windows-server-2003/windows/appcompat/shims/verifier/securitychecks.cpp

/*++

 Copyright (c) 2001 Microsoft Corporation

 Module Name:

   SecurityChecks.cpp

 Abstract:

   This AppVerifier shim hooks CreateProcess, CreateProcessAsUser,
   and WinExec and checks to see if some conditions exist that
   might allow trojan horse behavior to occur.
   
 Notes:

   This is a general purpose shim.

 History:

   12/13/2001   rparsons    Created

--*/

#include "precomp.h"

IMPLEMENT_SHIM_BEGIN(SecurityChecks)
#include "ShimHookMacro.h"

//
// verifier log entries
//
BEGIN_DEFINE_VERIFIER_LOG(SecurityChecks)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_BADARGUMENTS)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WINEXEC)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_NULL_DACL)
    VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WORLDWRITE_DACL)
END_DEFINE_VERIFIER_LOG(SecurityChecks)

INIT_VERIFIER_LOG(SecurityChecks);

APIHOOK_ENUM_BEGIN
    APIHOOK_ENUM_ENTRY(CreateProcessA)
    APIHOOK_ENUM_ENTRY(CreateProcessW)
    APIHOOK_ENUM_ENTRY(CreateProcessAsUserA)
    APIHOOK_ENUM_ENTRY(CreateProcessAsUserW)
    APIHOOK_ENUM_ENTRY(WinExec)

	APIHOOK_ENUM_ENTRY(CreateFileA)	
	APIHOOK_ENUM_ENTRY(CreateFileW)
	APIHOOK_ENUM_ENTRY(CreateDesktopA)	
	APIHOOK_ENUM_ENTRY(CreateDesktopW)	
	APIHOOK_ENUM_ENTRY(CreateWindowStationA)
	APIHOOK_ENUM_ENTRY(CreateWindowStationW)
    
    APIHOOK_ENUM_ENTRY(RegCreateKeyExA)
    APIHOOK_ENUM_ENTRY(RegCreateKeyExW)
    APIHOOK_ENUM_ENTRY(RegSaveKeyA)
    APIHOOK_ENUM_ENTRY(RegSaveKeyW)
    APIHOOK_ENUM_ENTRY(RegSaveKeyExA)
    APIHOOK_ENUM_ENTRY(RegSaveKeyExW)

    APIHOOK_ENUM_ENTRY(CreateFileMappingA)
    APIHOOK_ENUM_ENTRY(CreateFileMappingW)
    APIHOOK_ENUM_ENTRY(CreateJobObjectA)
    APIHOOK_ENUM_ENTRY(CreateJobObjectW)
    APIHOOK_ENUM_ENTRY(CreateThread)
    APIHOOK_ENUM_ENTRY(CreateRemoteThread)

    APIHOOK_ENUM_ENTRY(CreateDirectoryA)
    APIHOOK_ENUM_ENTRY(CreateDirectoryW)
    APIHOOK_ENUM_ENTRY(CreateDirectoryExA)
    APIHOOK_ENUM_ENTRY(CreateDirectoryExW)
    APIHOOK_ENUM_ENTRY(CreateHardLinkA)
    APIHOOK_ENUM_ENTRY(CreateHardLinkW)
    APIHOOK_ENUM_ENTRY(CreateMailslotA)
    APIHOOK_ENUM_ENTRY(CreateMailslotW)
    APIHOOK_ENUM_ENTRY(CreateNamedPipeA)
    APIHOOK_ENUM_ENTRY(CreateNamedPipeW)
    APIHOOK_ENUM_ENTRY(CreatePipe)
    APIHOOK_ENUM_ENTRY(CreateMutexA)
    APIHOOK_ENUM_ENTRY(CreateMutexW)
    APIHOOK_ENUM_ENTRY(CreateSemaphoreA)
    APIHOOK_ENUM_ENTRY(CreateSemaphoreW)
    APIHOOK_ENUM_ENTRY(CreateWaitableTimerA)
    APIHOOK_ENUM_ENTRY(CreateWaitableTimerW)
    APIHOOK_ENUM_ENTRY(CreateEventA)
    APIHOOK_ENUM_ENTRY(CreateEventW)

    APIHOOK_ENUM_ENTRY(SetFileSecurityA)
    APIHOOK_ENUM_ENTRY(SetFileSecurityW)
    APIHOOK_ENUM_ENTRY(SetKernelObjectSecurity)
    APIHOOK_ENUM_ENTRY(SetNamedSecurityInfoA)
    APIHOOK_ENUM_ENTRY(SetNamedSecurityInfoW)
    APIHOOK_ENUM_ENTRY(SetSecurityInfo)
    APIHOOK_ENUM_ENTRY(RegSetKeySecurity)
    APIHOOK_ENUM_ENTRY(SetUserObjectSecurity)
    APIHOOK_ENUM_ENTRY(SetServiceObjectSecurity)

    APIHOOK_ENUM_ENTRY(SetNtmsObjectSecurity)
    APIHOOK_ENUM_ENTRY(ClusterRegCreateKey)
    APIHOOK_ENUM_ENTRY(ClusterRegSetKeySecurity)
    APIHOOK_ENUM_ENTRY(CreateNtmsMediaPoolA)
    APIHOOK_ENUM_ENTRY(CreateNtmsMediaPoolW)

APIHOOK_ENUM_END

BYTE g_ajSidBuffer[SECURITY_MAX_SID_SIZE];
PSID g_pWorldSid = NULL;

WCHAR g_wszWinDir[MAX_PATH];
DWORD g_dwWinDirLen = 0;

void
InitWorldSid(
    void
    )
{
    DWORD dwSidSize = sizeof(g_ajSidBuffer);

    if (CreateWellKnownSid(WinWorldSid, NULL, g_ajSidBuffer, &dwSidSize)) {
        g_pWorldSid = g_ajSidBuffer;
    } else {
        g_pWorldSid = NULL;
    }
}

void
CheckDacl(
    PACL        pDacl,
    LPCWSTR     szCaller,
    LPCWSTR     szParam,
    LPCWSTR     szName
    )
{
    if (!pDacl) {
        //
        // we have a NULL dacl -- log a problem
        //
        VLOG(VLOG_LEVEL_ERROR,
             VLOG_SECURITYCHECKS_NULL_DACL,
             "Called %ls, and specified a NULL DACL in %ls for object '%ls.'",
             szCaller,
             szParam,
             szName);
        return;
    }

    if (!g_pWorldSid) {
        //
        // we never were able to get the world Sid
        //
        return;
    }

    for (DWORD i = 0; i < pDacl->AceCount; ++i) {
        PACE_HEADER     pAceHeader = NULL;
        PSID            pSID;
        ACCESS_MASK     dwAccessMask;

        if (!GetAce(pDacl, i, (LPVOID*)&pAceHeader)) {
            continue;
        }

        //
        // if it's not some form of ACCESS_ALLOWED ACE, we aren't interested
        //
        if (pAceHeader->AceType == ACCESS_ALLOWED_ACE_TYPE) {

            pSID = &(((PACCESS_ALLOWED_ACE)pAceHeader)->SidStart);
            dwAccessMask = ((PACCESS_ALLOWED_ACE)pAceHeader)->Mask;

        } else if (pAceHeader->AceType == ACCESS_ALLOWED_OBJECT_ACE_TYPE) {

            PACCESS_ALLOWED_OBJECT_ACE pAAOAce = (PACCESS_ALLOWED_OBJECT_ACE)pAceHeader;

            //
            // who the heck came up with this system? The Sid starts at a different place
            // depending on the flags. Anyone ever heard of multiple structs? Sigh.
            //
            if ((pAAOAce->Flags & ACE_OBJECT_TYPE_PRESENT) && (pAAOAce->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)) {

                pSID = &(pAAOAce->SidStart);

            } else if ((pAAOAce->Flags & ACE_OBJECT_TYPE_PRESENT) || (pAAOAce->Flags & ACE_INHERITED_OBJECT_TYPE_PRESENT)){

                pSID = (PSID)&(pAAOAce->InheritedObjectType);

            } else {

                pSID = (PSID)&(pAAOAce->ObjectType);
            }

            dwAccessMask = ((PACCESS_ALLOWED_OBJECT_ACE)pAceHeader)->Mask;

        } else {
            continue;
        }

        //
        // check the validity of the SID, just to be safe
        //
        if (!IsValidSid(pSID)) {

            continue;
        }


        //
        // if the SID is the world, and the access mask allows WRITE_DAC and WRITE_OWNER, we have a problem
        //
        if ((dwAccessMask & (WRITE_DAC | WRITE_OWNER)) && EqualSid(pSID, g_pWorldSid)) {
            VLOG(VLOG_LEVEL_ERROR,
                 VLOG_SECURITYCHECKS_WORLDWRITE_DACL,
                 "Called %ls, and specified a DACL with WRITE_DAC and/or WRITE_OWNER for WORLD in %ls for object '%ls.'",
                 szCaller,
                 szParam,
                 szName);
            return;
        }

    }
}

void
CheckSecurityDescriptor(
    PSECURITY_DESCRIPTOR    pSecurityDescriptor,
    LPCWSTR                 szCaller,
    LPCWSTR                 szParam,
    LPCWSTR                 szName
    )
{
    BOOL                    bDaclPresent = FALSE;
    BOOL                    bDaclDefaulted = FALSE;
    PACL                    pDacl = NULL;

    if (!pSecurityDescriptor || !szName || !szName[0]) {
        //
        // there are no attributes, so they get the default, which is fine,
        // or the object doesn't have a name, so it can't be highjacked
        //
        return;
    }

    if (GetSecurityDescriptorDacl(pSecurityDescriptor, &bDaclPresent, &pDacl, &bDaclDefaulted)) {
        if (bDaclPresent) {
            CheckDacl(pDacl, szCaller, szParam, szName);
        }
    }
}

void
CheckSecurityAttributes(
    LPSECURITY_ATTRIBUTES   pSecurityAttrib,
    LPCWSTR                 szCaller,
    LPCWSTR                 szParam,
    LPCWSTR                 szName
    )
{
    PSECURITY_DESCRIPTOR    pSecurityDescriptor = NULL;

    if (!pSecurityAttrib) {
        //
        // there's no attributes, so they get the default, which is fine
        //
        return;
    }

    pSecurityDescriptor = (PSECURITY_DESCRIPTOR)pSecurityAttrib->lpSecurityDescriptor;

    CheckSecurityDescriptor(pSecurityDescriptor, szCaller, szParam, szName);
}

void
CheckCreateProcess(
    LPCWSTR		pwszApplicationName,
    LPCWSTR		pwszCommandLine,
    LPCWSTR		pwszCaller
    )
{
    //
    // if applicationname is non-null, there's no problem
    //
    if (pwszApplicationName) {
        return;
    }

    //
    // if there's no command line, there's a problem, but not one we want to solve
    //
    if (!pwszCommandLine) {
        return;
    }

    //
    // if there are no spaces, no problem
    //
    LPWSTR pSpaceLoc = wcschr(pwszCommandLine, L' ');
    if (!pSpaceLoc) {
        return;
    }

    //
    // if the beginning of the command line is quoted, no problem
    //
    if (pwszCommandLine[0] == L'\"') {
        return;
    }

    //
    // if the phrase '.exe ' appears before the first space, we'll call that good
    //
    LPWSTR pExeLoc = wcsistr(pwszCommandLine, L".exe ");
    if (pExeLoc && pExeLoc < pSpaceLoc) {
        return;
    }

    //
    // if the first part of the command line is windir, we'll call that good
    //
    if (g_dwWinDirLen && _wcsnicmp(pwszCommandLine, g_wszWinDir, g_dwWinDirLen) == 0) {
        return;
    }


	if (_wcsicmp(pwszCaller, L"winexec") == 0) {
		VLOG(VLOG_LEVEL_ERROR,
			 VLOG_SECURITYCHECKS_BADARGUMENTS,
			 "Called %ls with command line '%ls'. The command line has spaces, and the exe name is not in quotes.",
			 pwszCaller,
			 pwszCommandLine);
    } else {
		VLOG(VLOG_LEVEL_ERROR,
			 VLOG_SECURITYCHECKS_BADARGUMENTS,
			 "Called %ls with command line '%ls'. The lpApplicationName argument is NULL, lpCommandLine has spaces, and the exe name is not in quotes.",
			 pwszCaller,
			 pwszCommandLine);
    }
}

void
CheckForNoPathInFileName(
    LPCWSTR  pwszFilePath,
    LPCWSTR  pwszCaller
    )
{
    if (!pwszFilePath || !pwszCaller) {
        return;
    }

    //
    // skip quotes and space if necessary
    //
    DWORD dwBegin = 0;
    while (pwszFilePath[dwBegin] == L'\"' || pwszFilePath[dwBegin] == L' ') {
        dwBegin++;
    }

    //
    // if there's nothing left of the string, get out
    //
    if (!pwszFilePath[dwBegin] || !pwszFilePath[dwBegin + 1]) {
        return;
    }

    //
    // check for DOS (x:...) and UNC (\\...) full paths
    //
    if (pwszFilePath[dwBegin + 1] == L':' || (pwszFilePath[dwBegin] == L'\\' && pwszFilePath[dwBegin + 1] == L'\\')) {
        //
        // full path
        //
        return;
    }

    VLOG(VLOG_LEVEL_ERROR,
         VLOG_SECURITYCHECKS_BADARGUMENTS,
         "Called '%ls' with '%ls' specified. Use a full path to the file to ensure that you get the executable you want, and not a malicious exe with the same name.",
         pwszCaller,
         pwszFilePath);
}

BOOL 
APIHOOK(CreateProcessA)(
    LPCSTR                lpApplicationName,
    LPSTR                 lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes, 
    LPSECURITY_ATTRIBUTES lpThreadAttributes, 
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPCSTR                lpCurrentDirectory,
    LPSTARTUPINFOA        lpStartupInfo, 
    LPPROCESS_INFORMATION lpProcessInformation 
    )
{
    LPWSTR pwszApplicationName = ToUnicode(lpApplicationName);
    LPWSTR pwszCommandLine = ToUnicode(lpCommandLine);

    CheckCreateProcess(pwszApplicationName, pwszCommandLine, L"CreateProcess");

    if (pwszApplicationName) {
        CheckForNoPathInFileName(pwszApplicationName, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", pwszApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", pwszApplicationName);
    } else {
        CheckForNoPathInFileName(pwszCommandLine, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", pwszCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", pwszCommandLine);
    }

    if (pwszApplicationName) {
        free(pwszApplicationName);
        pwszApplicationName = NULL;
    }
    if (pwszCommandLine) {
        free(pwszCommandLine);
        pwszCommandLine = NULL;
    }

    return ORIGINAL_API(CreateProcessA)(lpApplicationName,
                                        lpCommandLine,
                                        lpProcessAttributes,
                                        lpThreadAttributes,
                                        bInheritHandles,
                                        dwCreationFlags,
                                        lpEnvironment,
                                        lpCurrentDirectory,
                                        lpStartupInfo,
                                        lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessW)(
    LPCWSTR               lpApplicationName,
    LPWSTR                lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPWSTR                lpCurrentDirectory,
    LPSTARTUPINFOW        lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    )
{
    CheckCreateProcess(lpApplicationName, lpCommandLine, L"CreateProcess");

    if (lpApplicationName) {
        CheckForNoPathInFileName(lpApplicationName, L"CreateProcess");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", lpApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", lpApplicationName);
    } else {
        CheckForNoPathInFileName(lpCommandLine, L"CreateProcess");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcess", L"lpProcessAttributes", lpCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcess", L"lpThreadAttributes", lpCommandLine);
    }


    return ORIGINAL_API(CreateProcessW)(lpApplicationName,
                                        lpCommandLine,
                                        lpProcessAttributes,
                                        lpThreadAttributes,
                                        bInheritHandles,
                                        dwCreationFlags,
                                        lpEnvironment,
                                        lpCurrentDirectory,
                                        lpStartupInfo,
                                        lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessAsUserA)(
    HANDLE                hToken,
    LPCSTR                lpApplicationName,
    LPSTR                 lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes, 
    LPSECURITY_ATTRIBUTES lpThreadAttributes, 
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPCSTR                lpCurrentDirectory,
    LPSTARTUPINFOA        lpStartupInfo, 
    LPPROCESS_INFORMATION lpProcessInformation 
    )
{
    LPWSTR pwszApplicationName = ToUnicode(lpApplicationName);
    LPWSTR pwszCommandLine = ToUnicode(lpCommandLine);

    CheckCreateProcess(pwszApplicationName, pwszCommandLine, L"CreateProcessAsUser");

    if (pwszApplicationName) {
        CheckForNoPathInFileName(pwszApplicationName, L"CreateProcessAsUser");

        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", pwszApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", pwszApplicationName);
    } else {
        CheckForNoPathInFileName(pwszCommandLine, L"CreateProcessAsUser");
        
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", pwszCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", pwszCommandLine);
    }

    if (pwszApplicationName) {
        free(pwszApplicationName);
        pwszApplicationName = NULL;
    }
    if (pwszCommandLine) {
        free(pwszCommandLine);
        pwszCommandLine = NULL;
    }

    return ORIGINAL_API(CreateProcessAsUserA)(hToken,
                                              lpApplicationName,
                                              lpCommandLine,
                                              lpProcessAttributes,    
                                              lpThreadAttributes,
                                              bInheritHandles,
                                              dwCreationFlags,
                                              lpEnvironment,
                                              lpCurrentDirectory,
                                              lpStartupInfo,
                                              lpProcessInformation);
}

BOOL 
APIHOOK(CreateProcessAsUserW)(
    HANDLE                hToken,
    LPCWSTR               lpApplicationName,
    LPWSTR                lpCommandLine,
    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    BOOL                  bInheritHandles,
    DWORD                 dwCreationFlags,
    LPVOID                lpEnvironment,
    LPWSTR                lpCurrentDirectory,
    LPSTARTUPINFOW        lpStartupInfo,
    LPPROCESS_INFORMATION lpProcessInformation
    )
{
    CheckCreateProcess(lpApplicationName, lpCommandLine, L"CreateProcessAsUser");

    if (lpApplicationName) {
        CheckForNoPathInFileName(lpApplicationName, L"CreateProcessAsUser");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", lpApplicationName);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", lpApplicationName);
    } else {
        CheckForNoPathInFileName(lpCommandLine, L"CreateProcessAsUser");
    
        CheckSecurityAttributes(lpProcessAttributes, L"CreateProcessAsUser", L"lpProcessAttributes", lpCommandLine);
        CheckSecurityAttributes(lpThreadAttributes, L"CreateProcessAsUser", L"lpThreadAttributes", lpCommandLine);
    }

    return ORIGINAL_API(CreateProcessAsUserW)(hToken,
                                              lpApplicationName,
                                              lpCommandLine,
                                              lpProcessAttributes,
                                              lpThreadAttributes,
                                              bInheritHandles,
                                              dwCreationFlags,
                                              lpEnvironment,
                                              lpCurrentDirectory,
                                              lpStartupInfo,
                                              lpProcessInformation);
}

UINT 
APIHOOK(WinExec)(
    LPCSTR lpCmdLine, 
    UINT   uCmdShow 
    )
{
    LPWSTR pwszCmdLine = ToUnicode(lpCmdLine);

    VLOG(VLOG_LEVEL_ERROR, VLOG_SECURITYCHECKS_WINEXEC, "Called WinExec.");

    CheckForNoPathInFileName(pwszCmdLine, L"WinExec");

    CheckCreateProcess(NULL, pwszCmdLine, L"WinExec");

    if (pwszCmdLine) {
        free(pwszCmdLine);
        pwszCmdLine = NULL;
    }

    return ORIGINAL_API(WinExec)(lpCmdLine, uCmdShow);
}


HANDLE
APIHOOK(CreateFileA)(
    LPCSTR                lpFileName,            // file name
    DWORD                 dwDesiredAccess,       // access mode
    DWORD                 dwShareMode,           // share mode
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  // SD
    DWORD                 dwCreationDisposition, // how to create
    DWORD                 dwFlagsAndAttributes,  // file attributes
    HANDLE                hTemplateFile          // handle to template file
    )
{
    LPWSTR pwszName = ToUnicode(lpFileName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateFile", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateFileA)(lpFileName,
                                     dwDesiredAccess,
                                     dwShareMode,
                                     lpSecurityAttributes,
                                     dwCreationDisposition,
                                     dwFlagsAndAttributes,
                                     hTemplateFile);

}


HANDLE
APIHOOK(CreateFileW)(
    LPCWSTR               lpFileName,            // file name
    DWORD                 dwDesiredAccess,       // access mode
    DWORD                 dwShareMode,           // share mode
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  // SD
    DWORD                 dwCreationDisposition, // how to create
    DWORD                 dwFlagsAndAttributes,  // file attributes
    HANDLE                hTemplateFile          // handle to template file
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateFile", L"lpSecurityAttributes", lpFileName);
    
    return ORIGINAL_API(CreateFileW)(lpFileName,
                                     dwDesiredAccess,
                                     dwShareMode,
                                     lpSecurityAttributes,
                                     dwCreationDisposition,
                                     dwFlagsAndAttributes,
                                     hTemplateFile);
}


HDESK 
APIHOOK(CreateDesktopA)(
    LPCSTR lpszDesktop,          // name of new desktop
    LPCSTR lpszDevice,           // reserved; must be NULL
    LPDEVMODEA pDevmode,         // reserved; must be NULL
    DWORD dwFlags,               // desktop interaction
    ACCESS_MASK dwDesiredAccess, // access of returned handle
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    LPWSTR pwszName = ToUnicode(lpszDesktop);

    CheckSecurityAttributes(lpsa, L"CreateDesktop", L"lpsa", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDesktopA)(lpszDesktop,        
                                        lpszDevice,         
                                        pDevmode,         
                                        dwFlags,              
                                        dwDesiredAccess,
                                        lpsa);
}

HDESK 
APIHOOK(CreateDesktopW)(
    LPCWSTR lpszDesktop,         // name of new desktop
    LPCWSTR lpszDevice,          // reserved; must be NULL
    LPDEVMODEW pDevmode,         // reserved; must be NULL
    DWORD dwFlags,               // desktop interaction
    ACCESS_MASK dwDesiredAccess, // access of returned handle
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    CheckSecurityAttributes(lpsa, L"CreateDesktop", L"lpsa", lpszDesktop);

    return ORIGINAL_API(CreateDesktopW)(lpszDesktop,        
                                        lpszDevice,         
                                        pDevmode,         
                                        dwFlags,              
                                        dwDesiredAccess,
                                        lpsa);
}



HWINSTA 
APIHOOK(CreateWindowStationA)(
    LPSTR lpwinsta,              // new window station name
    DWORD dwReserved,            // reserved; must be zero
    ACCESS_MASK dwDesiredAccess, // requested access
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    LPWSTR pwszName = ToUnicode(lpwinsta);

    CheckSecurityAttributes(lpsa, L"CreateWindowStation", L"lpsa", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateWindowStationA)(lpwinsta,        
                                              dwReserved,         
                                              dwDesiredAccess,
                                              lpsa);
}

HWINSTA 
APIHOOK(CreateWindowStationW)(
    LPWSTR lpwinsta,             // new window station name
    DWORD dwReserved,            // reserved; must be zero
    ACCESS_MASK dwDesiredAccess, // requested access
    LPSECURITY_ATTRIBUTES lpsa   // security attributes
    )
{
    CheckSecurityAttributes(lpsa, L"CreateWindowStation", L"lpsa", lpwinsta);

    return ORIGINAL_API(CreateWindowStationW)(lpwinsta,        
                                              dwReserved,         
                                              dwDesiredAccess,
                                              lpsa);
}


LONG 
APIHOOK(RegCreateKeyExA)(
    HKEY                  hKey,                
    LPCSTR                lpSubKey,         
    DWORD                 Reserved,           
    LPSTR                 lpClass,           
    DWORD                 dwOptions,          
    REGSAM                samDesired,        
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    PHKEY                 phkResult,          
    LPDWORD               lpdwDisposition   
    )
{
    LPWSTR pwszName = ToUnicode(lpSubKey);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegCreateKeyEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegCreateKeyExA)(hKey,
                                         lpSubKey,
                                         Reserved,
                                         lpClass,
                                         dwOptions,
                                         samDesired,
                                         lpSecurityAttributes,
                                         phkResult,
                                         lpdwDisposition);
}

LONG 
APIHOOK(RegCreateKeyExW)(
    HKEY                  hKey,                
    LPCWSTR               lpSubKey,         
    DWORD                 Reserved,           
    LPWSTR                lpClass,           
    DWORD                 dwOptions,          
    REGSAM                samDesired,        
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    PHKEY                 phkResult,          
    LPDWORD               lpdwDisposition   
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegCreateKeyEx", L"lpSecurityAttributes", lpSubKey);
    
    return ORIGINAL_API(RegCreateKeyExW)(hKey,
                                         lpSubKey,
                                         Reserved,
                                         lpClass,
                                         dwOptions,
                                         samDesired,
                                         lpSecurityAttributes,
                                         phkResult,
                                         lpdwDisposition);
}

LONG 
APIHOOK(RegSaveKeyA)(
    HKEY                    hKey,                 // handle to key
    LPCSTR                  lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpFile);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKey", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegSaveKeyA)(hKey,
                                     lpFile,
                                     lpSecurityAttributes);
}

LONG 
APIHOOK(RegSaveKeyW)(
    HKEY                    hKey,                 // handle to key
    LPCWSTR                 lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKey", L"lpSecurityAttributes", lpFile);
    
    return ORIGINAL_API(RegSaveKeyW)(hKey,
                                     lpFile,
                                     lpSecurityAttributes);
}

LONG 
APIHOOK(RegSaveKeyExA)(
    HKEY                    hKey,                 // handle to key
    LPCSTR                  lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes, // SD
    DWORD                   Flags
    )
{
    LPWSTR pwszName = ToUnicode(lpFile);

    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKeyEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(RegSaveKeyExA)(hKey,
                                     lpFile,
                                     lpSecurityAttributes,
                                     Flags);
}

LONG 
APIHOOK(RegSaveKeyExW)(
    HKEY                    hKey,                 // handle to key
    LPCWSTR                 lpFile,               // data file
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes, // SD
    DWORD                   Flags
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"RegSaveKeyEx", L"lpSecurityAttributes", lpFile);
    
    return ORIGINAL_API(RegSaveKeyExW)(hKey,
                                       lpFile,
                                       lpSecurityAttributes,
                                       Flags);
}

HANDLE 
APIHOOK(CreateFileMappingA)(
    HANDLE hFile,              
    LPSECURITY_ATTRIBUTES lpAttributes,
    DWORD flProtect,           
    DWORD dwMaximumSizeHigh,   
    DWORD dwMaximumSizeLow,    
    LPCSTR lpName             
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpAttributes, L"CreateFileMapping", L"lpAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateFileMappingA)(hFile, 
                                           lpAttributes, 
                                           flProtect, 
                                           dwMaximumSizeHigh, 
                                           dwMaximumSizeLow, 
                                           lpName);
}

HANDLE 
APIHOOK(CreateFileMappingW)(
    HANDLE hFile,              
    LPSECURITY_ATTRIBUTES lpAttributes,
    DWORD flProtect,           
    DWORD dwMaximumSizeHigh,   
    DWORD dwMaximumSizeLow,    
    LPCWSTR lpName             
    )
{
    CheckSecurityAttributes(lpAttributes, L"CreateFileMapping", L"lpAttributes", lpName);
    
    return ORIGINAL_API(CreateFileMappingW)(hFile, 
                                            lpAttributes, 
                                            flProtect, 
                                            dwMaximumSizeHigh, 
                                            dwMaximumSizeLow, 
                                            lpName);
}

HANDLE 
APIHOOK(CreateJobObjectA)(
    LPSECURITY_ATTRIBUTES   lpJobAttributes,  // SD
    LPCSTR                  lpName            // job name 
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpJobAttributes, L"CreateJobObject", L"lpJobAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateJobObjectA)(lpJobAttributes,
                                          lpName);
}

HANDLE 
APIHOOK(CreateJobObjectW)(
    LPSECURITY_ATTRIBUTES   lpJobAttributes,  // SD
    LPCWSTR                 lpName            // job name 
    )
{
    CheckSecurityAttributes(lpJobAttributes, L"CreateJobObject", L"lpJobAttributes", lpName);
    
    return ORIGINAL_API(CreateJobObjectW)(lpJobAttributes,
                                          lpName);
}


HANDLE
APIHOOK(CreateThread)(
    LPSECURITY_ATTRIBUTES   lpThreadAttributes, // SD
    SIZE_T                  dwStackSize,        // initial stack size
    LPTHREAD_START_ROUTINE  lpStartAddress,     // thread function
    LPVOID                  lpParameter,        // thread argument
    DWORD                   dwCreationFlags,    // creation option
    LPDWORD                 lpThreadId          // thread identifier
    )
{
    CheckSecurityAttributes(lpThreadAttributes, L"CreateThread", L"lpThreadAttributes", L"Unnamed thread");
    
    return ORIGINAL_API(CreateThread)(lpThreadAttributes,
                                      (DWORD)dwStackSize,
                                      lpStartAddress,
                                      lpParameter,    
                                      dwCreationFlags,
                                      lpThreadId);      
}

HANDLE 
APIHOOK(CreateRemoteThread)(
    HANDLE                  hProcess,           // handle to process
    LPSECURITY_ATTRIBUTES   lpThreadAttributes, // SD
    SIZE_T                  dwStackSize,        // initial stack size
    LPTHREAD_START_ROUTINE  lpStartAddress,     // thread function
    LPVOID                  lpParameter,        // thread argument
    DWORD                   dwCreationFlags,    // creation option
    LPDWORD                 lpThreadId          // thread identifier
    )
{
    CheckSecurityAttributes(lpThreadAttributes, L"CreateRemoteThread", L"lpThreadAttributes", L"Unnamed thread");
    
    return ORIGINAL_API(CreateRemoteThread)(hProcess, 
                                            lpThreadAttributes,
                                            dwStackSize,
                                            lpStartAddress,
                                            lpParameter,    
                                            dwCreationFlags,
                                            lpThreadId);      
}




BOOL
APIHOOK(CreateDirectoryA)(
    LPCSTR                lpPathName,           // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpPathName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectory", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDirectoryA)(lpPathName, 
                                          lpSecurityAttributes);
}


BOOL
APIHOOK(CreateDirectoryW)(
    LPCWSTR               lpPathName,           // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectory", L"lpSecurityAttributes", lpPathName);
    
    return ORIGINAL_API(CreateDirectoryW)(lpPathName, 
                                          lpSecurityAttributes);
}


BOOL
APIHOOK(CreateDirectoryExA)(
    LPCSTR                lpTemplateDirectory,   // template directory
    LPCSTR                lpNewDirectory,        // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes   // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpNewDirectory);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectoryEx", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateDirectoryExA)(lpTemplateDirectory,
                                            lpNewDirectory,
                                            lpSecurityAttributes);

}


BOOL
APIHOOK(CreateDirectoryExW)(
    LPCWSTR               lpTemplateDirectory,  // template directory
    LPCWSTR               lpNewDirectory,       // directory name
    LPSECURITY_ATTRIBUTES lpSecurityAttributes  // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateDirectoryEx", L"lpSecurityAttributes", lpNewDirectory);
    
    return ORIGINAL_API(CreateDirectoryExW)(lpTemplateDirectory,
                                            lpNewDirectory,
                                            lpSecurityAttributes);

}

BOOL 
APIHOOK(CreateHardLinkA)(
    LPCSTR                  lpFileName,          // link name name
    LPCSTR                  lpExistingFileName,  // target file name
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  
    )
{
    LPWSTR pwszName = ToUnicode(lpFileName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateHardLink", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateHardLinkA)(lpFileName,
                                         lpExistingFileName,
                                         lpSecurityAttributes);


}

BOOL 
APIHOOK(CreateHardLinkW)(
    LPCWSTR                 lpFileName,          // link name name
    LPCWSTR                 lpExistingFileName,  // target file name
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes  
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateHardLink", L"lpSecurityAttributes", lpFileName);
    
    return ORIGINAL_API(CreateHardLinkW)(lpFileName,
                                         lpExistingFileName,
                                         lpSecurityAttributes);


}


HANDLE 
APIHOOK(CreateMailslotA)(
    LPCSTR                  lpName,              // mailslot name
    DWORD                   nMaxMessageSize,     // maximum message size
    DWORD                   lReadTimeout,        // read time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes // inheritance option
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateMailslot", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateMailslotA)(lpName,
                                         nMaxMessageSize,
                                         lReadTimeout,
                                         lpSecurityAttributes);
}

HANDLE 
APIHOOK(CreateMailslotW)(
    LPCWSTR                 lpName,              // mailslot name
    DWORD                   nMaxMessageSize,     // maximum message size
    DWORD                   lReadTimeout,        // read time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes // inheritance option
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateMailslot", L"lpSecurityAttributes", lpName);
    
    return ORIGINAL_API(CreateMailslotW)(lpName,
                                         nMaxMessageSize,
                                         lReadTimeout,
                                         lpSecurityAttributes);
}


HANDLE 
APIHOOK(CreateNamedPipeA)(
    LPCSTR                  lpName,                 // pipe name
    DWORD                   dwOpenMode,             // pipe open mode
    DWORD                   dwPipeMode,             // pipe-specific modes
    DWORD                   nMaxInstances,          // maximum number of instances
    DWORD                   nOutBufferSize,         // output buffer size
    DWORD                   nInBufferSize,          // input buffer size
    DWORD                   nDefaultTimeOut,        // time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes    // SD
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNamedPipe", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateNamedPipeA)(lpName,
                                          dwOpenMode, 
                                          dwPipeMode,
                                          nMaxInstances,      
                                          nOutBufferSize,     
                                          nInBufferSize,      
                                          nDefaultTimeOut,    
                                          lpSecurityAttributes);
}

HANDLE 
APIHOOK(CreateNamedPipeW)(
    LPCWSTR                 lpName,                 // pipe name
    DWORD                   dwOpenMode,             // pipe open mode
    DWORD                   dwPipeMode,             // pipe-specific modes
    DWORD                   nMaxInstances,          // maximum number of instances
    DWORD                   nOutBufferSize,         // output buffer size
    DWORD                   nInBufferSize,          // input buffer size
    DWORD                   nDefaultTimeOut,        // time-out interval
    LPSECURITY_ATTRIBUTES   lpSecurityAttributes    // SD
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNamedPipe", L"lpSecurityAttributes", lpName);
    
    return ORIGINAL_API(CreateNamedPipeW)(lpName,
                                          dwOpenMode, 
                                          dwPipeMode,
                                          nMaxInstances,      
                                          nOutBufferSize,     
                                          nInBufferSize,      
                                          nDefaultTimeOut,    
                                          lpSecurityAttributes);
}

BOOL 
APIHOOK(CreatePipe)(
    PHANDLE                 hReadPipe,         // read handle
    PHANDLE                 hWritePipe,        // write handle
    LPSECURITY_ATTRIBUTES   lpPipeAttributes,  // security attributes
    DWORD                   nSize              // pipe size
    )
{
    CheckSecurityAttributes(lpPipeAttributes, L"CreatePipe", L"lpPipeAttributes", L"Unnamed pipe");
    
    return ORIGINAL_API(CreatePipe)(hReadPipe,
                                    hWritePipe,
                                    lpPipeAttributes,
                                    nSize);
}

HANDLE 
APIHOOK(CreateMutexA)(
    LPSECURITY_ATTRIBUTES lpMutexAttributes,  // SD
    BOOL bInitialOwner,                       // initial owner
    LPCSTR lpName                             // object name
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpMutexAttributes, L"CreateMutex", L"lpMutexAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateMutexA)(lpMutexAttributes,
                                      bInitialOwner,
                                      lpName);
}

HANDLE 
APIHOOK(CreateMutexW)(
    LPSECURITY_ATTRIBUTES lpMutexAttributes,  // SD
    BOOL bInitialOwner,                       // initial owner
    LPCWSTR lpName                            // object name
    )
{
    CheckSecurityAttributes(lpMutexAttributes, L"CreateMutex", L"lpMutexAttributes", lpName);
    
    return ORIGINAL_API(CreateMutexW)(lpMutexAttributes,
                                      bInitialOwner,
                                      lpName);
}

HANDLE 
APIHOOK(CreateSemaphoreA)(
    LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, // SD
    LONG lInitialCount,                          // initial count
    LONG lMaximumCount,                          // maximum count
    LPCSTR lpName                                // object name
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpSemaphoreAttributes, L"CreateSemaphore", L"lpSemaphoreAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateSemaphoreA)(lpSemaphoreAttributes,
                                          lInitialCount,
                                          lMaximumCount,
                                          lpName);
}

HANDLE 
APIHOOK(CreateSemaphoreW)(
    LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, // SD
    LONG lInitialCount,                          // initial count
    LONG lMaximumCount,                          // maximum count
    LPCWSTR lpName                               // object name
    )
{
    CheckSecurityAttributes(lpSemaphoreAttributes, L"CreateSemaphore", L"lpSemaphoreAttributes", lpName);
    
    return ORIGINAL_API(CreateSemaphoreW)(lpSemaphoreAttributes,
                                          lInitialCount,
                                          lMaximumCount,
                                          lpName);
}


HANDLE
APIHOOK(CreateWaitableTimerA)(
    IN LPSECURITY_ATTRIBUTES lpTimerAttributes,
    IN BOOL bManualReset,
    IN LPCSTR lpTimerName
    )
{
    LPWSTR pwszName = ToUnicode(lpTimerName);

    CheckSecurityAttributes(lpTimerAttributes, L"CreateWaitableTimer", L"lpTimerAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateWaitableTimerA)(lpTimerAttributes,
                                              bManualReset,
                                              lpTimerName);
}


HANDLE
APIHOOK(CreateWaitableTimerW)(
    IN LPSECURITY_ATTRIBUTES lpTimerAttributes,
    IN BOOL bManualReset,
    IN LPCWSTR lpTimerName
    )
{
    CheckSecurityAttributes(lpTimerAttributes, L"CreateWaitableTimer", L"lpTimerAttributes", lpTimerName);
    
    return ORIGINAL_API(CreateWaitableTimerW)(lpTimerAttributes,
                                              bManualReset,
                                              lpTimerName);
}

HANDLE
APIHOOK(CreateEventA)(
    IN LPSECURITY_ATTRIBUTES lpEventAttributes,
    IN BOOL bManualReset,
    IN BOOL bInitialState,
    IN LPCSTR lpName
    )
{
    LPWSTR pwszName = ToUnicode(lpName);

    CheckSecurityAttributes(lpEventAttributes, L"CreateEvent", L"lpEventAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateEventA)(lpEventAttributes,
                                      bManualReset,
                                      bInitialState,
                                      lpName);
}

HANDLE
APIHOOK(CreateEventW)(
    IN LPSECURITY_ATTRIBUTES lpEventAttributes,
    IN BOOL bManualReset,
    IN BOOL bInitialState,
    IN LPCWSTR lpName
    )
{
    CheckSecurityAttributes(lpEventAttributes, L"CreateEvent", L"lpEventAttributes", lpName);
    
    return ORIGINAL_API(CreateEventW)(lpEventAttributes,
                                      bManualReset,
                                      bInitialState,
                                      lpName);
}

BOOL
APIHOOK(SetFileSecurityA) (
    IN LPCSTR lpFileName,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor
    )
{
    if (SecurityInformation & DACL_SECURITY_INFORMATION) {
        LPWSTR pwszName = ToUnicode(lpFileName);

        CheckSecurityDescriptor(pSecurityDescriptor, L"SetFileSecurity", L"pSecurityDescriptor", pwszName);

        if (pwszName) {
            free(pwszName);
            pwszName = NULL;
        }
    }
    
    return ORIGINAL_API(SetFileSecurityA)(lpFileName,
                                          SecurityInformation,
                                          pSecurityDescriptor);
}

BOOL
APIHOOK(SetFileSecurityW) (
    IN LPCWSTR lpFileName,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor
    )
{
    if (SecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(pSecurityDescriptor, L"SetFileSecurity", L"pSecurityDescriptor", lpFileName);
    }

    return ORIGINAL_API(SetFileSecurityW)(lpFileName,
                                          SecurityInformation,
                                          pSecurityDescriptor);
}


BOOL
APIHOOK(SetKernelObjectSecurity) (
    IN HANDLE Handle,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor
    )
{
    if (SecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(pSecurityDescriptor, L"SetKernelObjectSecurity", L"pSecurityDescriptor", L"Unknown Kernel Object");
    }

    return ORIGINAL_API(SetKernelObjectSecurity)(Handle,
                                                 SecurityInformation,
                                                 pSecurityDescriptor);
}


DWORD
APIHOOK(SetNamedSecurityInfoA)(
    IN LPSTR               pObjectName,
    IN SE_OBJECT_TYPE        ObjectType,
    IN SECURITY_INFORMATION  SecurityInfo,
    IN PSID                  psidOwner,
    IN PSID                  psidGroup,
    IN PACL                  pDacl,
    IN PACL                  pSacl
    )
{
    if (SecurityInfo & DACL_SECURITY_INFORMATION) {
        LPWSTR pwszName = ToUnicode(pObjectName);

        CheckDacl(pDacl, L"SetNamedSecurityInfo", L"pDacl", pwszName);

        if (pwszName) {
            free(pwszName);
            pwszName = NULL;
        }
    }

    return ORIGINAL_API(SetNamedSecurityInfoA)(pObjectName,
                                               ObjectType,
                                               SecurityInfo,
                                               psidOwner,
                                               psidGroup,
                                               pDacl,
                                               pSacl);
}

DWORD
APIHOOK(SetNamedSecurityInfoW)(
    IN LPWSTR               pObjectName,
    IN SE_OBJECT_TYPE        ObjectType,
    IN SECURITY_INFORMATION  SecurityInfo,
    IN PSID                  psidOwner,
    IN PSID                  psidGroup,
    IN PACL                  pDacl,
    IN PACL                  pSacl
    )
{
    if (SecurityInfo & DACL_SECURITY_INFORMATION) {
        CheckDacl(pDacl, L"SetNamedSecurityInfo", L"pDacl", pObjectName);
    }

    return ORIGINAL_API(SetNamedSecurityInfoW)(pObjectName,
                                               ObjectType,
                                               SecurityInfo,
                                               psidOwner,
                                               psidGroup,
                                               pDacl,
                                               pSacl);
}

DWORD
APIHOOK(SetSecurityInfo)(
    IN HANDLE                handle,
    IN SE_OBJECT_TYPE        ObjectType,
    IN SECURITY_INFORMATION  SecurityInfo,
    IN PSID                  psidOwner,
    IN PSID                  psidGroup,
    IN PACL                  pDacl,
    IN PACL                  pSacl
    )
{
    if (SecurityInfo & DACL_SECURITY_INFORMATION) {
        CheckDacl(pDacl, L"SetSecurityInfo", L"pDacl", L"Unknown Object");
    }

    return ORIGINAL_API(SetSecurityInfo)(handle,
                                         ObjectType,
                                         SecurityInfo,
                                         psidOwner,
                                         psidGroup,
                                         pDacl,
                                         pSacl);
}

LONG
APIHOOK(RegSetKeySecurity) (
    IN HKEY hKey,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR pSecurityDescriptor
    )
{
    if (SecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(pSecurityDescriptor, L"RegSetKeySecurity", L"pSecurityDescriptor", L"Unknown Key");
    }

    return ORIGINAL_API(RegSetKeySecurity)(hKey,
                                           SecurityInformation,
                                           pSecurityDescriptor);
}

BOOL
APIHOOK(SetUserObjectSecurity)(
    IN HANDLE hObj,
    IN PSECURITY_INFORMATION pSIRequested,
    IN PSECURITY_DESCRIPTOR pSID)
{
    if (*pSIRequested & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(pSID, L"SetUserObjectSecurity", L"pSID", L"Unknown Object");
    }

    return ORIGINAL_API(SetUserObjectSecurity)(hObj,
                                               pSIRequested,
                                               pSID);
}


BOOL
APIHOOK(SetServiceObjectSecurity)(
    SC_HANDLE               hService,
    SECURITY_INFORMATION    dwSecurityInformation,
    PSECURITY_DESCRIPTOR    lpSecurityDescriptor
    )
{
    if (dwSecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(lpSecurityDescriptor, L"SetServiceObjectSecurity", L"lpSecurityDescriptor", L"Unknown Service");
    }

    return ORIGINAL_API(SetServiceObjectSecurity)(hService,
                                                  dwSecurityInformation,
                                                  lpSecurityDescriptor);
}


DWORD 
APIHOOK(SetNtmsObjectSecurity)(
    HANDLE hSession,
    LPNTMS_GUID lpObjectId,
    DWORD dwType,
    SECURITY_INFORMATION lpSecurityInformation,
    PSECURITY_DESCRIPTOR lpSecurityDescriptor
    )
{
    if (lpSecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(lpSecurityDescriptor, L"SetNtmsObjectSecurity", L"lpSecurityDescriptor", L"Unknown Object");
    }

    return ORIGINAL_API(SetNtmsObjectSecurity)(hSession,
                                               lpObjectId,
                                               dwType,
                                               lpSecurityInformation,
                                               lpSecurityDescriptor);
}


LONG 
APIHOOK(ClusterRegCreateKey)(
    HKEY hKey,                                   
    LPCWSTR lpszSubKey,                          
    DWORD dwOptions,                             
    REGSAM samDesired,                           
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,  
    PHKEY phkResult,                             
    LPDWORD lpdwDisposition                      
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"ClusterRegCreateKey", L"lpSecurityAttributes", lpszSubKey);
    
    return ORIGINAL_API(ClusterRegCreateKey)(hKey,
                                             lpszSubKey,
                                             dwOptions,
                                             samDesired,
                                             lpSecurityAttributes,
                                             phkResult,
                                             lpdwDisposition);
}

LONG 
APIHOOK(ClusterRegSetKeySecurity)(
    HKEY hKey,                                
    SECURITY_INFORMATION SecurityInformation,  
    PSECURITY_DESCRIPTOR pSecurityDescriptor  
    )
{
    if (SecurityInformation & DACL_SECURITY_INFORMATION) {
        CheckSecurityDescriptor(pSecurityDescriptor, L"ClusterRegSetKeySecurity", L"pSecurityDescriptor", L"Unknown Key");
    }

    return ORIGINAL_API(ClusterRegSetKeySecurity)(hKey,
                                                  SecurityInformation,
                                                  pSecurityDescriptor);
}


DWORD 
APIHOOK(CreateNtmsMediaPoolA)(
    HANDLE hSession,
    LPCSTR lpPoolName,
    LPNTMS_GUID lpMediaType,
    DWORD dwAction,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    LPNTMS_GUID lpPoolId
    )
{
    LPWSTR pwszName = ToUnicode(lpPoolName);

    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNtmsMediaPool", L"lpSecurityAttributes", pwszName);

    if (pwszName) {
        free(pwszName);
        pwszName = NULL;
    }
    
    return ORIGINAL_API(CreateNtmsMediaPoolA)(hSession,
                                              lpPoolName,
                                              lpMediaType,
                                              dwAction,
                                              lpSecurityAttributes,
                                              lpPoolId);

}

DWORD 
APIHOOK(CreateNtmsMediaPoolW)(
    HANDLE hSession,
    LPCWSTR lpPoolName,
    LPNTMS_GUID lpMediaType,
    DWORD dwAction,
    LPSECURITY_ATTRIBUTES lpSecurityAttributes,
    LPNTMS_GUID lpPoolId            // OUT
    )
{
    CheckSecurityAttributes(lpSecurityAttributes, L"CreateNtmsMediaPool", L"lpSecurityAttributes", lpPoolName);
    
    return ORIGINAL_API(CreateNtmsMediaPoolW)(hSession,
                                              lpPoolName,
                                              lpMediaType,
                                              dwAction,
                                              lpSecurityAttributes,
                                              lpPoolId);
}




SHIM_INFO_BEGIN()

    SHIM_INFO_DESCRIPTION(AVS_SECURITYCHECKS_DESC)
    SHIM_INFO_FRIENDLY_NAME(AVS_SECURITYCHECKS_FRIENDLY)
    SHIM_INFO_FLAGS(0)
    SHIM_INFO_GROUPS(0)    
    SHIM_INFO_VERSION(2, 4)
    SHIM_INFO_INCLUDE_EXCLUDE("I:*")

SHIM_INFO_END()

/*++

 Register hooked functions.

--*/
HOOK_BEGIN

    if (fdwReason == DLL_PROCESS_ATTACH) {
        DWORD dwSize;

        InitWorldSid();

        dwSize = GetSystemWindowsDirectoryW(g_wszWinDir, ARRAYSIZE(g_wszWinDir));
        if (dwSize == 0 || dwSize > ARRAYSIZE(g_wszWinDir)) {
            g_wszWinDir[0] = 0;
        }
        g_dwWinDirLen = wcslen(g_wszWinDir);
    }

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_BADARGUMENTS, 
                            AVS_SECURITYCHECKS_BADARGUMENTS,
                            AVS_SECURITYCHECKS_BADARGUMENTS_R,
                            AVS_SECURITYCHECKS_BADARGUMENTS_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WINEXEC, 
                            AVS_SECURITYCHECKS_WINEXEC,
                            AVS_SECURITYCHECKS_WINEXEC_R,
                            AVS_SECURITYCHECKS_WINEXEC_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_NULL_DACL, 
                            AVS_SECURITYCHECKS_NULL_DACL,
                            AVS_SECURITYCHECKS_NULL_DACL_R,
                            AVS_SECURITYCHECKS_NULL_DACL_URL)

    DUMP_VERIFIER_LOG_ENTRY(VLOG_SECURITYCHECKS_WORLDWRITE_DACL, 
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL,
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL_R,
                            AVS_SECURITYCHECKS_WORLDWRITE_DACL_URL)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateProcessA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateProcessW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 CreateProcessAsUserA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 CreateProcessAsUserW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 WinExec)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileW)
    APIHOOK_ENTRY(USER32.DLL,                   CreateDesktopA)
    APIHOOK_ENTRY(USER32.DLL,                   CreateDesktopW)
    APIHOOK_ENTRY(USER32.DLL,                   CreateWindowStationA)
    APIHOOK_ENTRY(USER32.DLL,                   CreateWindowStationW)

    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegCreateKeyExA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegCreateKeyExW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyExA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSaveKeyExW)

    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileMappingA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateFileMappingW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateJobObjectA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateJobObjectW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateThread)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateRemoteThread)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryExA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateDirectoryExW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateHardLinkA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateHardLinkW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMailslotA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMailslotW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateNamedPipeA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateNamedPipeW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreatePipe)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMutexA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateMutexW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateSemaphoreA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateSemaphoreW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateWaitableTimerA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateWaitableTimerW)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateEventA)
    APIHOOK_ENTRY(KERNEL32.DLL,                 CreateEventW)

    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetFileSecurityA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetFileSecurityW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetKernelObjectSecurity)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetNamedSecurityInfoA)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetNamedSecurityInfoW)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetSecurityInfo)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 RegSetKeySecurity)

    APIHOOK_ENTRY(USER32.DLL,                   SetUserObjectSecurity)
    APIHOOK_ENTRY(ADVAPI32.DLL,                 SetServiceObjectSecurity)
    APIHOOK_ENTRY(NTMSAPI.DLL,                  SetNtmsObjectSecurity)
    APIHOOK_ENTRY(CLUSAPI.DLL,                  ClusterRegCreateKey)
    APIHOOK_ENTRY(CLUSAPI.DLL,                  ClusterRegSetKeySecurity)
    APIHOOK_ENTRY(NTMSAPI.DLL,                  CreateNtmsMediaPoolA)
    APIHOOK_ENTRY(NTMSAPI.DLL,                  CreateNtmsMediaPoolW)

HOOK_END



IMPLEMENT_SHIM_END