Add stubs for handle duplication auditing and token-based audit checks

2026-08-18 10:22:47 +02:00
parent ea967b8084
commit b6ab1b959b
2 changed files with 54 additions and 0 deletions
--- a/xtoskrnl/includes/se/audit.hh
+++ b/xtoskrnl/includes/se/audit.hh
@@ -18,6 +18,11 @@ namespace SE
    class Audit
    {
        public:
+            STATIC XTAPI VOID AuditHandleDuplication(PVOID SourceHandle,
+                                                     PVOID TargetHandle,
+                                                     PEPROCESS SourceProcess,
+                                                     PEPROCESS TargetProcess);
+            STATIC XTFASTCALL BOOLEAN AuditWithToken(IN PACCESS_TOKEN AccessToken);
            STATIC XTAPI VOID OperationAuditAlarm(IN PUNICODE_STRING SubsystemName,
                                                  IN PVOID HandleId,
                                                  IN PUNICODE_STRING ObjectTypeName,