I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.

Example output of !token 0xaddress command user_infor_output

According to this site token has the EX_FAST_REF structure which has a definition like this:

typedef struct EX_FAST_REF {
       union {
              PVOID Object;
              ULONG RefCnt : 3;
              ULONG Value;

Object field points to the address of the token, the Value field holds the fist 4 bytes from the token address. I could not find the info I need from these fields but when I investigate the token address a little bit I am beginning to see strings like uid. What is the type of structure windbg uses to get all of this information? (Both debugger and debuggee have 32 bit architecture).



This Token you've used, the link, is not the Token structure you're searching for. This is the structure https://www.nirsoft.net/kernel_struct/vista/TOKEN.html

  • I am marking this as an accepted answer. Since it answered my question. But when I try to place all of the needed structures by TOKEN structure compiler gives a syntax error(Code 2061). Is there a library where all of these structures are predefined? Nov 21 '17 at 16:39
  • The definition of structures on OS version based. It's different from Win7 to Win10 to x86 to x64... Unfortunately the moonsols which was provided by Microsoft is not available anymore. There you could find the exact structure based on the version.
    – EWD-0-
    Nov 22 '17 at 9:15
  • @EWD-0- You can use vergiliusproject.com as alternative to moonsols. It contains kernel structures from WinXP to Win10. Jan 10 '19 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.