API to get AppContainerName from AppContainerSid - c++

Question

Say, if I have a DACL for a process that I need to show for an end-user. I can convert it to string representation with ConvertSecurityDescriptorToStringSecurityDescriptor. I then need to make it a little bit more manageable for the user by removing "crazy" local SIDs from it. Here's an example:
D:(A;;0x1fffff;;;S-1-5-21-2301966995-2804055512-1978750589-1002)(A;;0x1fffff;;;SY)(A;;0x121411;;;S-1-5-5-0-1207601)(A;;0x1fffff;;;S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708)
For instance, the resulting string may include a user SID (or S-1-5-21-2301966995-2804055512-1978750589-1002 in the case above), which I can convert to a user name with LookupAccountName, but I can't seem to find a way to convert AppContainer SIDs into AppContainer name.
In this case, S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708 stands for Microsoft.Windows.ShellExperienceHost.
There's an API that can convert the latter into the former, called DeriveAppContainerSidFromAppContainerName.
But I'm curious how do I convert AppContainerSid into AppContainerName?

Answer 1

for this task exist undocumented function (look app_container.cc
from chromium
)
LONG WINAPI AppContainerLookupMoniker(PSID Sid, PWSTR* packageFamilyName);
it exported from api-ms-win-appmodel-identity-l1-2-0.dll
it take your sid as input and return string - packageFamilyName. for free this string need use another undocumented api
BOOLEAN WINAPI AppContainerFreeMemory(void* ptr);
returned packageFamilyName we can use already in documented api GetPackagesByPackageFamily. returned packageFullName we already can use in api like GetStagedPackagePathByFullName, OpenPackageInfoByFullName, etc..
for example:
#include <appmodel.h>
void AppXtest(PSID Sid)
{
LONG (WINAPI* AppContainerLookupMoniker)(PSID Sid, PWSTR* packageFamilyName);
BOOLEAN (WINAPI* AppContainerFreeMemory)(void* ptr);
if (HMODULE hmod = LoadLibraryW(L"api-ms-win-appmodel-identity-l1-2-0"))
{
if ((*(void**)&AppContainerLookupMoniker = GetProcAddress(hmod, "AppContainerLookupMoniker")) &&
(*(void**)&AppContainerFreeMemory = GetProcAddress(hmod, "AppContainerFreeMemory")))
{
PWSTR packageFamilyName;
LONG err = AppContainerLookupMoniker(Sid, &packageFamilyName);
if (err == NOERROR)
{
DbgPrint("%S\n", packageFamilyName);
UINT32 count = 0, bufferLength = 0;
if (ERROR_INSUFFICIENT_BUFFER == GetPackagesByPackageFamily(packageFamilyName, &count, 0, &bufferLength, 0))
{
PWSTR *packageFullNames = (PWSTR*)alloca(count * sizeof(PWSTR) + bufferLength*sizeof(WCHAR));
PWSTR buffer = (PWSTR)(packageFullNames+ count);
if (NOERROR == GetPackagesByPackageFamily(packageFamilyName, &count, packageFullNames, &bufferLength, buffer))
{
if (count)
{
do
{
PCWSTR packageFullName = *packageFullNames++;
DbgPrint("%S\n", packageFullName);
WCHAR path[MAX_PATH];
UINT32 len = RTL_NUMBER_OF(path);
if (NOERROR == GetStagedPackagePathByFullName(packageFullName, &len, path))
{
DbgPrint("%S\n", path);
}
} while (--count);
}
}
}
AppContainerFreeMemory(packageFamilyName);
}
}
}
}
for sid S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708
i got:
microsoft.windows.shellexperiencehost_cw5n1h2txyewy
Microsoft.Windows.ShellExperienceHost_10.0.14393.0_neutral_neutral_cw5n1h2txyewy
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy