RtlValidSid - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
#ifndef _NTRTL_H
//
// SIDs
//
/**
* The RtlValidSid routine validates a security identifier (SID) by verifying that its revision level and subauthority count are within valid ranges.
*
* \param Sid A pointer to the SID to validate.
* \return Returns `TRUE` if the SID is structurally valid, otherwise `FALSE`.
* \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlvalidsid
* \remarks This is a shallow header check, not a bounded-buffer validation or an identity/access check. It accepts a revision whose low nibble is 1 and at most 15 subauthorities; it does not prove that all subauthority storage is readable. String conversion additionally requires the exact revision byte 1.
*/
_Must_inspect_result_
NTSYSAPI
BOOLEAN
NTAPI
RtlValidSid(
_In_ PSID Sid
);
View code on GitHub// ntifs.h
NTSYSAPI BOOLEAN RtlValidSid(
[in] PSID Sid
);
View the official Windows Driver Kit DDI referenceThis function is documented in Windows Driver Kit.
The RtlValidSid routine validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum.
Sid [in]Pointer to the SID structure to validate.
RtlValidSid returns TRUE if the security descriptor is valid, FALSE otherwise.
For more information about security and access control, see Windows security model for driver developers and the documentation on these topics in the Windows SDK.