NtObjectManager

Author(s)

• James Forshaw

Tags

security defence offence sandbox

Cmdlets

Get-NtEvent New-NtEvent Get-NtProcess Get-NtSemaphore New-NtSemaphore Get-NtThread Get-NtTokenPrimary Get-NtTokenThread Get-NtTokenEffective Get-NtHandle Get-NtDirectory New-NtDirectory Get-NtFile New-NtFile Get-NtNamedPipeFile New-NtNamedPipeFile New-NtMailslotFile Get-NtFileReparsePoint Remove-NtFileReparsePoint Get-NtKey New-NtKey Add-NtKey Get-NtMutant New-NtMutant Get-NtObject New-NtSecurityDescriptor Use-NtObject Get-NtStatus Get-NtType Get-NtSymbolicLink Get-NtSymbolicLinkTarget New-NtSymbolicLink Start-NtWait

Dependencies

This module has no dependencies.

Release Notes

1.0.4
-----
* Support getting and setting file EA buffe
* Added cmdlet to get NTSTATUS code information
* Support to toggle UIAccess and Virtualization flags on tokens
* Added asynchronous support for file operations using Task APIs
* Added support for virtual memory functions
* Added cmdlet to create named pipes and mailslots.
* Added support for specifying SD as SDDL directly to cmdlets.
* Added thread descriptions for Anniversary edition and above.
1.0.3
-----
* Fixed small bug in handling of IO_STATUS_BLOCK which could result in memory corruption.
* Added support to list directory entries for a file directory.
* Added support to do basic read and writes to a file.
1.0.2
-----
* Added support to disable dynamic code policy on a process.
* Added cmdlets for reparse points.
* Fixes for EA buffer.
* Added service SIDs.
* Added support for removing token privileges.
* Fixed token security attribute parsing.
1.0.1
-----
* Fixed bug in Get-NtThread with -ProcessId
* Added support for FilterScript for Get-NtThread
* Added support for querying thread dynamic code opt-out policy
* Added support for RFG mitigation
1.0.0
-----
Initial release:
* NT Object Manager drive provider
* Cmdlets to directory work with Directorys, Files, Symbolic Links, Events, Semaphores, Processes, Threads, Tokens etc.