Skip to content

Commit 400085e

Browse files
tyranidtyranid
committed
Additional functions.
1 parent 2b8fa63 commit 400085e

2 files changed

Lines changed: 144 additions & 0 deletions

File tree

‎NtApiDotNet/Win32/EventTracing.cs‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,16 @@ public static NtResult<SecurityDescriptor> QueryTraceSecurity(Guid guid, bool th
5353
}
5454
}
5555

56+
/// <summary>
57+
/// Query security of an event.
58+
/// </summary>
59+
/// <param name="guid">The event GUID to query.</param>
60+
/// <returns>The event security descriptor.</returns>
61+
public static SecurityDescriptor QueryTraceSecurity(Guid guid)
62+
{
63+
return QueryTraceSecurity(guid, true).Result;
64+
}
65+
5666
/// <summary>
5767
/// Query the default security for events.
5868
/// </summary>
@@ -63,6 +73,118 @@ public static NtResult<SecurityDescriptor> QueryDefaultSecurity(bool throw_on_er
6373
return QueryTraceSecurity(TraceKnownGuids.DefaultTraceSecurity, throw_on_error);
6474
}
6575

76+
/// <summary>
77+
/// Query the default security for events.
78+
/// </summary>
79+
/// <returns>The default security descriptor.</returns>
80+
public static SecurityDescriptor QueryDefaultSecurity()
81+
{
82+
return QueryDefaultSecurity(true).Result;
83+
}
84+
85+
/// <summary>
86+
/// Modify trace security.
87+
/// </summary>
88+
/// <param name="guid">The event trace GUID.</param>
89+
/// <param name="operation">The operation to perform.</param>
90+
/// <param name="sid">The SID to set.</param>
91+
/// <param name="access_mask">The access mask to set.</param>
92+
/// <param name="allow">True to allow, false to deny.</param>
93+
/// <param name="throw_on_error">True to throw on error.</param>
94+
/// <returns>The NT status code.</returns>
95+
public static NtStatus ControlTraceSecurity(Guid guid, EventSecurityOperation operation, Sid sid, TraceAccessRights access_mask, bool allow, bool throw_on_error)
96+
{
97+
using (var buffer = sid.ToSafeBuffer())
98+
{
99+
return Win32NativeMethods.EventAccessControl(ref guid, operation, buffer, access_mask, allow).ToNtException(throw_on_error);
100+
}
101+
}
102+
103+
/// <summary>
104+
/// Modify trace security.
105+
/// </summary>
106+
/// <param name="guid">The event trace GUID.</param>
107+
/// <param name="operation">The operation to perform.</param>
108+
/// <param name="sid">The SID to set.</param>
109+
/// <param name="access_mask">The access mask to set.</param>
110+
/// <param name="allow">True to allow, false to deny.</param>
111+
public static void ControlTraceSecurity(Guid guid, EventSecurityOperation operation, Sid sid, TraceAccessRights access_mask, bool allow)
112+
{
113+
ControlTraceSecurity(guid, operation, sid, access_mask, allow, true);
114+
}
115+
116+
/// <summary>
117+
/// Adds DACL ACE for an event trace.
118+
/// </summary>
119+
/// <param name="guid">The event trace GUID.</param>
120+
/// <param name="sid">The SID to set.</param>
121+
/// <param name="access_mask">The access mask to set.</param>
122+
/// <param name="allow">True to allow, false to deny.</param>
123+
/// <param name="throw_on_error">True to throw on error.</param>
124+
/// <returns>The NT status code.</returns>
125+
public static NtStatus AddTraceSecurityDacl(Guid guid, Sid sid, TraceAccessRights access_mask, bool allow, bool throw_on_error)
126+
{
127+
return ControlTraceSecurity(guid, EventSecurityOperation.AddDacl, sid, access_mask, allow, throw_on_error);
128+
}
129+
130+
/// <summary>
131+
/// Adds DACL ACE for an event trace.
132+
/// </summary>
133+
/// <param name="guid">The event trace GUID.</param>
134+
/// <param name="sid">The SID to set.</param>
135+
/// <param name="access_mask">The access mask to set.</param>
136+
/// <param name="allow">True to allow, false to deny.</param>
137+
public static void AddTraceSecurityDacl(Guid guid, Sid sid, TraceAccessRights access_mask, bool allow)
138+
{
139+
AddTraceSecurityDacl(guid, sid, access_mask, allow, true);
140+
}
141+
142+
/// <summary>
143+
/// Clears DACL and adds ACE for an event trace.
144+
/// </summary>
145+
/// <param name="guid">The event trace GUID.</param>
146+
/// <param name="sid">The SID to set.</param>
147+
/// <param name="access_mask">The access mask to set.</param>
148+
/// <param name="allow">True to allow, false to deny.</param>
149+
/// <param name="throw_on_error">True to throw on error.</param>
150+
/// <returns>The NT status code.</returns>
151+
public static NtStatus SetTraceSecurityDacl(Guid guid, Sid sid, TraceAccessRights access_mask, bool allow, bool throw_on_error)
152+
{
153+
return ControlTraceSecurity(guid, EventSecurityOperation.SetDacl, sid, access_mask, allow, throw_on_error);
154+
}
155+
156+
/// <summary>
157+
/// lears DACL and adds ACE for an event trace.
158+
/// </summary>
159+
/// <param name="guid">The event trace GUID.</param>
160+
/// <param name="sid">The SID to set.</param>
161+
/// <param name="access_mask">The access mask to set.</param>
162+
/// <param name="allow">True to allow, false to deny.</param>
163+
public static void SetTraceSecurityDacl(Guid guid, Sid sid, TraceAccessRights access_mask, bool allow)
164+
{
165+
SetTraceSecurityDacl(guid, sid, access_mask, allow, true);
166+
}
167+
168+
/// <summary>
169+
/// Remove security for an event trace.
170+
/// </summary>
171+
/// <param name="guid">The event trace GUID.</param>
172+
/// <param name="throw_on_error">True to throw on error.</param>
173+
/// <returns>The NT status code.</returns>
174+
public static NtStatus RemoveTraceSecurity(Guid guid, bool throw_on_error)
175+
{
176+
return Win32NativeMethods.EventAccessRemove(ref guid).ToNtException(throw_on_error);
177+
}
178+
179+
/// <summary>
180+
/// Remove security for an event trace.
181+
/// </summary>
182+
/// <param name="guid">The event trace GUID.</param>
183+
public static void RemoveTraceSecurity(Guid guid)
184+
{
185+
RemoveTraceSecurity(guid, true);
186+
}
187+
66188
/// <summary>
67189
/// Register an event trace with a specific GUID.
68190
/// </summary>

‎NtApiDotNet/Win32/Win32NativeMethods.cs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,14 @@ internal enum EventControlCode
269269
CaptureState = 2,
270270
}
271271

272+
public enum EventSecurityOperation
273+
{
274+
SetDacl,
275+
SetSacl,
276+
AddDacl,
277+
AddSacl
278+
}
279+
272280
[StructLayout(LayoutKind.Sequential)]
273281
internal struct PROCESS_INFORMATION
274282
{
@@ -1041,6 +1049,20 @@ internal static extern Win32Error EventAccessQuery(
10411049
ref int BufferSize
10421050
);
10431051

1052+
[DllImport("advapi32.dll", CharSet = CharSet.Unicode)]
1053+
internal static extern Win32Error EventAccessControl(
1054+
ref Guid Guid,
1055+
EventSecurityOperation Operation,
1056+
SafeSidBufferHandle Sid,
1057+
AccessMask Rights,
1058+
[MarshalAs(UnmanagedType.U1)] bool AllowOrDeny
1059+
);
1060+
1061+
[DllImport("advapi32.dll", CharSet = CharSet.Unicode)]
1062+
internal static extern Win32Error EventAccessRemove(
1063+
ref Guid Guid
1064+
);
1065+
10441066
[DllImport("advapi32.dll", CharSet = CharSet.Unicode)]
10451067
internal static extern Win32Error EventRegister(
10461068
ref Guid ProviderId,

0 commit comments

Comments
 (0)