPrivilege")
#define SE_INC_BASE_PRIORITY_NAME         ("SeIncreaseBasePriorityPrivilege")
#define SE_CREATE_PAGEFILE_NAME           ("SeCreatePagefilePrivilege")
#define SE_CREATE_PERMANENT_NAME          ("SeCreatePermanentPrivilege")
#define SE_BACKUP_NAME                    ("SeBackupPrivilege")
#define SE_RESTORE_NAME                   ("SeRestorePrivilege")
#define SE_SHUTDOWN_NAME                  ("SeShutdownPrivilege")
#define SE_DEBUG_NAME                     ("SeDebugPrivilege")
#define SE_AUDIT_NAME                     ("SeAuditPrivilege")
#define SE_SYSTEM_ENVIRONMENT_NAME        ("SeSystemEnvironmentPrivilege")
#define SE_CHANGE_NOTIFY_NAME             ("SeChangeNotifyPrivilege")
#define SE_REMOTE_SHUTDOWN_NAME           ("SeRemoteShutdownPrivilege")
#define SE_UNDOCK_NAME                    ("SeUndockPrivilege")
#define SE_SYNC_AGENT_NAME                ("SeSyncAgentPrivilege")
#define SE_ENABLE_DELEGATION_NAME         ("SeEnableDelegationPrivilege")
#define SE_MANAGE_VOLUME_NAME             ("SeManageVolumePrivilege")
#define SE_IMPERSONATE_NAME               ("SeImpersonatePrivilege")
#define SE_CREATE_GLOBAL_NAME             ("SeCreateGlobalPrivilege")
#define SE_TRUSTED_CREDMAN_ACCESS_NAME    ("SeTrustedCredManAccessPrivilege")
#define SE_RELABEL_NAME                   ("SeRelabelPrivilege")
#define SE_INC_WORKING_SET_NAME           ("SeIncreaseWorkingSetPrivilege")
#define SE_TIME_ZONE_NAME                 ("SeTimeZonePrivilege")
#define SE_CREATE_SYMBOLIC_LINK_NAME      ("SeCreateSymbolicLinkPrivilege")