[NDK] Match AUX_ACCESS_DATA definition with publicly available version.

Looks like public symbols contain this structure starting with Win7,
so we can deduce what it looked like in Win2003.
Note that our previous definition was missing a second ULONG at the
end, which can be seen in the SeQueryInfoToken kmtest -- if you
allocated only sizeof(AUX_ACCESS_DATA), the test would crash with
a 4 byte buffer overflow.
This commit is contained in:
Thomas Faber 2023-05-27 18:24:29 -04:00 committed by Timo Kreuzer
parent ff410211e9
commit 156053cafd
5 changed files with 45 additions and 30 deletions

View file

@ -255,9 +255,24 @@ typedef struct _TOKEN
typedef struct _AUX_ACCESS_DATA
{
PPRIVILEGE_SET PrivilegeSet;
PPRIVILEGE_SET PrivilegesUsed;
GENERIC_MAPPING GenericMapping;
ULONG Reserved;
ACCESS_MASK AccessesToAudit;
ACCESS_MASK MaximumAuditMask;
#if (NTDDI_VERSION >= NTDDI_LONGHORN)
GUID TransactionId;
#endif
#if (NTDDI_VERSION >= NTDDI_WIN7)
PVOID NewSecurityDescriptor;
PVOID ExistingSecurityDescriptor;
PVOID ParentSecurityDescriptor;
VOID (NTAPI *DerefSecurityDescriptor)(PVOID, PVOID);
PVOID SDLock;
ACCESS_REASONS AccessReasons;
#endif
#if (NTDDI_VERSION >= NTDDI_WIN8)
BOOLEAN GenerateStagingEvents;
#endif
} AUX_ACCESS_DATA, *PAUX_ACCESS_DATA;
//