Win32 API 日本語リファレンス
ホームSystem.SystemServices › TOKEN_LOGGING_INFORMATION

TOKEN_LOGGING_INFORMATION

構造体
サイズx64: 80 バイト / x86: 60 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
TokenTypeTOKEN_TYPE4+0+0トークンの種類(プライマリかインパーソネーションか)を示す。
TokenElevationTOKEN_ELEVATION4+4+4トークンが昇格しているか否かを示す。
TokenElevationTypeTOKEN_ELEVATION_TYPE4+8+8昇格の種別(既定/全権/制限付き)を示す。
ImpersonationLevelSECURITY_IMPERSONATION_LEVEL4+12+12インパーソネーションレベル(匿名/識別/偽装/委任)を示す。
IntegrityLevelDWORD4+16+16トークンの整合性レベル(信頼度)を示す。
UserSID_AND_ATTRIBUTES16/8+24+20トークン所有ユーザーのSIDと属性を保持する。
TrustLevelSidPSID8/4+40+28保護プロセスの信頼レベルを表すSID。NULL可。
SessionIdDWORD4+48+32トークンが属するターミナルサービスセッションのID。
AppContainerNumberDWORD4+52+36アプリコンテナー番号。非コンテナーでは0。
AuthenticationIdLUID8+56+40認証セッションを一意に識別するLUID(ログオンID)。
GroupCountDWORD4+64+48Groups配列に含まれるグループ数を示す。
GroupsLengthDWORD4+68+52Groupsデータのバイト長を示す。
GroupsSID_AND_ATTRIBUTES*8/4+72+56トークンに属するグループSIDと属性の配列へのポインタ。

各言語での定義

#include <windows.h>

// TOKEN_ELEVATION  (x64 4 / x86 4 バイト)
typedef struct TOKEN_ELEVATION {
    DWORD TokenIsElevated;
} TOKEN_ELEVATION;

// SID_AND_ATTRIBUTES  (x64 16 / x86 8 バイト)
typedef struct SID_AND_ATTRIBUTES {
    PSID Sid;
    DWORD Attributes;
} SID_AND_ATTRIBUTES;

// LUID  (x64 8 / x86 8 バイト)
typedef struct LUID {
    DWORD LowPart;
    INT HighPart;
} LUID;

// TOKEN_LOGGING_INFORMATION  (x64 80 / x86 60 バイト)
typedef struct TOKEN_LOGGING_INFORMATION {
    TOKEN_TYPE TokenType;
    TOKEN_ELEVATION TokenElevation;
    TOKEN_ELEVATION_TYPE TokenElevationType;
    SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
    DWORD IntegrityLevel;
    SID_AND_ATTRIBUTES User;
    PSID TrustLevelSid;
    DWORD SessionId;
    DWORD AppContainerNumber;
    LUID AuthenticationId;
    DWORD GroupCount;
    DWORD GroupsLength;
    SID_AND_ATTRIBUTES* Groups;
} TOKEN_LOGGING_INFORMATION;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct TOKEN_ELEVATION
{
    public uint TokenIsElevated;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct SID_AND_ATTRIBUTES
{
    public IntPtr Sid;
    public uint Attributes;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LUID
{
    public uint LowPart;
    public int HighPart;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct TOKEN_LOGGING_INFORMATION
{
    public int TokenType;
    public TOKEN_ELEVATION TokenElevation;
    public int TokenElevationType;
    public int ImpersonationLevel;
    public uint IntegrityLevel;
    public SID_AND_ATTRIBUTES User;
    public IntPtr TrustLevelSid;
    public uint SessionId;
    public uint AppContainerNumber;
    public LUID AuthenticationId;
    public uint GroupCount;
    public uint GroupsLength;
    public IntPtr Groups;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure TOKEN_ELEVATION
    Public TokenIsElevated As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure SID_AND_ATTRIBUTES
    Public Sid As IntPtr
    Public Attributes As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LUID
    Public LowPart As UInteger
    Public HighPart As Integer
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure TOKEN_LOGGING_INFORMATION
    Public TokenType As Integer
    Public TokenElevation As TOKEN_ELEVATION
    Public TokenElevationType As Integer
    Public ImpersonationLevel As Integer
    Public IntegrityLevel As UInteger
    Public User As SID_AND_ATTRIBUTES
    Public TrustLevelSid As IntPtr
    Public SessionId As UInteger
    Public AppContainerNumber As UInteger
    Public AuthenticationId As LUID
    Public GroupCount As UInteger
    Public GroupsLength As UInteger
    Public Groups As IntPtr
End Structure
import ctypes
from ctypes import wintypes

class TOKEN_ELEVATION(ctypes.Structure):
    _fields_ = [
        ("TokenIsElevated", wintypes.DWORD),
    ]

class SID_AND_ATTRIBUTES(ctypes.Structure):
    _fields_ = [
        ("Sid", ctypes.c_void_p),
        ("Attributes", wintypes.DWORD),
    ]

class LUID(ctypes.Structure):
    _fields_ = [
        ("LowPart", wintypes.DWORD),
        ("HighPart", ctypes.c_int),
    ]

class TOKEN_LOGGING_INFORMATION(ctypes.Structure):
    _fields_ = [
        ("TokenType", ctypes.c_int),
        ("TokenElevation", TOKEN_ELEVATION),
        ("TokenElevationType", ctypes.c_int),
        ("ImpersonationLevel", ctypes.c_int),
        ("IntegrityLevel", wintypes.DWORD),
        ("User", SID_AND_ATTRIBUTES),
        ("TrustLevelSid", ctypes.c_void_p),
        ("SessionId", wintypes.DWORD),
        ("AppContainerNumber", wintypes.DWORD),
        ("AuthenticationId", LUID),
        ("GroupCount", wintypes.DWORD),
        ("GroupsLength", wintypes.DWORD),
        ("Groups", ctypes.c_void_p),
    ]
#[repr(C)]
pub struct TOKEN_ELEVATION {
    pub TokenIsElevated: u32,
}

#[repr(C)]
pub struct SID_AND_ATTRIBUTES {
    pub Sid: *mut core::ffi::c_void,
    pub Attributes: u32,
}

#[repr(C)]
pub struct LUID {
    pub LowPart: u32,
    pub HighPart: i32,
}

#[repr(C)]
pub struct TOKEN_LOGGING_INFORMATION {
    pub TokenType: i32,
    pub TokenElevation: TOKEN_ELEVATION,
    pub TokenElevationType: i32,
    pub ImpersonationLevel: i32,
    pub IntegrityLevel: u32,
    pub User: SID_AND_ATTRIBUTES,
    pub TrustLevelSid: *mut core::ffi::c_void,
    pub SessionId: u32,
    pub AppContainerNumber: u32,
    pub AuthenticationId: LUID,
    pub GroupCount: u32,
    pub GroupsLength: u32,
    pub Groups: *mut core::ffi::c_void,
}
import "golang.org/x/sys/windows"

type TOKEN_ELEVATION struct {
	TokenIsElevated uint32
}

type SID_AND_ATTRIBUTES struct {
	Sid uintptr
	Attributes uint32
}

type LUID struct {
	LowPart uint32
	HighPart int32
}

type TOKEN_LOGGING_INFORMATION struct {
	TokenType int32
	TokenElevation TOKEN_ELEVATION
	TokenElevationType int32
	ImpersonationLevel int32
	IntegrityLevel uint32
	User SID_AND_ATTRIBUTES
	TrustLevelSid uintptr
	SessionId uint32
	AppContainerNumber uint32
	AuthenticationId LUID
	GroupCount uint32
	GroupsLength uint32
	Groups uintptr
}
type
  TOKEN_ELEVATION = record
    TokenIsElevated: DWORD;
  end;

  SID_AND_ATTRIBUTES = record
    Sid: Pointer;
    Attributes: DWORD;
  end;

  LUID = record
    LowPart: DWORD;
    HighPart: Integer;
  end;

  TOKEN_LOGGING_INFORMATION = record
    TokenType: Integer;
    TokenElevation: TOKEN_ELEVATION;
    TokenElevationType: Integer;
    ImpersonationLevel: Integer;
    IntegrityLevel: DWORD;
    User: SID_AND_ATTRIBUTES;
    TrustLevelSid: Pointer;
    SessionId: DWORD;
    AppContainerNumber: DWORD;
    AuthenticationId: LUID;
    GroupCount: DWORD;
    GroupsLength: DWORD;
    Groups: Pointer;
  end;
const TOKEN_ELEVATION = extern struct {
    TokenIsElevated: u32,
};

const SID_AND_ATTRIBUTES = extern struct {
    Sid: ?*anyopaque,
    Attributes: u32,
};

const LUID = extern struct {
    LowPart: u32,
    HighPart: i32,
};

const TOKEN_LOGGING_INFORMATION = extern struct {
    TokenType: i32,
    TokenElevation: TOKEN_ELEVATION,
    TokenElevationType: i32,
    ImpersonationLevel: i32,
    IntegrityLevel: u32,
    User: SID_AND_ATTRIBUTES,
    TrustLevelSid: ?*anyopaque,
    SessionId: u32,
    AppContainerNumber: u32,
    AuthenticationId: LUID,
    GroupCount: u32,
    GroupsLength: u32,
    Groups: ?*anyopaque,
};
type
  TOKEN_ELEVATION {.bycopy.} = object
    TokenIsElevated: uint32

  SID_AND_ATTRIBUTES {.bycopy.} = object
    Sid: pointer
    Attributes: uint32

  LUID {.bycopy.} = object
    LowPart: uint32
    HighPart: int32

  TOKEN_LOGGING_INFORMATION {.bycopy.} = object
    TokenType: int32
    TokenElevation: TOKEN_ELEVATION
    TokenElevationType: int32
    ImpersonationLevel: int32
    IntegrityLevel: uint32
    User: SID_AND_ATTRIBUTES
    TrustLevelSid: pointer
    SessionId: uint32
    AppContainerNumber: uint32
    AuthenticationId: LUID
    GroupCount: uint32
    GroupsLength: uint32
    Groups: pointer
struct TOKEN_ELEVATION
{
    uint TokenIsElevated;
}

struct SID_AND_ATTRIBUTES
{
    void* Sid;
    uint Attributes;
}

struct LUID
{
    uint LowPart;
    int HighPart;
}

struct TOKEN_LOGGING_INFORMATION
{
    int TokenType;
    TOKEN_ELEVATION TokenElevation;
    int TokenElevationType;
    int ImpersonationLevel;
    uint IntegrityLevel;
    SID_AND_ATTRIBUTES User;
    void* TrustLevelSid;
    uint SessionId;
    uint AppContainerNumber;
    LUID AuthenticationId;
    uint GroupCount;
    uint GroupsLength;
    void* Groups;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; TOKEN_LOGGING_INFORMATION サイズ: 60 バイト(x86)
dim st, 15    ; 4byte整数×15(構造体サイズ 60 / 4 切り上げ)
; TokenType : TOKEN_TYPE (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; TokenElevation : TOKEN_ELEVATION (+4, 4byte)  varptr(st)+4 を基点に操作(4byte:入れ子/配列)
; TokenElevationType : TOKEN_ELEVATION_TYPE (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ImpersonationLevel : SECURITY_IMPERSONATION_LEVEL (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; IntegrityLevel : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; User : SID_AND_ATTRIBUTES (+20, 8byte)  varptr(st)+20 を基点に操作(8byte:入れ子/配列)
; TrustLevelSid : PSID (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; SessionId : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; AppContainerNumber : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; AuthenticationId : LUID (+40, 8byte)  varptr(st)+40 を基点に操作(8byte:入れ子/配列)
; GroupCount : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; GroupsLength : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; Groups : SID_AND_ATTRIBUTES* (+56, 4byte)  varptr(st)+56 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; TOKEN_LOGGING_INFORMATION サイズ: 80 バイト(x64)
dim st, 20    ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; TokenType : TOKEN_TYPE (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; TokenElevation : TOKEN_ELEVATION (+4, 4byte)  varptr(st)+4 を基点に操作(4byte:入れ子/配列)
; TokenElevationType : TOKEN_ELEVATION_TYPE (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ImpersonationLevel : SECURITY_IMPERSONATION_LEVEL (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; IntegrityLevel : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; User : SID_AND_ATTRIBUTES (+24, 16byte)  varptr(st)+24 を基点に操作(16byte:入れ子/配列)
; TrustLevelSid : PSID (+40, 8byte)  qpoke st,40,値 / qpeek(st,40)  ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; SessionId : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; AppContainerNumber : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; AuthenticationId : LUID (+56, 8byte)  varptr(st)+56 を基点に操作(8byte:入れ子/配列)
; GroupCount : DWORD (+64, 4byte)  st.16 = 値  /  値 = st.16   (lpoke/lpeek も可)
; GroupsLength : DWORD (+68, 4byte)  st.17 = 値  /  値 = st.17   (lpoke/lpeek も可)
; Groups : SID_AND_ATTRIBUTES* (+72, 8byte)  varptr(st)+72 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global TOKEN_ELEVATION
    #field int TokenIsElevated
#endstruct

#defstruct global SID_AND_ATTRIBUTES
    #field intptr Sid
    #field int Attributes
#endstruct

#defstruct global LUID
    #field int LowPart
    #field int HighPart
#endstruct

#defstruct global TOKEN_LOGGING_INFORMATION
    #field int TokenType
    #field TOKEN_ELEVATION TokenElevation
    #field int TokenElevationType
    #field int ImpersonationLevel
    #field int IntegrityLevel
    #field SID_AND_ATTRIBUTES User
    #field intptr TrustLevelSid
    #field int SessionId
    #field int AppContainerNumber
    #field LUID AuthenticationId
    #field int GroupCount
    #field int GroupsLength
    #field intptr Groups
#endstruct

stdim st, TOKEN_LOGGING_INFORMATION        ; NSTRUCT 変数を確保
st->TokenType = 100
mes "TokenType=" + st->TokenType