mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
3ca3818e2a
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3993 21ef857c-d57f-4fe0-8362-d861dc6d29cd
412 lines
11 KiB
C
412 lines
11 KiB
C
#ifndef _NTSEAPI_H
|
|
#define _NTSEAPI_H
|
|
|
|
// Privileges
|
|
|
|
#define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
|
|
#define SE_CREATE_TOKEN_PRIVILEGE (2L)
|
|
#define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
|
|
#define SE_LOCK_MEMORY_PRIVILEGE (4L)
|
|
#define SE_INCREASE_QUOTA_PRIVILEGE (5L)
|
|
|
|
#define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
|
|
#define SE_TCB_PRIVILEGE (7L)
|
|
#define SE_SECURITY_PRIVILEGE (8L)
|
|
#define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
|
|
#define SE_LOAD_DRIVER_PRIVILEGE (10L)
|
|
#define SE_SYSTEM_PROFILE_PRIVILEGE (11L)
|
|
#define SE_SYSTEMTIME_PRIVILEGE (12L)
|
|
#define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
|
|
#define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
|
|
#define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
|
|
#define SE_CREATE_PERMANENT_PRIVILEGE (16L)
|
|
#define SE_BACKUP_PRIVILEGE (17L)
|
|
#define SE_RESTORE_PRIVILEGE (18L)
|
|
#define SE_SHUTDOWN_PRIVILEGE (19L)
|
|
#define SE_DEBUG_PRIVILEGE (20L)
|
|
#define SE_AUDIT_PRIVILEGE (21L)
|
|
#define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
|
|
#define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
|
|
#define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
|
|
#define SE_UNDOCK_PRIVILEGE (25L)
|
|
#define SE_SYNC_AGENT_PRIVILEGE (26L)
|
|
#define SE_ENABLE_DELEGATION_PRIVILEGE (27L)
|
|
#define SE_MANAGE_VOLUME_PRIVILEGE (28L)
|
|
#define SE_IMPERSONATE_PRIVILEGE (29L)
|
|
#define SE_CREATE_GLOBAL_PRIVILEGE (30L)
|
|
#define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
|
|
#define SE_RELABEL_PRIVILEGE (32L)
|
|
#define SE_INC_WORKING_SET_PRIVILEGE (33L)
|
|
#define SE_TIME_ZONE_PRIVILEGE (34L)
|
|
#define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)
|
|
#define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
|
|
|
|
// Tokens
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCreateToken(
|
|
__out PHANDLE TokenHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in TOKEN_TYPE TokenType,
|
|
__in PLUID AuthenticationId,
|
|
__in PLARGE_INTEGER ExpirationTime,
|
|
__in PTOKEN_USER User,
|
|
__in PTOKEN_GROUPS Groups,
|
|
__in PTOKEN_PRIVILEGES Privileges,
|
|
__in_opt PTOKEN_OWNER Owner,
|
|
__in PTOKEN_PRIMARY_GROUP PrimaryGroup,
|
|
__in_opt PTOKEN_DEFAULT_DACL DefaultDacl,
|
|
__in PTOKEN_SOURCE TokenSource
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenProcessToken(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenProcessTokenEx(
|
|
__in HANDLE ProcessHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ULONG HandleAttributes,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenThreadToken(
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in BOOLEAN OpenAsSelf,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenThreadTokenEx(
|
|
__in HANDLE ThreadHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in BOOLEAN OpenAsSelf,
|
|
__in ULONG HandleAttributes,
|
|
__out PHANDLE TokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtDuplicateToken(
|
|
__in HANDLE ExistingTokenHandle,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in POBJECT_ATTRIBUTES ObjectAttributes,
|
|
__in BOOLEAN EffectiveOnly,
|
|
__in TOKEN_TYPE TokenType,
|
|
__out PHANDLE NewTokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQueryInformationToken(
|
|
__in HANDLE TokenHandle,
|
|
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
|
__out_bcount(TokenInformationLength) PVOID TokenInformation,
|
|
__in ULONG TokenInformationLength,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtSetInformationToken(
|
|
__in HANDLE TokenHandle,
|
|
__in TOKEN_INFORMATION_CLASS TokenInformationClass,
|
|
__in_bcount(TokenInformationLength) PVOID TokenInformation,
|
|
__in ULONG TokenInformationLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAdjustPrivilegesToken(
|
|
__in HANDLE TokenHandle,
|
|
__in BOOLEAN DisableAllPrivileges,
|
|
__in_opt PTOKEN_PRIVILEGES NewState,
|
|
__in ULONG BufferLength,
|
|
__out_bcount_part_opt(BufferLength, *ReturnLength) PTOKEN_PRIVILEGES PreviousState,
|
|
__out __drv_when(PreviousState == NULL, __out_opt) PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAdjustGroupsToken(
|
|
__in HANDLE TokenHandle,
|
|
__in BOOLEAN ResetToDefault,
|
|
__in_opt PTOKEN_GROUPS NewState,
|
|
__in_opt ULONG BufferLength,
|
|
__out_bcount_part_opt(BufferLength, *ReturnLength) PTOKEN_GROUPS PreviousState,
|
|
__out PULONG ReturnLength
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtFilterToken(
|
|
__in HANDLE ExistingTokenHandle,
|
|
__in ULONG Flags,
|
|
__in_opt PTOKEN_GROUPS SidsToDisable,
|
|
__in_opt PTOKEN_PRIVILEGES PrivilegesToDelete,
|
|
__in_opt PTOKEN_GROUPS RestrictedSids,
|
|
__out PHANDLE NewTokenHandle
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCompareTokens(
|
|
__in HANDLE FirstTokenHandle,
|
|
__in HANDLE SecondTokenHandle,
|
|
__out PBOOLEAN Equal
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtPrivilegeCheck(
|
|
__in HANDLE ClientToken,
|
|
__inout PPRIVILEGE_SET RequiredPrivileges,
|
|
__out PBOOLEAN Result
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtImpersonateAnonymousToken(
|
|
__in HANDLE ThreadHandle
|
|
);
|
|
|
|
// Access checking
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheck(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByType(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_ecount(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeResultList(
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in_ecount(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__out_bcount(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
|
|
__inout PULONG PrivilegeSetLength,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus
|
|
);
|
|
|
|
// Audit alarm
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out PACCESS_MASK GrantedAccess,
|
|
__out PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeResultListAndAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in HANDLE ClientToken,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in_opt PSID PrincipalSelfSid,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in AUDIT_EVENT_TYPE AuditType,
|
|
__in ULONG Flags,
|
|
__in_ecount_opt(ObjectTypeListLength) POBJECT_TYPE_LIST ObjectTypeList,
|
|
__in ULONG ObjectTypeListLength,
|
|
__in PGENERIC_MAPPING GenericMapping,
|
|
__in BOOLEAN ObjectCreation,
|
|
__out_ecount(ObjectTypeListLength) PACCESS_MASK GrantedAccess,
|
|
__out_ecount(ObjectTypeListLength) PNTSTATUS AccessStatus,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtOpenObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in PUNICODE_STRING ObjectTypeName,
|
|
__in PUNICODE_STRING ObjectName,
|
|
__in_opt PSECURITY_DESCRIPTOR SecurityDescriptor,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in ACCESS_MASK GrantedAccess,
|
|
__in_opt PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN ObjectCreation,
|
|
__in BOOLEAN AccessGranted,
|
|
__out PBOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtPrivilegeObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in HANDLE ClientToken,
|
|
__in ACCESS_MASK DesiredAccess,
|
|
__in PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN AccessGranted
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtCloseObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in BOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtDeleteObjectAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in_opt PVOID HandleId,
|
|
__in BOOLEAN GenerateOnClose
|
|
);
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtPrivilegedServiceAuditAlarm(
|
|
__in PUNICODE_STRING SubsystemName,
|
|
__in PUNICODE_STRING ServiceName,
|
|
__in HANDLE ClientToken,
|
|
__in PPRIVILEGE_SET Privileges,
|
|
__in BOOLEAN AccessGranted
|
|
);
|
|
|
|
// Authz
|
|
|
|
#if (PHNT_VERSION >= PHNT_WIN7)
|
|
// rev
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtQuerySecurityAttributesToken(
|
|
__in HANDLE TokenHandle,
|
|
__in_ecount_opt(NumberOfAttributes) PUNICODE_STRING Attributes,
|
|
__in ULONG NumberOfAttributes,
|
|
__out_bcount(Length) PVOID Buffer, // PAUTHZ_SECURITY_ATTRIBUTES_INFORMATION
|
|
__in ULONG Length,
|
|
__out PULONG ReturnLength
|
|
);
|
|
#endif
|
|
|
|
#endif
|