mirror of
https://github.com/yardenshafir/WinDbg_Scripts
synced 2026-06-08 18:28:57 +00:00
yardenshafir
4 lines
445 B
Plaintext
4 lines
445 B
Plaintext
dx @$getTokenTrustLabelSidForProcess = (p => ((nt!_TOKEN*)(p.KernelObject.Token.Object & ~0xf))->TrustLevelSid)
|
|
dx @$parseSid = (s => Debugger.Utility.Control.ExecuteCommand("!sid " + ((__int64)s).ToDisplayString("x"))[0])
|
|
dx -g @$cursession.Processes.Select(p => new {Name = p.Name, TrustLevelSid = @$getTokenTrustLabelSidForProcess(p)}).Where(p => p.TrustLevelSid).Select(p => new {Name = p.Name, TrustLevelSid = @$parseSid(p.TrustLevelSid)})
|