Privilege view

Author: torusrxxx

src/dbg/instruction.cpp

@@ -2383,4 +2383,85 @@ CMDRESULT cbInstrMnemonicbrief(int argc, char* argv[])
         return STATUS_ERROR;
     dputs(MnemonicHelp::getBriefDescription(argv[1]).c_str());
     return STATUS_CONTINUE;
-}
+}
+
+
+CMDRESULT cbGetPrivilegeState(int argc, char* argv[])
+{
+    TOKEN_PRIVILEGES* Privileges;
+    DWORD returnLength;
+    LUID luid;
+    if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
+    {
+        varset("$result", (duint)0, false);
+        return CMDRESULT::STATUS_CONTINUE;
+    }
+    Privileges = (TOKEN_PRIVILEGES*)emalloc(64 * 16 + 8, "_dbg_getprivilegestate");
+    if (GetTokenInformation(hProcessToken, TokenPrivileges, Privileges, 64 * 16 + 8, &returnLength) == 0)
+    {
+        if (returnLength > 4 * 1024 * 1024)
+        {
+            varset("$result", (duint)0, false);
+            return CMDRESULT::STATUS_CONTINUE;
+        }
+        Privileges = (TOKEN_PRIVILEGES*)erealloc(Privileges, returnLength, "_dbg_getprivilegestate");
+        if (GetTokenInformation(hProcessToken, TokenPrivileges, Privileges, returnLength, &returnLength) == 0)
+        {
+            efree(Privileges, "_dbg_getprivilegestate");
+            return STATUS_ERROR;
+        }
+    }
+    for (unsigned int i = 0; i < Privileges->PrivilegeCount; i++)
+    {
+        if (4 + sizeof(LUID_AND_ATTRIBUTES) * i > returnLength)
+        {
+            efree(Privileges, "_dbg_getprivilegestate");
+            return STATUS_ERROR;
+        }
+        if (memcmp(&Privileges->Privileges[i].Luid, &luid, sizeof(LUID)) == 0)
+        {
+            efree(Privileges, "_dbg_getprivilegestate");
+            varset("$result", (duint)(Privileges->Privileges[i].Attributes + 1), false); // 2=enabled, 3=default, 1=disabled
+            return STATUS_CONTINUE;
+        }
+    }
+    efree(Privileges, "_dbg_getprivilegestate");
+    varset("$result", (duint)0, false);
+    return STATUS_CONTINUE;
+}
+
+CMDRESULT cbEnablePrivilege(int argc, char* argv[])
+{
+    LUID luid;
+    if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
+    {
+        dprintf("Could not find the specified privilege: %s\n", argv[1]);
+        return CMDRESULT::STATUS_ERROR;
+    }
+    TOKEN_PRIVILEGES* Privilege;
+    Privilege = (TOKEN_PRIVILEGES*)emalloc(sizeof(LUID_AND_ATTRIBUTES) + 4, "_dbg_enableprivilege");
+    Privilege->PrivilegeCount = 1;
+    Privilege->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
+    Privilege->Privileges[0].Luid = luid;
+    bool ret = AdjustTokenPrivileges(hProcessToken, FALSE, Privilege, sizeof(LUID_AND_ATTRIBUTES) + 4, nullptr, nullptr) != NO_ERROR;
+    efree(Privilege, "_dbg_enableprivilege");
+    return ret ? CMDRESULT::STATUS_CONTINUE : CMDRESULT::STATUS_CONTINUE;
+}
+
+CMDRESULT cbDisablePrivilege(int argc, char* argv[])
+{
+    LUID luid;
+    if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
+    {
+        dprintf("Could not find the specified privilege: %s\n", argv[1]);
+        return CMDRESULT::STATUS_ERROR;
+    }
+    TOKEN_PRIVILEGES* Privilege;
+    Privilege = (TOKEN_PRIVILEGES*)emalloc(sizeof(LUID_AND_ATTRIBUTES) + 4, "_dbg_disableprivilege");
+    Privilege->PrivilegeCount = 1;
+    Privilege->Privileges[0].Attributes = 0;
+    Privilege->Privileges[0].Luid = luid;
+    bool ret = AdjustTokenPrivileges(hProcessToken, FALSE, Privilege, sizeof(LUID_AND_ATTRIBUTES) + 4, nullptr, nullptr) != NO_ERROR;
+    efree(Privilege, "_dbg_disableprivilege");
+    return ret ? CMDRESULT::STATUS_CONTINUE : CMDRESULT::STATUS_CONTINUE;
+}