admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create TokenTrustLevel

Browse Source
This commit is contained in:
yardenshafir
2023-02-21 15:17:31 -05:00
committed by GitHub
parent 2be3dccd72
commit 50db3f6657
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TokenTrustLevel
+3
View File
@@ -0,0 +1,3 @@
dx @$getTokenTrustLabelSidForProcess = (p => ((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TrustLevelSid)
dx @$parseSid = (s => Debugger.Utility.Control.ExecuteCommand("!sid " + ((__int64)s).ToDisplayString("x"))[0])
dx -g @$cursession.Processes.Select(p => new {Name = p.Name, TrustLevelSid = @$getTokenTrustLabelSidForProcess(p)}).Where(p => p.TrustLevelSid).Select(p => new {Name = p.Name, TrustLevelSid = @$parseSid(p.TrustLevelSid)})