#ifndef _NTSEAPI_H

//
// Access checking
//

/**
 * The NtAccessCheck routine determines whether a security descriptor grants a specified set of access rights to the client represented by an access token.
 *
 * \param SecurityDescriptor Pointer to the SECURITY_DESCRIPTOR structure against which access is checked.
 * \param ClientToken Handle to the access token representing the client. The handle must have TOKEN_QUERY access.
 * \param DesiredAccess Object-specific access mask to check. Map GENERIC_READ/WRITE/EXECUTE/ALL first; unmapped generic bits return STATUS_GENERIC_NOT_MAPPED.
 * \param GenericMapping Pointer to the GENERIC_MAPPING structure associated with the object for which access is being checked.
 * \param PrivilegeSet Pointer to a PRIVILEGE_SET structure that receives the privileges required to access the object. The buffer must be large enough to hold the privilege set.
 * \param PrivilegeSetLength Pointer to a variable that specifies the size, in bytes, of the PrivilegeSet buffer. On input, this is the size of the buffer; on output, it receives the number of bytes required.
 * \param GrantedAccess Pointer to an access mask that receives the granted access rights.
 * \param AccessStatus Pointer to a variable that receives the results of the access check.
 * \return NTSTATUS for execution of the check. A successful return does not itself grant access: inspect AccessStatus and GrantedAccess (or their result arrays).
 * \sa https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-accesscheck
 * \remarks For an ordinary token handle, the user-mode path requires an impersonation token at SecurityIdentification
 * or higher and TOKEN_QUERY (0x8); a primary token is rejected with STATUS_NO_IMPERSONATION_TOKEN.
 * AccessStatus is itself NTSTATUS, not the Win32 BOOL result. An empty DACL can yield syscall STATUS_SUCCESS
 * with AccessStatus = STATUS_ACCESS_DENIED and GrantedAccess = 0. Map generic bits before calling; do not
 * equate successful execution with authorization.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAccessCheck(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_ HANDLE ClientToken,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PGENERIC_MAPPING GenericMapping,
    _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
    _Inout_ PULONG PrivilegeSetLength,
    _Out_ PACCESS_MASK GrantedAccess,
    _Out_ PNTSTATUS AccessStatus
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAccessCheck(
    _In_ PSECURITY_DESCRIPTOR SecurityDescriptor,
    _In_ HANDLE ClientToken,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PGENERIC_MAPPING GenericMapping,
    _Out_writes_bytes_(*PrivilegeSetLength) PPRIVILEGE_SET PrivilegeSet,
    _Inout_ PULONG PrivilegeSetLength,
    _Out_ PACCESS_MASK GrantedAccess,
    _Out_ PNTSTATUS AccessStatus
    );

#endif
View code on GitHub