Add function to consume audit masks

2026-07-14 23:22:30 +02:00
parent f99e919cb7
commit 5349bd115e
2 changed files with 73 additions and 0 deletions
--- a/xtoskrnl/includes/ob/security.hh
+++ b/xtoskrnl/includes/ob/security.hh
@@ -18,6 +18,10 @@ namespace OB
    class Security
    {
        public:
+            STATIC XTAPI VOID AuditObjectAccess(IN HANDLE Handle,
+                                                IN PHANDLE_TABLE_ENTRY_INFO ObjectTableEntryInfo,
+                                                IN PUNICODE_STRING ObjectTypeName,
+                                                IN ACCESS_MASK DesiredAccess);
            STATIC XTAPI XTSTATUS ProcessObjectSecurityDescriptor(IN PVOID Object,
                                                                  IN SECURITY_OPERATION_CODE OperationCode,
                                                                  IN PSECURITY_INFORMATION SecurityInformation,