admin/yardenshafir-WinDbg_Scripts
1
0
Fork 0
mirror of https://github.com/yardenshafir/WinDbg_Scripts synced 2026-06-08 18:28:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create appcontainers.txt

Browse Source 
Print all processes running as appcontainers
This commit is contained in:
yardenshafir
2022-05-25 09:49:21 -04:00
committed by GitHub
parent 2fc6624795
commit c4b7a83938
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
appcontainers.txt
+3
View File
@@ -0,0 +1,3 @@
# Get all appcontainer processes (makred by Token.TokenFlags.LowBox (value == 0x4000)
dx -g @$appcontainers = @$cursession.Processes.Select(p => new {Name = p.Name, Id = p.Id, ProcessObj = p, TokenFlags = ((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TokenFlags}).Where(p => (p.TokenFlags & 0x4000) == 0x4000)