Addendum

Key Windows Kernel Structures

The _TOKEN structure in the Windows kernel is a critical data structure that represents a security context for a process or thread. It encapsulates information about the user’s identity, privileges, and group memberships, which are used to enforce access control and privilege separation within the system.

This structure is a part of a EPROCESS (field Token, of type _EX_FAST_REF - see below). It has the following structure (valid for Windows 10, release 1809):

//0x498 bytes (sizeof), src: Vergilius Project
struct _TOKEN
{
    struct _TOKEN_SOURCE TokenSource;                                       //0x0
    struct _LUID TokenId;                                                   //0x10
    struct _LUID AuthenticationId;                                          //0x18
    struct _LUID ParentTokenId;                                             //0x20
    union _LARGE_INTEGER ExpirationTime;                                    //0x28
    struct _ERESOURCE* TokenLock;                                           //0x30
    struct _LUID ModifiedId;                                                //0x38
    struct _SEP_TOKEN_PRIVILEGES Privileges;                                //0x40
    struct _SEP_AUDIT_POLICY AuditPolicy;                                   //0x58
    ULONG SessionId;                                                        //0x78
    ULONG UserAndGroupCount;                                                //0x7c
    ULONG RestrictedSidCount;                                               //0x80
    ULONG VariableLength;                                                   //0x84
    ULONG DynamicCharged;                                                   //0x88
    ULONG DynamicAvailable;                                                 //0x8c
    ULONG DefaultOwnerIndex;                                                //0x90
    struct _SID_AND_ATTRIBUTES* UserAndGroups;                              //0x98
    struct _SID_AND_ATTRIBUTES* RestrictedSids;                             //0xa0
    VOID* PrimaryGroup;                                                     //0xa8
    ULONG* DynamicPart;                                                     //0xb0
    struct _ACL* DefaultDacl;                                               //0xb8
    enum _TOKEN_TYPE TokenType;                                             //0xc0
    enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;                  //0xc4
    ULONG TokenFlags;                                                       //0xc8
    UCHAR TokenInUse;                                                       //0xcc
    ULONG IntegrityLevelIndex;                                              //0xd0
    ULONG MandatoryPolicy;                                                  //0xd4
    struct _SEP_LOGON_SESSION_REFERENCES* LogonSession;                     //0xd8
    struct _LUID OriginatingLogonSession;                                   //0xe0
    struct _SID_AND_ATTRIBUTES_HASH SidHash;                                //0xe8
    struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash;                      //0x1f8
    struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes; //0x308
    VOID* Package;                                                          //0x310
    struct _SID_AND_ATTRIBUTES* Capabilities;                               //0x318
    ULONG CapabilityCount;                                                  //0x320
    struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash;                       //0x328
    struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry;                     //0x438
    struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry;                   //0x440
    struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes;       //0x448
    VOID* TrustLevelSid;                                                    //0x450
    struct _TOKEN* TrustLinkedToken;                                        //0x458
    VOID* IntegrityLevelSidValue;                                           //0x460
    struct _SEP_SID_VALUES_BLOCK* TokenSidValues;                           //0x468
    struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry;                        //0x470
    struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo;                     //0x478
    struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry;             //0x480
    VOID* SessionObject;                                                    //0x488
    ULONGLONG VariablePart;                                                 //0x490
};

The _EX_FAST_REF structure is a lightweight reference counting mechanism used in the Windows kernel to efficiently manage pointers to objects. It’s designed to provide fast access to the referenced object while minimizing the overhead of reference counting operations.

It is used in many data structures, like EPROCESS, _WMI_LOGGER_CONTEXT, _CONTROL_AREA, etc., and holds a pointer to other objects, e.g. _TOKEN.

//0x8 bytes (sizeof), src: Vergilius Project
struct _EX_FAST_REF
{
    union
    {
        VOID* Object;                                                       //0x0
        ULONGLONG RefCnt:4;                                                 //0x0
        ULONGLONG Value;                                                    //0x0
    };
};