in PPLGuard/utils.cpp [414:456]
BOOL TokenGetSid(HANDLE hToken, PSID* ppSid)
{
BOOL bReturnValue = TRUE;
DWORD dwSize = 0;
PTOKEN_USER pTokenUser = NULL;
if (!GetTokenInformation(hToken, TokenUser, NULL, 0, &dwSize))
{
if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
PrintLastError(L"GetTokenInformation");
goto end;
}
}
pTokenUser = (PTOKEN_USER)LocalAlloc(LPTR, dwSize);
if (!pTokenUser)
goto end;
if (!GetTokenInformation(hToken, TokenUser, pTokenUser, dwSize, &dwSize))
{
PrintLastError(L"GetTokenInformation");
goto end;
}
*ppSid = (PSID)LocalAlloc(LPTR, SECURITY_MAX_SID_SIZE);
if (!*ppSid)
goto end;
if (!CopySid(SECURITY_MAX_SID_SIZE, *ppSid, pTokenUser->User.Sid))
{
PrintLastError(L"CopySid");
LocalFree(*ppSid);
goto end;
}
bReturnValue = TRUE;
end:
if (pTokenUser)
LocalFree(pTokenUser);
return bReturnValue;
}