HomePhorge

(PUP-839) FFI Util::Windows::Security::parse_dacl
470133da296dUnpublished

Unpublished Commit ยท Learn More

Repository Importing: This repository is still importing.

Description

(PUP-839) FFI Util::Windows::Security::parse_dacl

  • Previously parse_dacl did some byte manipulation that would have likely caused errors in x64. It also used a GetAce API definition that was not FFI'd and therefore would have had incorrect pointer lengths on x64. parse_dacl now accepts an FFI::Pointer as a param rather than an address.
  • New FFI structs have been created for ACE, ACE_HEADER and ACL that make casting memory addresses much simpler to reason about.
  • An extraneous call to IsValidSid was removed and the code flow was refactored to return sooner in unsupported / failure cases.

Details

Provenance
Ethan J. Brown <Iristyle@github>Authored on
vanmeeuwenPushed on Jun 2 2015, 2:22 PM
Parents
rPU795dfb04942f: (PUP-839) Remove windows/memory reference
Branches
Unknown
Tags
Unknown

Event Timeline

Ethan J. Brown <Iristyle@github> committed rPU470133da296d: (PUP-839) FFI Util::Windows::Security::parse_dacl (authored by Ethan J. Brown <Iristyle@github>).Jun 19 2014, 11:32 PM