			TokenInfor 1.2.8 ʹ˵
						---bingle@email.com.cn
:
1. ˵
2. ʹ
3. Ŀǰڵ
4. ¼
5. Ϣ


1. ˵
-------------------------

    TokenInfor˿Բ鿴̵ķϸϢ⣬Բ鿴̵߳Ϣ
1.2pulist+whoamiǿwhoamiһѡҪ鿴ƵЩϢҲpulist
һгн̵ûϢгĳ̵̵߳Ϣ

    Windows NT4resource kitиƵĹpview(Process Explode)windows 2000Ժ
汾вܻ߳Ϣ΢Ҳûߣwin2000reskitҲûС

ƽ̨Windows NT4 / Windows 2000 / Windows xp / Windows 2003


2. ʹ
-------------------------
TokenInfor 1.2 Show Token Information of Specify Process or Thread.

Usage : tinfor [Target] [Options]
[Target]:
  -p       -- ʾϵͳн̵ƼҪϢ
  PID      -- ҪʾĽID, ȱʡǵǰ
  PNAME    -- ҪʾĽ, ֧Ӵƥ
  -t       -- ʾ̵ָ߳, ָPIDʹõǰ
  -t tid   -- ָʾ̶̵߳, ָ
  -t #tNO  -- ָʾ̵ĵڼ߳,  ָPIDʹõǰ

[Options]:
  -USER    -- ʾƵ USER Ϣ, ָѡʱȱʡ
  -GROUP   -- ʾƵ GROUPs Ϣ
  -PRIV    -- ʾƵ PRIVileges Ϣ
  -ACL     -- ʾƵ DACL Ϣ
  -STAT    -- ʾƵ STAT/STATistics Ϣ(״̬/ͳϢ)
  -ALL     -- ʾƵϢ

  -?       -- ݰ

Example:
  tinfor -t 111,       ʾ߳tid=111ûϢ
  tinfor 8 -t #1 -ALL, ʾpid=8ĵ1̵߳Ϣ
  tinfor cmd -acl,     ʾ*cmd*̵̵߳ACLϢ

ûָIDͲѯǰ̣ҲкtinforԼˡ


ʹ÷£
D:\>tinfor.exe -?
TokenInfor 1.2 Show Token Information of Specify Process or Thread.
  By bingle@email.com.cn
  Welcome to http://www.BingleSite.net

Usage : tinfor [Target] [Options]
[Target]:
  -p       -- show all running Processes
  PID      -- Process ID to shown, use current process by default
  PNAME    -- Process Name to shown
  -t tid   -- Thread ID to shown
  -t #tNO  -- Thread Index of the process to shown

[Options]:
  -USER    -- show USER information of token. default if no options provide
  -GROUP   -- show GROUPs information of token.
  -PRIV    -- show PRIVileges information of token.
  -ACL     -- show DACL information of token.
  -STAT    -- show STAT/STATistics information of token.
  -ALL     -- Show above all token information.

  -?       -- show this.

Example:
  tinfor -t 111,       ʾ߳tid=111ûϢ
  tinfor 8 -t #1 -ALL, ʾpid=8ĵ1̵߳Ϣ
  tinfor cmd -acl,     ʾ*cmd*̵̵߳ACLϢ


D:\>tinfor
Token Information of Process ID = 916.

Owner : BUILTIN\Administrators  S-1-5-32-544
User  : BIGNLE\administrator  S-1-5-21-1390067357-706699826-842925246-500

D:\>tinfor -p

Impersonate As System OK.  Run As SYSTEM

 PID TNUM Name                     OWNER                    USER
   8  40 System           BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 164   6 smss.exe         BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 192  12 csrss.exe        BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 212  18 winlogon.exe     BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 240  31 services.exe     BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 252  16 lsass.exe        BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 492  12 svchost.exe      BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 536  28 svchost.exe      BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 832  24 Explorer.EXE     BUILTIN\Administrators   BINGLEPC\Administrator
1016   2 daemon.exe       BUILTIN\Administrators   BINGLEPC\Administrator
1040   1 internat.exe     BUILTIN\Administrators   BINGLEPC\Administrator
1084   2 cmd.exe          BUILTIN\Administrators   BINGLEPC\Administrator
 136   1 cmd.exe          BUILTIN\Administrators   NT AUTHORITY\SYSTEM
1140   5 taskmgr.exe      BUILTIN\Administrators   BINGLEPC\Administrator
 480   2 cmd.exe          BUILTIN\Administrators   BINGLEPC\Administrator
1024   2 cmd.exe          BINGLEPC\bingle   BINGLEPC\bingle
1624   1 tinfor.exe       BUILTIN\Administrators   BINGLEPC\Administrator

D:\>tinfor 8 -t

 TID  PID      OWNER                    USER
   4    8   No Token
  12    8   No Token
  16    8   No Token
  20    8   No Token
  24    8   No Token
  28    8   No Token
  32    8   No Token

D:\>tinfor c

Impersonate As System OK.  Run As SYSTEM

 PID TNUM Name                     OWNER                    USER
 192  12 csrss.exe        BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 240  31 services.exe     BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 492  12 svchost.exe      BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 536  28 svchost.exe      BUILTIN\Administrators   NT AUTHORITY\SYSTEM
1080   1 conime.exe       BUILTIN\Administrators   BINGLEPC\Administrator
1084   2 cmd.exe          BUILTIN\Administrators   BINGLEPC\Administrator
 136   1 cmd.exe          BUILTIN\Administrators   NT AUTHORITY\SYSTEM
 480   2 cmd.exe          BUILTIN\Administrators   BINGLEPC\Administrator
1024   2 cmd.exe          BINGLEPC\bingle   BINGLEPC\bingle

D:\>tinfor 480 -all

Token Information of Process ID = 480.

Owner : BUILTIN\Administrators  S-1-5-32-544
User  : BIGNLE\administrator  S-1-5-21-1390067357-706699826-842925246-500


Groups Count 9 (* Primary Group) :
  [* 0] "BIGNLE\None"        S-1-5-21-1390067357-706699826-842925246-513
  [  1] "\Everyone"      S-1-1-0
  [  2] "BIGNLE\Debugger Users"      S-1-5-21-1390067357-706699826-842925246-1000
  [  3] "BUILTIN\Administrators"         S-1-5-32-544
  [  4] "BUILTIN\Users"  S-1-5-32-545
  [  5] Get Name Error:1332      S-1-5-5-0-42243
  [  6] "\LOCAL"         S-1-2-0
  [  7] "NT AUTHORITY\INTERACTIVE"       S-1-5-4
  [  8] "NT AUTHORITY\Authenticated Users"       S-1-5-11

Restricted Sids 0 :
   (E:Enabled, L:Logon ID, M: Mandatory, O:Owner, R: Resource, D:Deny Only)

Privilege Count 20 (D:Disabled, E:Enabled, A:Used for Access) :
  [ 0  D] SeLockMemoryPrivilege          - ڴҳ
  [ 1  D] SeTcbPrivilege                 - Բϵͳʽ
  [ 2  D] SeAssignPrimaryTokenPrivilege  - 滻̼Ǻ
  [ 3 EE] SeChangeNotifyPrivilege        - 
  [ 4  D] SeIncreaseQuotaPrivilege       - 
  [ 5  D] SeSecurityPrivilege            - ˺Ͱȫ־
  [ 6  D] SeBackupPrivilege              - ļĿ¼
  [ 7  D] SeRestorePrivilege             - ԭļĿ¼
  [ 8  D] SeShutdownPrivilege            - رϵͳ
  [ 9  D] SeRemoteShutdownPrivilege      - Զϵͳǿƹػ
  [10  D] SeTakeOwnershipPrivilege       - ȡļȨ
  [11  E] SeDebugPrivilege               - Գ
  [12  D] SeSystemEnvironmentPrivilege   - ޸Ĺֵ̼
  [13  D] SeSystemProfilePrivilege       - ϵͳ
  [14  D] SeProfileSingleProcessPrivilege - õһ
  [15  D] SeIncreaseBasePriorityPrivilege - ӽȼ
  [16  E] SeLoadDriverPrivilege          - װغж豸
  [17  D] SeCreatePagefilePrivilege      - ҳļ
  [18  E] SeUndockPrivilege              - Ӳӹվȡ
  [19  D] SeSystemtimePrivilege          - ϵͳʱ

2 ACEs in Default Dacl:
  [ 0] ALL(0x10000000) for Alias BUILTIN\Administrators S-1-5-32-544
  [ 1] ALL(0x10000000) for User NT AUTHORITY\SYSTEM S-1-5-18

Session Id : 0
Token Source: User32
Source Id  : 0x0 0xB100
Authenticate Id : 0x0 0xB141
Expiration Time : 0x7FFFFFFF 0xFFFFFFFF
Dynamic Charged : 0x1F4
DynamicAvailable: 0x1A4
Modified Id: 0x0 0x280410
Token  Id  : 0x0 0x2803E6
Token Type : Primary Token

bingle@D:\>tinfor -priv

Enable Debug Priv failed, error: 1300
Cannot Impersonate As System. Some operation maybe denied. Run As bingle

Token Information of Process ID = 848.

Privilege Count 3 (D:Disabled, E:Enabled, A:Used for Access) :
  [ 0 EE] SeChangeNotifyPrivilege        - 
  [ 1  D] SeShutdownPrivilege            - رϵͳ
  [ 2  D] SeUndockPrivilege              - Ӳӹվȡ


bingle@D:\>tinfor -p

TokenInfor 1.2 Show Token Information of Specify Process or Thread.
  By bingle@email.com.cn
  Welcome to http://www.BingleSite.net

Enable Debug Priv failed, error: 1300
Cannot Impersonate As System. Some operation maybe denied. Run As bingle

 PID TNUM Name                     OWNER                    USER
Unable to open target Process ID=8. Error : 5
Unable to open target Process ID=164. Error : 5
Unable to open target Process ID=192. Error : 5
Unable to open target Process ID=212. Error : 5
Unable to open target Process ID=240. Error : 5
Unable to open target Process ID=252. Error : 5
Unable to open target Process ID=444. Error : 5
Unable to open target Process ID=468. Error : 5
Unable to open target Process ID=492. Error : 5
Unable to open target Process ID=536. Error : 5
Unable to open target Process ID=832. Error : 5
Unable to open target Process ID=1416. Error : 5
1576   1 cmd.exe          BINGLEPC\bingle   BINGLEPC\bingle
1384   1 tinfor.exe       BINGLEPC\bingle   BINGLEPC\bingle



3. Ŀǰڵ
-------------------------


4. ¼
-------------------------

1.2:
 - ֧߳
 - ֶ֧Զ̻̲߳ѯ
 - ˲ѯݵϸϢȨǷáACLϢȡ
 - ֧ѡѯ
 - ȡdll

1.1:
 - Ϊֹ֧ԱԲ鿴ͨụ̂һdll

1.0:
 - ʵֹԱԹԱ̺ϵͳ̵Ĳѯ


5. Ϣ
-------------------------

ļб
tinfor.exe 		--- tokenInfor 1.2 
tinfor1.2.txt	--- ʹü˵ļ


Autor: bingle
email: bingle@email.com.cn
web:   www.BingleSite.net

   κν뷢ʼ bingle@email.com.cn, лл


					bingle 2003-9
