How do I get the caller SID in kernel mode hook? (windows)

Question

I'm developing a driver that hooks some functions in windows (hardening driver that will block some actions). The problem is, that I want to log which was the user who attempted to run those actions.

For example, I've put an hook on ZwSetValueKey in order to filter registry writing.

The hook works perfectly, But I don't know how to get the caller SID. I've found out that I can determine whether the mode of the caller(i.e. user mode or kernel mode) using ExGetPreviousMode. But I'm not really sure how to determine the SID if the caller was in user mode.

Thanks.

Answer 1

If this were user mode, you'd start with GetCurrentProcess or GetCurrentThread, and then call GetProcessToken or GetThreadToken. This would get you an access token, from which the SID can be extracted directly. In kernel model, there's PsGetCurrentProcess and ZwOpenProcessTokenEx, and the like for threads.

Here's the equivalent question for user space: How to get Calling-Process Windows User Access Token.

I haven't tested this, but I hope it gets you started.