mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
Matt Graeber
02c982dd18
When displaying handle information, you can now filter by and display object type names: Get-NtSystemInformation
419 lines
21 KiB
XML
419 lines
21 KiB
XML
<?xml version="1.0" encoding="utf-8" ?>
|
|
<Configuration>
|
|
<ViewDefinitions>
|
|
<View>
|
|
<Name>SystemModuleView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_MODULE</TypeName>
|
|
</ViewSelectedBy>
|
|
<TableControl>
|
|
<AutoSize/>
|
|
<TableHeaders>
|
|
<TableColumnHeader>
|
|
<Label>ImageBaseAddress</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>ImageSize</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Flags</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Index</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Rank</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>LoadCount</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NameOffset</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Name</Label>
|
|
</TableColumnHeader>
|
|
</TableHeaders>
|
|
<TableRowEntries>
|
|
<TableRowEntry>
|
|
<TableColumnItems>
|
|
<TableColumnItem>
|
|
<ScriptBlock>"0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>ImageSize</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>Flags</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>Index</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>Rank</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>LoadCount</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NameOffset</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<ScriptBlock>$_.Name -replace '\\SystemRoot', $Env:SystemRoot</ScriptBlock>
|
|
</TableColumnItem>
|
|
</TableColumnItems>
|
|
</TableRowEntry>
|
|
</TableRowEntries>
|
|
</TableControl>
|
|
</View>
|
|
<View>
|
|
<Name>SystemLockView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_LOCK_INFORMATION</TypeName>
|
|
</ViewSelectedBy>
|
|
<TableControl>
|
|
<TableHeaders>
|
|
<TableColumnHeader>
|
|
<Label>Address</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Type</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>ExclusiveOwnerThreadId</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>ActiveCount</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>ContentionCount</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NumberOfSharedWaiters</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NumberOfExclusiveWaiters</Label>
|
|
</TableColumnHeader>
|
|
</TableHeaders>
|
|
<TableRowEntries>
|
|
<TableRowEntry>
|
|
<TableColumnItems>
|
|
<TableColumnItem>
|
|
<ScriptBlock>"0x$($_.Address.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>Type</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>ExclusiveOwnerThreadId</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>ActiveCount</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>ContentionCount</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NumberOfSharedWaiters</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NumberOfExclusiveWaiters</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
</TableColumnItems>
|
|
</TableRowEntry>
|
|
</TableRowEntries>
|
|
</TableControl>
|
|
</View>
|
|
<View>
|
|
<Name>PoolTagView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_POOL_TAG_INFORMATION</TypeName>
|
|
</ViewSelectedBy>
|
|
<TableControl>
|
|
<AutoSize/>
|
|
<TableHeaders>
|
|
<TableColumnHeader>
|
|
<Label>Tag</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>PagedPoolAllocs</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>PagedPoolFrees</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>PagedPoolUsage</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NonPagedPoolAllocs</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NonPagedPoolFrees</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>NonPagedPoolUsage</Label>
|
|
</TableColumnHeader>
|
|
</TableHeaders>
|
|
<TableRowEntries>
|
|
<TableRowEntry>
|
|
<TableColumnItems>
|
|
<TableColumnItem>
|
|
<PropertyName>Tag</PropertyName>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>PagedPoolAllocs</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>PagedPoolFrees</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>PagedPoolUsage</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NonPagedPoolAllocs</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NonPagedPoolFrees</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>NonPagedPoolUsage</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
</TableColumnItems>
|
|
</TableRowEntry>
|
|
</TableRowEntries>
|
|
</TableControl>
|
|
</View>
|
|
<View>
|
|
<Name>SystemHandleView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_HANDLE_INFORMATION</TypeName>
|
|
</ViewSelectedBy>
|
|
<TableControl>
|
|
<TableHeaders>
|
|
<TableColumnHeader>
|
|
<Label>UniqueProcessId</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>CreatorBackTraceIndex</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>ObjectType</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>HandleAttribute</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>HandleValue</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>Object</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>GrantedAccess</Label>
|
|
</TableColumnHeader>
|
|
</TableHeaders>
|
|
<TableRowEntries>
|
|
<TableRowEntry>
|
|
<TableColumnItems>
|
|
<TableColumnItem>
|
|
<PropertyName>UniqueProcessId</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>CreatorBackTraceIndex</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>ObjectType</PropertyName>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>HandleAttribute</PropertyName>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>HandleValue</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<ScriptBlock>"0x$($_.Object.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>GrantedAccess</PropertyName>
|
|
</TableColumnItem>
|
|
</TableColumnItems>
|
|
</TableRowEntry>
|
|
</TableRowEntries>
|
|
</TableControl>
|
|
</View>
|
|
<View>
|
|
<Name>GenericMappingView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_GENERIC_MAPPING</TypeName>
|
|
</ViewSelectedBy>
|
|
<TableControl>
|
|
<AutoSize/>
|
|
<TableHeaders>
|
|
<TableColumnHeader>
|
|
<Label>GenericRead</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>GenericWrite</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>GenericExecute</Label>
|
|
</TableColumnHeader>
|
|
<TableColumnHeader>
|
|
<Label>GenericAll</Label>
|
|
</TableColumnHeader>
|
|
</TableHeaders>
|
|
<TableRowEntries>
|
|
<TableRowEntry>
|
|
<TableColumnItems>
|
|
<TableColumnItem>
|
|
<PropertyName>GenericRead</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>GenericWrite</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>GenericExecute</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
<TableColumnItem>
|
|
<PropertyName>GenericAll</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</TableColumnItem>
|
|
</TableColumnItems>
|
|
</TableRowEntry>
|
|
</TableRowEntries>
|
|
</TableControl>
|
|
</View>
|
|
<View>
|
|
<Name>ObjectTypeView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_OBJECTTYPE_INFORMATION</TypeName>
|
|
</ViewSelectedBy>
|
|
<ListControl>
|
|
<ListEntries>
|
|
<ListEntry>
|
|
<ListItems>
|
|
<ListItem>
|
|
<PropertyName>NumberOfObjects</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>NumberOfHandles</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>TypeIndex</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>InvalidAttributes</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>GenericMapping</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>ValidAccessMask</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>PoolType</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>SecurityRequired</PropertyName>
|
|
<FormatString>0x{0:X2}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>WaitableObject</PropertyName>
|
|
<FormatString>0x{0:X2}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>TypeName</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>Objects</PropertyName>
|
|
</ListItem>
|
|
</ListItems>
|
|
</ListEntry>
|
|
</ListEntries>
|
|
</ListControl>
|
|
</View>
|
|
<View>
|
|
<Name>ObjectView</Name>
|
|
<ViewSelectedBy>
|
|
<TypeName>_SYSTEM_OBJECT_INFORMATION</TypeName>
|
|
</ViewSelectedBy>
|
|
<ListControl>
|
|
<ListEntries>
|
|
<ListEntry>
|
|
<ListItems>
|
|
<ListItem>
|
|
<Label>Object</Label>
|
|
<ScriptBlock>"0x$($_.Object.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</ListItem>
|
|
<ListItem>
|
|
<Label>CreatorUniqueProcess</Label>
|
|
<ScriptBlock>"0x$($_.CreatorUniqueProcess.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>CreatorBackTraceIndex</PropertyName>
|
|
<FormatString>0x{0:X4}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>Flags</PropertyName>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>PointerCount</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>HandleCount</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>PagedPoolCharge</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>NonPagedPoolCharge</PropertyName>
|
|
<FormatString>0x{0:X8}</FormatString>
|
|
</ListItem>
|
|
<ListItem>
|
|
<Label>ExclusiveProcessId</Label>
|
|
<ScriptBlock>"0x$($_.ExclusiveProcessId.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</ListItem>
|
|
<ListItem>
|
|
<Label>SecurityDescriptor</Label>
|
|
<ScriptBlock>"0x$($_.SecurityDescriptor.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
|
|
</ListItem>
|
|
<ListItem>
|
|
<PropertyName>NameInfo</PropertyName>
|
|
</ListItem>
|
|
</ListItems>
|
|
</ListEntry>
|
|
</ListEntries>
|
|
</ListControl>
|
|
</View>
|
|
</ViewDefinitions>
|
|
</Configuration> |