Nikolay Sivov (@nsivov) commented about dlls/ntdll/sec.c:
- {
return STATUS_INVALID_PARAMETER;
- }
- service_sid_length = RtlLengthRequiredSid( 1 + ARRAY_SIZE(hash) );
- too_small = *pServiceSidLength < service_sid_length;
- *pServiceSidLength = service_sid_length;
- if (too_small)
- {
return STATUS_BUFFER_TOO_SMALL;
- }
- ((SID*)pServiceSid)->Revision = SID_REVISION;
- ((SID*)pServiceSid)->IdentifierAuthority = nt_authority;
- ((SID*)pServiceSid)->SubAuthorityCount = 1 + ARRAY_SIZE(hash);
- ((SID*)pServiceSid)->SubAuthority[0] = SECURITY_SERVICE_ID_BASE_RID;
It's not very important but this part could be using RtlInitializeSid() or RtlInitializeSidEx() to set all the fields, but we don't have that one yet.