解读RtlGetIdentityAuthority

最新推荐文章于 2021-08-31 20:31:34 发布
最新推荐文章于 2021-08-31 20:31:34 发布
阅读量465 收藏
点赞数
分类专栏： WCP 操作系统相关 编程语言 系统维护
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/hadstj/article/details/53790847
版权
系统维护 同时被 3 个专栏收录
248 篇文章 0 订阅
订阅专栏
操作系统相关
179 篇文章 0 订阅
订阅专栏
WCP
86 篇文章 0 订阅
订阅专栏

解读RtlGetIdentityAuthority

 

RtlGetIdentityAuthority，这个函数使用的十分广泛，返回一组虚函数地址。

需要一个输入参数，但是，不起什么作用，直接传一个 0 即可。

输出参数为 IRtlIdentityAuthority接口。

调用这个函数，好像会影响两个全局变量：

g_pIIdentityAuthority

g_pIAppIdAuthority

typedefHRESULT(__fastcall *PRTL_GET_IDENTITY_AUTHORITY_FUNCTION)(INT, IIdentityAuthority **);

staticPRTL_GET_IDENTITY_AUTHORITY_FUNCTIONpRtlGetIdentityAuthority;

pRtlGetIdentityAuthority = (PRTL_GET_IDENTITY_AUTHORITY_FUNCTION)CalcFunctionAddress(phWCP, pfb_RtlGetIdentityAuthority);

IIdentityAuthority *Authority = NULL;

pRtlGetIdentityAuthority(0, &Authority);

 

 

Windows::Rtl::CRtlTearoffObject<class Windows::Rtl::CRtlInnerObjectTearoffImpl<class Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority> >::Release(void)

Windows::Rtl::CRtlTearoffObject<class Windows::Rtl::CRtlInnerObjectTearoffImpl<class Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority> >::CreateInterface(struct _GUID const &,class Windows::Auto<struct Windows::Rtl::IRtlObject *> *)

Parse(unsigned long,struct _LUNICODE_STRING const *,class Windows::Auto<struct Windows::Identity::Rtl::IRtlReferenceIdentity *> *)

Parse(unsigned long,struct _LUNICODE_STRING const *,class Windows::Auto<struct Windows::Identity::Rtl::IRtlDefinitionIdentity *> *)

Format(unsigned long,struct Windows::Identity::Rtl::IRtlBaseIdentity *,class Windows::Auto<struct _LUNICODE_STRING> *)

FormatIntoBuffer(unsigned long,struct Windows::Identity::Rtl::IRtlBaseIdentity *,struct _LUNICODE_STRING *,unsigned long *)

AreEqual(unsigned long,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,bool *)

AreEqual(unsigned long,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,bool *)

Matches(unsigned long,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,struct Windows::Identity::Rtl::IRtlReferenceIdentity *,bool *)

DetermineRelationship(unsigned long,struct Windows::Identity::Rtl::IRtlReferenceIdentity *,struct Windows::Identity::Rtl::IRtlReferenceIdentity *,unsigned long *)

Hash(unsigned long,unsigned long,struct Windows::Identity::Rtl::IRtlBaseIdentity *,unsigned __int64 *)

GenerateKeyFormIntoBuffer(unsigned long,struct Windows::Identity::Rtl::IRtlBaseIdentity *,struct _LUNICODE_STRING *)

CompareNames(unsigned long,struct _LUNICODE_STRING const *,struct _LUNICODE_STRING const *,int *)

CompareNames(unsigned long,struct _LUNICODE_STRING const *,struct _LUNICODE_STRING const *,int *)

CompareValues(unsigned long,struct _LUNICODE_STRING const *,struct _LUNICODE_STRING const *,int *)

HashNamespace(unsigned long,struct _LUNICODE_STRING const *,unsigned __int64 *)

HashName(unsigned long,struct _LUNICODE_STRING const *,unsigned __int64 *)

HashValue(unsigned long,struct _LBLOB const *,unsigned __int64 *)

HashName(unsigned long,struct _LUNICODE_STRING const *,unsigned __int64 *)

Create(unsigned long,struct Windows::Identity::Rtl::IRtlReferenceIdentity *,struct Windows::Identity::Rtl::BUILTIN_ATTRIBUTES const &,struct Windows::Vector<struct Windows::Identity::Rtl::_ATTRIBUTE const > const *,class Windows::Auto<struct Windows::Identity::Rtl::IRtlReferenceIdentity *> *)

Create(unsigned long,struct Windows::Identity::Rtl::IRtlDefinitionIdentity *,struct Windows::Identity::Rtl::BUILTIN_ATTRIBUTES const &,struct Windows::Vector<struct Windows::Identity::Rtl::_ATTRIBUTE const > const *,class Windows::Auto<struct Windows::Identity::Rtl::IRtlDefinitionIdentity *> *)

LookupBuiltinAttribute(unsigned long,struct _LUNICODE_STRING const *,unsigned long *)

 

与 IIdentityAuthority接口有显著差别：

EXTERN_C const IIDIID_IIdentityAuthority;

#if defined(__cplusplus) &&!defined(CINTERFACE)
MIDL_INTERFACE("261a6983-c35d-4d0d-aa5b-7867259e77bc")
IIdentityAuthority : public IUnknown
{
public:
    virtual HRESULTSTDMETHODCALLTYPE TextToDefinition(
        _In_  DWORD dwFlags,
        _In_  LPCWSTR pszIdentity,
        _Out_  IDefinitionIdentity **ppIDefinitionIdentity) = 0;
       
    virtual HRESULTSTDMETHODCALLTYPE TextToReference(
        _In_  DWORD dwFlags,
        _In_  LPCWSTR pszIdentity,
        _Out_  IReferenceIdentity **ppIReferenceIdentity) = 0;
       
    virtual HRESULT STDMETHODCALLTYPEDefinitionToText(
        _In_  DWORD dwFlags,
        _In_  IDefinitionIdentity *pIDefinitionIdentity,
        _Out_  LPWSTR *ppszFormattedIdentity) = 0;
       
    virtual HRESULTSTDMETHODCALLTYPE DefinitionToTextBuffer(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pIDefinitionIdentity,
       _In_  SIZE_T cchBufferSize,
       _Out_writes_to_(cchBufferSize, *pcchWritten)  WCHARwchBuffer[ ],
       _Out_  SIZE_T *pcchWritten) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE ReferenceToText(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _Out_  LPWSTR *ppszFormattedIdentity) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE ReferenceToTextBuffer(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _In_  SIZE_T cchBufferSize,
       _Out_writes_to_(cchBufferSize, *pcchWritten)  WCHARwchBuffer[ ],
       _Out_  SIZE_T *pcchWritten) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE AreDefinitionsEqual(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pDefinition1,
       _In_  IDefinitionIdentity *pDefinition2,
       _Out_  BOOL *pfEqual) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE AreReferencesEqual(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pReference1,
       _In_  IReferenceIdentity *pReference2,
       _Out_  BOOL *pfEqual) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE AreTextualDefinitionsEqual(
       _In_  DWORD dwFlags,
       _In_  LPCWSTR pszIdentityLeft,
       _In_  LPCWSTR pszIdentityRight,
       _Out_  BOOL *pfEqual) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE AreTextualReferencesEqual(
       _In_  DWORD dwFlags,
       _In_  LPCWSTR pszIdentityLeft,
       _In_  LPCWSTR pszIdentityRight,
       _Out_  BOOL *pfEqual) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE DoesDefinitionMatchReference(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pIDefinitionIdentity,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _Out_  BOOL *pfMatches) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE extualDefinitionMatchTextualReference(
       _In_  DWORD dwFlags,
       _In_  LPCWSTR pszDefinition,
       _In_  LPCWSTR pszReference,
       _Out_  BOOL *pfMatches) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE HashReference(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _Out_  ULONGLONG *pullPseudoKey) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE HashDefinition(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pIDefinitionIdentity,
       _Out_  ULONGLONG *pullPseudoKey) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE GenerateDefinitionKey(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pIDefinitionIdentity,
       _Out_  LPWSTR *ppszKeyForm) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE GenerateReferenceKey(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _Out_  LPWSTR *ppszKeyForm) = 0;
  
   virtual HRESULTSTDMETHODCALLTYPE CreateDefinition(
       _Out_  IDefinitionIdentity **ppNewIdentity)= 0;
  
   virtual HRESULTSTDMETHODCALLTYPE CreateReference(
       _Out_  IReferenceIdentity **ppNewIdentity) = 0;
       
   virtual HRESULTSTDMETHODCALLTYPE DefinitionToTextBufferLength(
       _In_  DWORD dwFlags,
       _In_  IDefinitionIdentity *pIDefinitionIdentity,
       _Out_  SIZE_T *pcchBufferRequired) = 0;
   
   virtual HRESULTSTDMETHODCALLTYPE ReferenceToTextBufferLength(
       _In_  DWORD dwFlags,
       _In_  IReferenceIdentity *pIReferenceIdentity,
       _Out_  SIZE_T *pcchBufferRequired) = 0;
   
};

但是，再仔细分析一下，实质上还是一致的。比如，IRtlIdentityAuthority 中的第一个函数 parse 与 lIdentityAuthority 中的第二个函数 TextToReference 就是一致的。

IRtlIdentityAuthority

lIdentityAuthority

parse

TextToReference

unsigned long

DWORD dwFlags

struct _LUNICODE_STRING const *

LPCWSTR pszIdentity

class Windows::Auto<struct Windows::Identity::Rtl::IRtlReferenceIdentity *> *

IReferenceIdentity **ppIReferenceIdentity

 

 

//----- (000000018010C0FC)----------------------------------------------------
__int64 __fastcall RtlGetIdentityAuthority(__int64 a1, structWindows::Rtl::OneShotTypeDescriptionRecord *a2)
{
  structWindows::Rtl::OneShotTypeDescriptionRecord *v2;// rdi@1
  unsigned int v3; // ebx@2
  void (__fastcall***v4)(_QWORD); // rdi@5
  void (__fastcall*v5)(_QWORD); // rsi@6
  void (__fastcall***v7)(_QWORD); // rsi@8
  void (__fastcall*v8)(_QWORD); // rbx@9
  int v9; // [sp+0h] [bp-60h]@4
  void (__fastcall***v10)(_QWORD); // [sp+20h][bp-40h]@4
  const char *v11; // [sp+28h][bp-38h]@2
  const char *v12; // [sp+30h][bp-30h]@2
  int v13; // [sp+38h] [bp-28h]@2
  const char *v14; // [sp+40h][bp-20h]@2
  unsigned int v15; // [sp+48h] [bp-18h]@1

  v15 =C00000E5;
  v2 =a2;
  if (!a2 )
  {
   Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter(&v15);
    v13 =94;
    v11 ="base\\wcp\\identity\\id_authority.cpp";
    v12 ="Windows::Identity::Rtl::RtlGetIdentityAuthority";
    v14 ="Not-null check failed: Authority";
   Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
      &v15,
      (__int64)&v11);
    return v15;
  }
  v3 =`anonymous namespace'::InitializeIdentityAuthority(a1,a2);
  if ((v3 &0x80000000) != 0 )
    return v3;
  _InterlockedOr((volatilesigned __int32 *)&v9,0);
  v10 =0i64;
  v3 =Windows::Rtl::IRtlObject::CreateRequiredInterface<Windows::Identity::Rtl::IRtlIdentityAuthority>(
         (_QWORD*)`anonymousnamespace'::g_RtlIdentityAuthority,
         &v10);
  if ((v3 &0x80000000) != 0 )
  {
    v4 =v10;
    if (v10 )
    {
      v5 =**v10;
      _guard_check_icall_fptr(**v10);
      v5(v4);
    }
    return v3;
  }
  v7 =*(void(__fastcall ****)(_QWORD))v2;
  *(_QWORD *)v2 =v10;
  if (v7 )
  {
    v8 =**v7;
    _guard_check_icall_fptr(**v7);
    v8(v7);
  }
  return 0i64;
}

 

//----- (1016BC61)--------------------------------------------------------
int __usercall `anonymous namespace'::InitializeIdentityAuthority@<eax>(volatilesigned __int32 *a1@<edi>)
{
  void (__thiscall***v1)(_DWORD); // esi@2
  int v2; // ecx@2
  int v3; // ebx@2
  int v4; // ST00_4@3
  volatile signed __int32*v5; //eax@3
  void (__thiscall*v6)(_DWORD); // edi@7
  void (__thiscall***v8)(_DWORD); // edi@9
  void (__thiscall*v9)(_DWORD); // esi@10
  signed __int32 v10; // [sp+Ch] [bp-8h]@1

  _InterlockedOr(&v10, 0);
  if (`anonymous namespace'::g_RtlIdentityAuthority )
    return 0;
  v1 =0;
  v10 =0;
  v3 =Windows::Rtl::CRtlOneShotTypeDescriptionInit<Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority>::Initialize(a1);
  if (v3 >= 0)
  {
    v4 =v2;
    v5 =(volatile signed __int32*)Windows::Rtl::CRtlOneShotTypeDescriptionInit<Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority>::TypeDescription();
    v3 =Windows::Rtl::CRtlObjectTypeDescription<Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority>::CreateInstance<Windows::Identity::Rtl::Implementation::CRtlIdentityAuthorityTearoff,int,Windows::Identity::Rtl::IRtlIdentityAuthority>(
           v5,
           v4,
           &v10);
    if (v3 >= 0)
      v3 =0;
    v1 =(void (__thiscall***)(_DWORD))v10;
    if (v3 >= 0)
    {
      v8 =(void (__thiscall***)(_DWORD))(_InterlockedCompareExchange(
                                            (volatile signed __int32*)&`anonymous namespace'::g_RtlIdentityAuthority,
                                            v10,
                                            0) != 0 ? (unsignedint)v1 : 0);
      if (v8 )
      {
        v9 =**v8;
        __guard_check_icall_fptr(**v8);
        v9(v8);
      }
      return 0;
    }
  }
  if (v1 )
  {
    v6 =**v1;
    __guard_check_icall_fptr(**v1);
    v6(v1);
  }
  return v3;
}

心想才事成
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
LLaMA模型系统解读
herosunly的博客
05-22 11万+
本文介绍核心内容为LLaMA模型系统解读，希望对学习和使用大模型的同学们有所帮助。 文章目录 1. 前言 2. LLaMA的核心目标和成功诀窍 2.1 核心目标 2.2 成功诀窍一 2.3 成功诀窍二 2.4 成功诀窍三 3. 常见误区 3.1 误区一 3.2 误区二 3.3 误区三 3.4 误区四
获取identity的几种方法
starseeker7的专栏
01-31 1029
根据业务需要，慎用标识值获取函数     获取刚插入记录的标识值有三种方式，必须理解清楚它们的区别，否则很容易获取到错误的标识值： @@IDENTITY     这是最常用的，它返回当前会话的所有作用域的最后一个标识值。但是若你的插入语句触发了一个触发器，这个 触发器也产生一个标识值，则@@IDENTITY返回的是触发器产生的标识值，而不是你的插入语句产生的标识值 SCOPE_
php登陆功能实现原理,详细解读PHP的Yii框架中登陆功能的实现
weixin_34164146的博客
03-10 392
Yii的登陆机制Yii 生成应用时已经提供了最基础的用户登陆机制。我们用 Yii 生成一个新的应用，进入 protected/components 目录，我们可以看到 UserIdentity.php 文件，里面的 UserIdentity 类里面只有一个 public 函数如下：public function authenticate(){$users=array(// username =&g...
insert data / get identity
weixin_43674051的博客
08-31 80
using System; using System.Data; using System.Data.SqlClient; namespace ADO.NETDemo { class Program { static void Main(string[] args) { //string connString = "Server=.;Database=mydatabase082;uid=sa;pwd=886566"; ...
IdentitySever4 入门篇(简单的身份验证)
weixin_43925876的博客
04-01 5719
本文参考：https://www.cnblogs.com/stulzq/p/8119928.html 什么是IdentitySever4 什么是identityServer4,这是一个OpenID Connect提供程序的身份验证组件。是一套身份验证框架 服务端将需要限制访问的数据，进行封装套一个壳。只有用户通过令牌验证核对才可以请求服务端包裹壳内的数据。 identity4的认证授权方...
JESD209-4B_LPDDR4 中文注释解读.pdf
06-18
**重要提醒: 解读已更新到v2, 最后更新时间22021-7-11 161631** 此文档对于JESD标准LPDDR4做中文解读，轻松理解LPDDR4标准。 为何有此文档? > 笔者曾经在dram领域摸爬滚打数年，深深感受到spec标准文档的理解直接...
DCMM标准解读.pdf
06-10
DCMM数据治理解读
JESD209-4C LPDDR4解读.pdf
08-01
此文档对于JESD标准LPDDR4做中文解读，轻松理解LPDDR4标准。 ** 行业标准： 作者有数年spec经验, 熟悉JEDEC标准建立的过程. ** 专业: 数年dram问题debug，spec解读专业到位。 ** 咨询: 承诺文档解读有疑问，可以...
《三级医院评审标准2021》解读.pptx
09-22
解读三级医院评审标准2021
Activiti 学习笔记13：分配组任务
勿忘初心
09-13 6918
一、流程图二、分配组任务方式一（直接指定办理人）1：流程图中任务节点的配置 2：测试代码ProcessEngine processEngine = ProcessEngines.getDefaultProcessEngine(); //部署流程定义，启动流程实例 @Test public void testTask() throws Exception {
util-1.表单相关操作(formUtil)
小僵尸喵喵喵
04-04 364
/** * ========================表单操作======================== */ var formUtil = function(){ /** * 表单序列化：serialize()方法通过序列化表单值，创建URL编码文本字符串。 * First name: <input type="text" name="Firs...
identify()被调用时
sssdffa的专栏
09-08 1388
当cderived。identify()被调用时，编译器查看identify()被派生类中定义的。还不行就开始寻找继承类中（在这种情况下是基地）。基地已经定义了一个identify()功能，因此使用一个。换句话说，基地：：identify()是因为可得出：：identify()不存在。 然而，如果我们定义的派生：：派生类中的identify()，它会被用来代替。这意味着我们可以函数有不同的工
identity
cxzhq2002的杂记
10-09 3728
 ============================================================using System;using System.Runtime.InteropServices;using System.Security.Principal;using System.Security.Permissions;using System.Windows.Fo
Chloe：一款轻量、高性能的.net C#数据访问框架(ORM)
grh_168的博客
11-26 1775
Usage Entity public enum Gender { Man = 1, Woman } [Table("Users")] public class User { [Column(IsPrimaryKey = true)] [AutoIncrement] public int Id { get; set; } public stri...
首次练习表单软件
xj_9264的博客
10-08 584
form1中代码为 ： function uf_onload() {//开始 dataset1.append();//开辟一块内存，存放开始数据 uf_query(); } function uf_query() {//查询 var param = {}; param.entid = dataset1.getValue('entid');//给id赋值 ds_entdoc.open...
使用getIdentifier()获取资源Id
热门推荐
叶园
07-12 5万+
使用getIdentifier()方法可以方便的获各应用包下的指定资源ID。 主要有两种方法： （1）方式一 Resources resources = context.getResources(); int indentify = resources.getIdentifier(org.loveandroid.androidtest:drawable/icon",null,null);
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值