TraceParserGen does NOT support field type "win:SID"

[gabiganam]

In Windows 10 Update 1903, the "Microsoft-Windows-Kernel-Process" manifest was updated, and a new type "win:SID" was introduced. This type is of variable length, it is a simple security identifier.

TraceParserGen has an internal "SkipSID" method, which is misleading, because it is actually a "SkipTokenUserAndSID", or "SkipWBEMSID".

A correct implementation of SkipSID is:

		internal int SkipSID(int offset)
		{
			// This is a Security Token.  Either it is null, which takes 4 bytes,
			// Otherwise it is an SID, which is variable size (sigh) depending on the 2nd byte in the SID
			int sid = GetInt32At(offset);
			if (sid == 0) return offset + 4;

			// 8 bytes for the SID (1 byte revision, 1 byte authorities count, 6 bytes identifier authority)
			int numAuthorities = GetByteAt(offset + 1); // Each authority is 4 bytes long
			return offset + 8 + 4 * numAuthorities;
		}

[github-actions[bot]]

Due to lack of recent activity, this issue has been labeled as 'stale'. It will be closed if no further activity occurs within 30 more days. Any new comment will remove the label.

[github-actions[bot]]

This issue will now be closed since it has been labeled 'stale' without activity for 30 days.

[brianrob]

Keeping this one alive - it can be fixed after we have a test bed for traceparsergen.