API to get AppContainerName from AppContainerSid

user_843732 0
Viewed 660

Say, if I have a DACL for a process that I need to show for an end-user. I can convert it to string representation with ConvertSecurityDescriptorToStringSecurityDescriptor. I then need to make it a little bit more manageable for the user by removing "crazy" local SIDs from it. Here's an example:

D:(A;;0x1fffff;;;S-1-5-21-2301966995-2804055512-1978750589-1002)(A;;0x1fffff;;;SY)(A;;0x121411;;;S-1-5-5-0-1207601)(A;;0x1fffff;;;S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708)

For instance, the resulting string may include a user SID (or S-1-5-21-2301966995-2804055512-1978750589-1002 in the case above), which I can convert to a user name with LookupAccountName, but I can't seem to find a way to convert AppContainer SIDs into AppContainer name.

In this case, S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708 stands for Microsoft.Windows.ShellExperienceHost.

There's an API that can convert the latter into the former, called DeriveAppContainerSidFromAppContainerName.

But I'm curious how do I convert AppContainerSid into AppContainerName?

sid kernel winapi c++
1 Answers

for this task exist undocumented function (look app_container.cc from chromium )

LONG WINAPI AppContainerLookupMoniker(PSID Sid, PWSTR* packageFamilyName);

it exported from api-ms-win-appmodel-identity-l1-2-0.dll

it take your sid as input and return string - packageFamilyName. for free this string need use another undocumented api

BOOLEAN WINAPI AppContainerFreeMemory(void* ptr);

returned packageFamilyName we can use already in documented api GetPackagesByPackageFamily. returned packageFullName we already can use in api like GetStagedPackagePathByFullName, OpenPackageInfoByFullName, etc..

for example:

#include <appmodel.h>

void AppXtest(PSID Sid)
{
    LONG (WINAPI* AppContainerLookupMoniker)(PSID Sid, PWSTR* packageFamilyName);
    BOOLEAN (WINAPI* AppContainerFreeMemory)(void* ptr);

    if (HMODULE hmod = LoadLibraryW(L"api-ms-win-appmodel-identity-l1-2-0"))
    {
        if ((*(void**)&AppContainerLookupMoniker = GetProcAddress(hmod, "AppContainerLookupMoniker")) &&
            (*(void**)&AppContainerFreeMemory = GetProcAddress(hmod, "AppContainerFreeMemory")))
        {

            PWSTR packageFamilyName;
            LONG err = AppContainerLookupMoniker(Sid, &packageFamilyName);

            if (err == NOERROR)
            {
                DbgPrint("%S\n", packageFamilyName);

                UINT32 count = 0, bufferLength = 0;

                if (ERROR_INSUFFICIENT_BUFFER == GetPackagesByPackageFamily(packageFamilyName, &count, 0, &bufferLength, 0))
                {
                    PWSTR *packageFullNames = (PWSTR*)alloca(count * sizeof(PWSTR) + bufferLength*sizeof(WCHAR));
                    PWSTR buffer = (PWSTR)(packageFullNames+ count);

                    if (NOERROR == GetPackagesByPackageFamily(packageFamilyName, &count, packageFullNames, &bufferLength, buffer))
                    {
                        if (count)
                        {
                            do 
                            {
                                PCWSTR packageFullName = *packageFullNames++;
                                DbgPrint("%S\n", packageFullName);

                                WCHAR path[MAX_PATH];
                                UINT32 len = RTL_NUMBER_OF(path);

                                if (NOERROR == GetStagedPackagePathByFullName(packageFullName, &len, path))
                                {
                                    DbgPrint("%S\n", path);
                                }
                            } while (--count);
                        }
                    }
                }

                AppContainerFreeMemory(packageFamilyName);
            }
        }
    }
}

for sid S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708

i got:

microsoft.windows.shellexperiencehost_cw5n1h2txyewy
Microsoft.Windows.ShellExperienceHost_10.0.14393.0_neutral_neutral_cw5n1h2txyewy
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy
user_64016560
Related