Hi
I’m developing a file system filter driver and I need to know on behalf of
which user is the call is done. Everything works fine, except that I can’t get
the impersonating user of a kernel thread in the system process.
In the following windbg output I did a !token to get the active thread token.
We can see : “Thread is not impersonating”. But if I look by myself in the
_ETHREAD structure, I can see that ImpersonationLevel is set to 2, so there is
an impersonation. (And the token referred in the ImpersonationInfo is really
the token of the user that the thread is supposed to impersonate)
It is a bug or I miss something?
Let me know I you want the complete output of windbg.
Thank you
Nicolas Sylvain
kd> !thread
THREAD ffb7b020 Cid 0004.0688 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0
IRP List:
f5b6ee70: (0006,0190) Flags: 40000884 Mdl: 00000000
Not impersonating
DeviceMap e1004940
Owning Process 8125eda0
Wait Start TickCount 199218 Elapsed Ticks: 0
Context Switch Count 300
UserTime 00:00:00.0000
KernelTime 00:00:05.0515
Start Address srv!WorkerThread (0xfb2d3b32)
Stack Init fb1d6000 Current fb1d57c4 Base fb1d6000 Limit fb1d3000 Call 0
Priority 9 BasePriority 9 PriorityDecrement 0 DecrementCount 0
ChildEBP RetAddr Args to Child
fb1d5884 faee2eca fb1d589c e10001f8 e10001f8 mydrv!GetCurrentSid+0x34 (FPO: [Non-Fpo]) (CONV: stdcall) [c:\work\mydrv\mydrv\systools.cpp @ 168]
fb1d58ac faee2eca fb1d58c8 f5b6ee70 ff5fe7e0 mydrv!JMan::GetCurrentProc+0x5a (FPO: [Non-Fpo]) (CONV: stdcall) [c:\work\mydrv\mydrv\drvproc.h @ 344]
fb1d58d8 faee2a5a 810f6698 ffb1a4b0 ff5e4d00 mydrv!Jman::GetCurrentProc+0x5a (FPO: [Non-Fpo]) (CONV: stdcall) [c:\work\mydrv\mydrv\drvproc.h @ 344]
fb1d5960 804e3d77 810f6698 f5b6ee70 806ee2e8 mydrv!Create+0x4a (FPO: [Non-Fpo]) (CONV: stdcall) [c:\work\mydrv\mydrv\filter.cpp @ 98]
fb1d5970 8066a2c5 f5b6ee80 f5b6ee70 ff5e4df8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
fb1d5994 80570f9c 81218c18 81186aa4 fb1d5b3c nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
fb1d5a74 8056386c 81218c30 00000000 81186a00 nt!IopParseDevice+0xa58 (FPO: [Non-Fpo])
fb1d5afc 80567c63 00000000 fb1d5b3c 00000040 nt!ObpLookupObjectName+0x56a (FPO: [Non-Fpo])
fb1d5b50 80571477 00000000 00000000 00000000 nt!ObOpenObjectByName+0xeb (FPO: [Non-Fpo])
fb1d5bcc 80571546 fb1d5cc4 00000020 fb1d5c94 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
fb1d5c28 8057160e fb1d5cc4 00000020 fb1d5c94 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
fb1d5c68 fb2f2e81 fb1d5cc4 00000020 fb1d5c94 nt!NtOpenFile+0x27 (FPO: [Non-Fpo])
fb1d5cb8 fb2e1852 e1262850 fb1d5cdc ffb6b2c0 srv!SrvRefreshShareRootHandle+0x57 (FPO: [Non-Fpo])
fb1d5d14 fb2d530c e1262850 fb2cff34 ffb6d0f8 srv!SrvReferenceShareForTreeConnect+0x5c (FPO: [Non-Fpo])
fb1d5d7c fb2c2ef6 ffb6d100 ffb736a0 fb2d3be8 srv!SrvSmbTreeConnectAndX+0x3ee (FPO: [Non-Fpo])
fb1d5d88 fb2d3be8 00000000 ffb7b020 00000000 srv!SrvProcessSmb+0xb7 (FPO: [0,0,0])
fb1d5dac 8057dfed ffb6d0f8 00000000 00000000 srv!WorkerThread+0x11e (FPO: [Non-Fpo])
fb1d5ddc 804fa477 fb2d3b32 ffb736a0 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
kd> !token -n
Thread is not impersonating. Using process token…
_EPROCESS 8125eda0, _ETHREAD ffb7b020, _TOKEN e10001f8
TS Session ID: 0
User: S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
Groups:
00 S-1-5-32-544 (Alias: BUILTIN\Administrators)
Attributes - Default Enabled Owner
01 S-1-1-0 (Well Known Group: localhost\Everyone)
Attributes - Mandatory Default Enabled
02 S-1-5-11 (Well Known Group: NT AUTHORITY\Authenticated Users)
Attributes - Mandatory Default Enabled
Primary Group: S-1-5-18 (Well Known Group: NT AUTHORITY\SYSTEM)
Privs:
[…]
Authentication ID: (0,3e7)
Impersonation Level: Anonymous
TokenType: Primary
Source: *SYSTEM* TokenFlags: 0x89 ( Token in use )
Token ID: 3ea ParentToken ID: 0
Modified ID: (0, 3eb)
RestrictedSidCount: 0 RestrictedSids: 00000000
kd> !process 8125eda0
PROCESS 8125eda0 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00039000 ObjectTable: e1000af8 HandleCount: 304.
Image: System
[…]
kd> dt -r ffb7b020 _ETHREAD
+0x000 Tcb :
+0x000 Header :
+0x000 Type : 0x6 ‘’
+0x001 Absolute : 0 ‘’
+0x002 Size : 0x70 ‘p’
+0x003 Inserted : 0 ‘’
+0x004 SignalState : 0
+0x008 WaitListHead : _LIST_ENTRY [0xffb7b028 - 0xffb7b028]
+0x010 MutantListHead : [0xffb7b030 - 0xffb7b030]
+0x000 Flink : 0xffb7b030 [0xffb7b030 - 0xffb7b030]
+0x004 Blink : 0xffb7b030 [0xffb7b030 - 0xffb7b030]
+0x018 InitialStack : 0xfb1d6000
+0x01c StackLimit : 0xfb1d3000
[…]
+0x20c ImpersonationInfo : 0xe19aa3e8
+0x000 Token : 0xe1279190
+0x004 CopyOnOpen : 0 ‘’
+0x005 EffectiveOnly : 0 ‘’
+0x008 ImpersonationLevel : 2 ( SecurityImpersonation )
[…]
+0x0c8 Token :
+0x000 Object : 0xe10001fb
+0x000 RefCnt : 0y011
+0x000 Value : 0xe10001fb
[…]
kd> !token -n 0xe1279190
_TOKEN e1279190
TS Session ID: 0
User: S-1-5-21-602162358-2077806209-839522115-1005 (no name mapped)
Groups:
00 S-1-5-21-602162358-2077806209-839522115-513 (no name mapped)
Attributes - Mandatory Default Enabled
01 S-1-1-0 (Well Known Group: localhost\Everyone)
Attributes - Mandatory Default Enabled
02 S-1-5-32-545 (Alias: BUILTIN\Users)
Attributes - Mandatory Default Enabled
03 S-1-5-2 (Well Known Group: NT AUTHORITY\NETWORK)
Attributes - Mandatory Default Enabled
04 S-1-5-11 (Well Known Group: NT AUTHORITY\Authenticated Users)
Attributes - Mandatory Default Enabled
Primary Group: S-1-5-21-602162358-2077806209-839522115-513 (no name mapped)
Privs:
00 0x000000017 SeChangeNotifyPrivilege Attributes - Enabled Default
01 0x000000013 SeShutdownPrivilege Attributes - Enabled Default
02 0x000000019 SeUndockPrivilege Attributes - Enabled Default
Authentication ID: (0,9f5e2)
Impersonation Level: Impersonation
TokenType: Impersonation
Source: NtLmSsp TokenFlags: 0x1
Token ID: 9f5e9 ParentToken ID: 0
Modified ID: (0, 9f5eb)
RestrictedSidCount: 0 RestrictedSids: 00000000