Conditional ACE Bytecode Reference

This section specifies the binary encoding for conditional ACE expressions. The format is byte-compatible with MS-DTYP section 2.4.4.17.4. Conditional expressions are stored in the ApplicationData member of CALLBACK ACE types, encoded in postfix (reverse Polish) notation.

§3.11.1 Magic signature #

A CALLBACK ACE contains a conditional expression if the ApplicationData begins with 0x61 0x72 0x74 0x78 (the string "artx"). If the signature is absent or the expression is shorter than 4 bytes, evaluation MUST return UNKNOWN.

§3.11.2 Token formats #

Each token begins with a single byte-code identifying the token type. All multibyte integers, including Unicode characters, are stored least-significant byte first (little-endian). Expressions end at the ACE boundary; any bytes needed for DWORD alignment MUST be set to 0x00.

§3.11.3 Literal tokens #

§3.11.3.1 Sign codes #

Integer literals include a sign byte after the QWORD value:

§3.11.3.2 Base codes #

Integer literals include a base byte after the sign byte. The base is for display purposes only — the value is always stored as binary 2's complement regardless of base:

§3.11.3.3 Integer encoding example #

The decimal value -1 encoded as a signed int64:

0x04 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x02 0x02
 ^    ^-------- QWORD (2's complement) --------^  ^    ^
 |                                                 |    base=decimal
 byte-code=int64                                   sign=negative

§3.11.4 Relational operator tokens #

§3.11.4.1 Binary relational operators #

LHS is the second element on the stack, RHS is the top. If LHS and RHS are different types, the entire conditional expression evaluates to UNKNOWN — with the exception of INT64 and UINT64 which are promoted for comparison (see the Conditional ACEs section for promotion rules). If either operand is UNKNOWN, the operation returns UNKNOWN.

String and octet string comparisons are byte-by-byte, case-insensitive by default. If the CLAIM_SECURITY_ATTRIBUTE_VALUE_CASE_SENSITIVE flag (0x0002) is set on either operand's attribute, comparison is case-sensitive.

§3.11.4.2 Unary relational operators (SID membership) #

The operand is the top of the stack and MUST be a SID literal or a composite of SID literals.

For an empty SID operand set:

• Member_of({}) and Device_Member_of({}) return TRUE (vacuous truth).
• Member_of_Any({}) and Device_Member_of_Any({}) return FALSE.
• The Not_* forms are the logical inverse of those results.

§3.11.5 Logical operator tokens #

Logical operators test the logical value of operands and produce TRUE, FALSE, or UNKNOWN. The logical value of an operand is determined by:

• Literal-origin value → error (entire expression returns UNKNOWN)
• Attribute with null value → UNKNOWN
• Attribute with integer value → TRUE if nonzero, FALSE if zero
• Attribute with string value → TRUE if non-empty, FALSE if empty
• Result value → the result's tri-state value

§3.11.5.1 Unary logical operators #

§3.11.5.2 Binary logical operators #

LHS is the second element on the stack, RHS is the top.

§3.11.6 Attribute reference tokens #

Attribute names are encoded as Unicode strings (same format as the 0x10 literal: DWORD length + UTF-16LE code units). The byte-code determines which namespace to look up the attribute in.

Attribute lookup is case-insensitive: the encoded name is matched against the namespace's attribute names without regard to case.

§3.11.7 Complete byte-code summary #

For quick reference, all byte-codes in numeric order: