From ea0dc9a2b8c51c1f861b0174d61fa1fb2aaf5be6 Mon Sep 17 00:00:00 2001 From: Matt Graeber Date: Sun, 12 May 2013 10:27:15 -0400 Subject: Added Get-NtSystemInformation Get-NtSystemInformation is a wrapper function for NtQuerySystemInformation. It is a swiss-army knife tool for obtaining internal OS information. It can currently be used to query the following: global flags, handles, objects, kernel pool allocations, and loaded kernel modules --- .../Get-NtSystemInformation.format.ps1xml | 334 +++++++++++++++++++++ 1 file changed, 334 insertions(+) create mode 100644 ReverseEngineering/Get-NtSystemInformation.format.ps1xml (limited to 'ReverseEngineering/Get-NtSystemInformation.format.ps1xml') diff --git a/ReverseEngineering/Get-NtSystemInformation.format.ps1xml b/ReverseEngineering/Get-NtSystemInformation.format.ps1xml new file mode 100644 index 0000000..5719d67 --- /dev/null +++ b/ReverseEngineering/Get-NtSystemInformation.format.ps1xml @@ -0,0 +1,334 @@ + + + + + SystemModuleView + + _SYSTEM_MODULE + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + "0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))" + + + ImageSize + 0x{0:X8} + + + Flags + 0x{0:X8} + + + Index + 0x{0:X4} + + + Rank + 0x{0:X4} + + + LoadCount + 0x{0:X4} + + + NameOffset + 0x{0:X4} + + + $_.Name -replace '\\SystemRoot', $Env:SystemRoot + + + + + + + + PoolTagView + + _SYSTEM_POOL_TAG_INFORMATION + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Tag + + + PagedPoolAllocs + 0x{0:X8} + + + PagedPoolFrees + 0x{0:X8} + + + PagedPoolUsage + 0x{0:X8} + + + NonPagedPoolAllocs + 0x{0:X8} + + + NonPagedPoolFrees + 0x{0:X8} + + + NonPagedPoolUsage + 0x{0:X8} + + + + + + + + SystemHandleView + + _SYSTEM_HANDLE_INFORMATION + + + + + + + UniqueProcessId + 0x{0:X4} + + + CreatorBackTraceIndex + 0x{0:X4} + + + ObjectTypeIndex + 0x{0:X2} + + + HandleAttribute + + + HandleValue + 0x{0:X4} + + + + "0x$($_.Object.ToString("X$([IntPtr]::Size * 2)"))" + + + GrantedAccess + + + + + + + + GenericMappingView + + _GENERIC_MAPPING + + + + + + + + + + + + + + + + + + + + + + GenericRead + 0x{0:X8} + + + GenericWrite + 0x{0:X8} + + + GenericExecute + 0x{0:X8} + + + GenericAll + 0x{0:X8} + + + + + + + + ObjectTypeView + + _SYSTEM_OBJECTTYPE_INFORMATION + + + + + + + NumberOfObjects + 0x{0:X8} + + + NumberOfHandles + 0x{0:X8} + + + TypeIndex + 0x{0:X8} + + + InvalidAttributes + + + GenericMapping + + + ValidAccessMask + + + PoolType + + + SecurityRequired + 0x{0:X2} + + + WaitableObject + 0x{0:X2} + + + TypeName + + + Objects + + + + + + + + ObjectView + + _SYSTEM_OBJECT_INFORMATION + + + + + + + + "0x$($_.Object.ToString("X$([IntPtr]::Size * 2)"))" + + + + "0x$($_.CreatorUniqueProcess.ToString("X$([IntPtr]::Size * 2)"))" + + + CreatorBackTraceIndex + 0x{0:X4} + + + Flags + + + PointerCount + 0x{0:X8} + + + HandleCount + 0x{0:X8} + + + PagedPoolCharge + 0x{0:X8} + + + NonPagedPoolCharge + 0x{0:X8} + + + + "0x$($_.ExclusiveProcessId.ToString("X$([IntPtr]::Size * 2)"))" + + + + "0x$($_.SecurityDescriptor.ToString("X$([IntPtr]::Size * 2)"))" + + + NameInfo + + + + + + + + \ No newline at end of file -- cgit v1.2.3