Hello All,
I am writing a minifilter driver to run on XP. At Precreate time I am trying
to get the SID using the method that Tony Mason recommends (code is below).
And then using the SID in the call to LookupAccountSid (executed in user
space). The code seems to work (in the sense that I don’t get any errors)
except the only user names I ever get are either NULL because the
LookupAccountSid returns an error 1332 or SYSTEM. When LookupAccountSid
returns 1332, the SID is all zeros.
The test scenario is as follows:
The account that I am logged onto has admin privileges and the user name is
Jim. When I try to access a particular file using explorer, notepad, and
wordpad the SID is always all zeros.
What does it mean when the SID contains all zeros. Does anyone have any idea
why the function is behaving this way? By the way the files are being
accessed locally.
TIA,
Jim
Code sample:
BOOLEAN
PSGetUserName (
__in PFLT_CALLBACK_DATA pCallbackData,
__in PFLT_FILTER pFilter,
OUT PUNICODE_STRING pUniUserName)
{
BOOLEAN success;
NTSTATUS status;
PTOKEN_USER pTokenUser;
SID sid;
ULONG retLength;
// First, try to open the security token of the thread
HANDLE hToken;
status = ZwOpenThreadTokenEx(NtCurrentThread(),
TOKEN_READ,
TRUE,
OBJ_KERNEL_HANDLE,
&hToken);
if (!NT_SUCCESS(status))
{
// The thread may not have a token – try to get the security token
// for the process
status = ZwOpenProcessTokenEx(NtCurrentProcess(),
TOKEN_READ,
OBJ_KERNEL_HANDLE,
&hToken);
if (!NT_SUCCESS(status))
{
DBGPRINT(5, (“PSGetUserName: Failed to open the process token. Status:
%x\n”,
status));
return FALSE;
}
}
// We have the token – now try to get the SID
//
// First, make the query to get the required length of the buffer
status = ZwQueryInformationToken(hToken,
TokenUser,
NULL,
0,
&retLength);
if (status != STATUS_BUFFER_TOO_SMALL)
{
DBGPRINT(5, (“PSGetUserName: Failed to get the length of the token
information. Status: %x\n”,
status));
ZwClose(hToken);
return FALSE;
}
// Allocate the appropriate buffer
pTokenUser = (PTOKEN_USER)ExAllocatePoolWithTag(NonPagedPool,
retLength,
UTIL_TAG);
if (pTokenUser == NULL)
{
DBGPRINT(5, (“PSGetUserName: Failed to allocate memory for the token
information.\n”));
ZwClose(hToken);
return FALSE;
}
// Now make the query with the appropriate length
status = ZwQueryInformationToken(hToken,
TokenUser,
pTokenUser,
retLength,
&retLength);
// Close the handle to the token – we don’t need it any longer
ZwClose(hToken);
// Copy the SID
RtlCopyMemory(&sid, pTokenUser->User.Sid, sizeof(SID));
// Free the buffer
ExFreePoolWithTag(pTokenUser, UTIL_TAG);
if (!NT_SUCCESS(status))
{
DBGPRINT(5, (“PSGetUserName: Failed to query token information. Status:
%x\n”,
status));
return FALSE;
}
// sEND MESSAGE TO USER SPACE
return TRUE;
}