debug.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for debug.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
VOID	SepDumpSdDebugInfo (_In_opt_ PISECURITY_DESCRIPTOR SecurityDescriptor)
	Dumps debug information of a security descriptor to the debugger.
VOID	SepDumpTokenDebugInfo (_In_opt_ PTOKEN Token)
	Dumps debug information of an access token to the debugger.
VOID	SepDumpAccessRightsStats (_In_ PACCESS_CHECK_RIGHTS AccessRights)
	Dumps security access rights to the debugger.
VOID	SepDumpAccessAndStatusList (_In_ PACCESS_MASK GrantedAccessList, _In_ PNTSTATUS AccessStatusList, _In_ BOOLEAN IsResultList, _In_ POBJECT_TYPE_LIST_INTERNAL ObjectTypeList, _In_ ULONG ObjectTypeListLength)
	Dumps access and status values of each object type in the result list.

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 11 of file debug.c.

Function Documentation

SepDumpAccessAndStatusList()

VOID SepDumpAccessAndStatusList	(	_In_ PACCESS_MASK	GrantedAccessList,
		_In_ PNTSTATUS	AccessStatusList,
		_In_ BOOLEAN	IsResultList,
		_In_ POBJECT_TYPE_LIST_INTERNAL	ObjectTypeList,
		_In_ ULONG	ObjectTypeListLength
	)

Dumps access and status values of each object type in the result list.

Definition at line 353 of file debug.c.

{
#ifndef NDEBUG
    ULONG ResultListIndex;
    ULONG ObjectTypeIndex;
    ULONG ResultListLength;
 
    DbgPrint("================== ACCESS & STATUS OBJECT TYPE LIST STATISTICS ==================\n");
    ResultListLength = IsResultList ? ObjectTypeListLength : 1;
    for (ResultListIndex = 0; ResultListIndex < ResultListLength; ResultListIndex++)
    {
        DbgPrint("Result Index #%lu, Granted access rights -> 0x%08lx, Access status -> 0x%08lx\n",
            ResultListIndex, GrantedAccessList[ResultListIndex], AccessStatusList[ResultListIndex]);
    }
 
    for (ObjectTypeIndex = 0; ObjectTypeIndex < ObjectTypeListLength; ObjectTypeIndex++)
    {
        DbgPrint("================== #%lu OBJECT ACCESS RIGHTS ==================\n", ObjectTypeIndex);
        DbgPrint("Remaining access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.RemainingAccessRights);
        DbgPrint("Granted access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.GrantedAccessRights);
        DbgPrint("Denied access rights -> 0x%08lx\n", ObjectTypeList[ObjectTypeIndex].ObjectAccessRights.DeniedAccessRights);
    }
#endif
}

Referenced by SepAccessCheckWorker().

SepDumpAccessRightsStats()

VOID SepDumpAccessRightsStats

(

_In_ PACCESS_CHECK_RIGHTS

AccessRights

)

Dumps security access rights to the debugger.

Definition at line 325 of file debug.c.

{
    /*
     * Dump the access rights only if we have remaining rights
     * to dump in the first place. RemainingAccessRights can be 0
     * if access check procedure has failed prematurely and this
     * member hasn't been filled yet.
     */
    if (!AccessRights->RemainingAccessRights)
    {
        return;
    }
 
#ifndef NDEBUG
    DbgPrint("================== ACCESS CHECK RIGHTS STATISTICS ==================\n");
    DbgPrint("Remaining access rights -> 0x%08lx\n", AccessRights->RemainingAccessRights);
    DbgPrint("Granted access rights -> 0x%08lx\n", AccessRights->GrantedAccessRights);
    DbgPrint("Denied access rights -> 0x%08lx\n", AccessRights->DeniedAccessRights);
#endif
}

Referenced by SepAccessCheckWorker().

SepDumpSdDebugInfo()

VOID SepDumpSdDebugInfo

(

_In_opt_ PISECURITY_DESCRIPTOR

SecurityDescriptor

)

Dumps debug information of a security descriptor to the debugger.

Definition at line 217 of file debug.c.

{
#ifndef NDEBUG
    UNICODE_STRING SidString;
    PSID OwnerSid, GroupSid;
    PACL Dacl, Sacl;
#endif
 
    /* Don't dump anything if no SD was provided */
    if (!SecurityDescriptor)
    {
        return;
    }
 
#ifndef NDEBUG
    /* Cache the necessary security buffers to dump info from */
    OwnerSid = SepGetOwnerFromDescriptor(SecurityDescriptor);
    GroupSid = SepGetGroupFromDescriptor(SecurityDescriptor);
    Sacl = SepGetSaclFromDescriptor(SecurityDescriptor);
    Dacl = SepGetDaclFromDescriptor(SecurityDescriptor);
 
    DbgPrint("================== SECURITY DESCRIPTOR DUMP INFO ==================\n");
    DbgPrint("SecurityDescriptor -> 0x%p\n", SecurityDescriptor);
    DbgPrint("SecurityDescriptor->Revision -> %u\n", SecurityDescriptor->Revision);
    DbgPrint("SecurityDescriptor->Control:\n");
    SepDumpSdControlInfo(SecurityDescriptor->Control);
 
    /* Dump the Owner SID if the SD belongs to an owner */
    if (OwnerSid)
    {
        RtlConvertSidToUnicodeString(&SidString, OwnerSid, TRUE);
        DbgPrint("SD Owner SID -> %wZ\n", &SidString);
        RtlFreeUnicodeString(&SidString);
    }
 
    /* Dump the Group SID if the SD belongs to a group */
    if (GroupSid)
    {
        RtlConvertSidToUnicodeString(&SidString, GroupSid, TRUE);
        DbgPrint("SD Group SID -> %wZ\n", &SidString);
        RtlFreeUnicodeString(&SidString);
    }
 
    /* Dump the ACL contents of SACL if this SD has one */
    if (Sacl)
    {
        SepDumpAclInfo(Sacl, TRUE);
    }
 
    /* Dump the ACL contents of DACL if this SD has one */
    if (Dacl)
    {
        SepDumpAclInfo(Dacl, FALSE);
    }
#endif
}

Referenced by SepAccessCheckWorker().

SepDumpTokenDebugInfo()

VOID SepDumpTokenDebugInfo

(

_In_opt_ PTOKEN

Token

)

Dumps debug information of an access token to the debugger.

Definition at line 280 of file debug.c.

{
#ifndef NDEBUG
    UNICODE_STRING SidString;
#endif
 
    /* Don't dump anything if no token was provided */
    if (!Token)
    {
        return;
    }
 
#ifndef NDEBUG
    /* Dump relevant token info */
    DbgPrint("================== ACCESS TOKEN DUMP INFO ==================\n");
    DbgPrint("Token -> 0x%p\n", Token);
    DbgPrint("Token->ImageFileName -> %s\n", Token->ImageFileName);
    DbgPrint("Token->TokenSource.SourceName -> \"%-.*s\"\n",
             RTL_NUMBER_OF(Token->TokenSource.SourceName),
             Token->TokenSource.SourceName);
    DbgPrint("Token->TokenSource.SourceIdentifier -> %lu.%lu\n",
             Token->TokenSource.SourceIdentifier.HighPart,
             Token->TokenSource.SourceIdentifier.LowPart);
 
    RtlConvertSidToUnicodeString(&SidString, Token->PrimaryGroup, TRUE);
    DbgPrint("Token primary group SID -> %wZ\n", &SidString);
    RtlFreeUnicodeString(&SidString);
 
    DbgPrint("Token user and groups SIDs:\n");
    SepDumpSidsOfToken(Token->UserAndGroups, Token->UserAndGroupCount);
 
    if (SeTokenIsRestricted(Token))
    {
        DbgPrint("Token restricted SIDs:\n");
        SepDumpSidsOfToken(Token->RestrictedSids, Token->RestrictedSidCount);
    }
#endif
}

Referenced by SepAccessCheckWorker().