#ifndef _NTSEAPI_H

// private
/**
 * Describes a native token security attribute. Name and string values are UNICODE_STRING descriptors,
 * unlike the PWSTR-based CLAIM_SECURITY_ATTRIBUTE_V1 representation.
 * \remarks The fixed structure is 40 bytes on x64 and 24 bytes on x86. ValueCount counts elements,
 * not bytes; Values points to storage interpreted according to ValueType.
 */
typedef struct _TOKEN_SECURITY_ATTRIBUTE_V1
{
    UNICODE_STRING Name;
    USHORT ValueType;
    USHORT Reserved;
    ULONG Flags;
    ULONG ValueCount;
    union
    {
        PLONG64 Int64;
        PULONG64 Uint64;
        PUNICODE_STRING String;
        PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE Fqbn;
        PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE OctetString;
    } Values;
} TOKEN_SECURITY_ATTRIBUTE_V1, *PTOKEN_SECURITY_ATTRIBUTE_V1;

#endif
View code on GitHub