Skip to content

Latest commit

 

History

History
6 lines (4 loc) · 582 Bytes

File metadata and controls

6 lines (4 loc) · 582 Bytes

Process Handle Inspector

This is a small proof of concept program that prints the permissions associated with a process handle.

How It Works

A handle to the target process is opened (currently lsass.exe) via the OpenProcess WinAPI. The obtained handle is then passed to the NtQueryObject API, which returns an objectInfo struct that contains the GrantedAccess field. This field is a bit mask where each bit represnts a permission listed in the official documentation.