13 Security Lab

System 권한여부체크 [1] 본문

Computer Science/Windows Externals

System 권한여부체크 [1]

Maj0r Tom 2015. 5. 11. 17:52

System 권한여부체크



1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
signed int __thiscall Check_ProcessSID(void *this)
{
  Flag = 0;
  hToken = 0;
  if ( OpenProcessToken(this, 8, &hToken) )
  {
    v5 = 0x44;
    if ( CreateWellKnownSid(22, 0, &SystemSID_INFO, &v5) )// 22 : WinLocalSystemSid
    {
      v7 = 0;
      GetTokenInformation(hToken, 1, 0);
      if ( GetLastError() == 122 )
      {
        LocalMem_Var = HeapAlloc(dword_405048); // Get local HeapMemory 
        if ( LocalMem_Var )
        { 
          // Get LocalMem_SID & Compare with SystemSID
          if ( GetTokenInformation(hToken, 1, LocalMem_Var) 
                && EqualSid(*(_DWORD *)LocalMem_Var, &SystemSID_INFO) ) 
                                                
            Flag = 1;
          HeapFree(dword_405048, 0, LocalMem_Var);
        }
      }
    }
    CloseHandle(hToken);
  }
  return Flag;
}




공유하기 링크
'Computer Science/Windows Externals' Related Articles more
Comments