Struct WindowsToken 

pub struct WindowsToken<'a, Driver>
where
    Driver: VmiRead,
    Driver::Architecture: ArchAdapter<Driver>,
{ /* private fields */ }

A Windows access token.

An access token records a security principal’s identity and the privileges the kernel grants to it. Every process holds a primary token. Threads may carry an impersonation token that overrides the process token for the duration of an impersonation.

Implementation Details

Corresponds to _TOKEN.

Implementations

impl<'a, Driver> WindowsToken<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

pub fn new(vmi: VmiState<'a, WindowsOs<Driver>>, va: Va) -> Self

Creates a new Windows token object.

pub fn session_id(&self) -> Result<u32, VmiError>

Returns the Terminal Services session ID.

Implementation Details

Corresponds to _TOKEN.SessionId.

pub fn token_source(&self) -> WindowsTokenSource<'a, Driver>

Returns an accessor for the token source.

Implementation Details

Corresponds to _TOKEN.TokenSource.

pub fn authentication_id(&self) -> Result<WindowsLuid, VmiError>

Returns the authentication LUID identifying the logon session.

Implementation Details

Corresponds to _TOKEN.AuthenticationId.

pub fn token_id(&self) -> Result<WindowsLuid, VmiError>

Returns the token’s own identifier.

Implementation Details

Corresponds to _TOKEN.TokenId.

pub fn parent_token_id(&self) -> Result<WindowsLuid, VmiError>

Returns the parent token identifier, or zero for tokens minted from scratch.

Implementation Details

Corresponds to _TOKEN.ParentTokenId.

pub fn modified_id(&self) -> Result<WindowsLuid, VmiError>

Returns the modified-token identifier.

Implementation Details

Corresponds to _TOKEN.ModifiedId.

pub fn originating_logon_session(&self) -> Result<WindowsLuid, VmiError>

Returns the originating logon-session LUID.

Implementation Details

Corresponds to _TOKEN.OriginatingLogonSession.

pub fn token_type(&self) -> Result<WindowsTokenType, VmiError>

Returns the token type discriminator.

Implementation Details

Corresponds to _TOKEN.TokenType.

pub fn impersonation_level(&self) -> Result<WindowsImpersonationLevel, VmiError>

Returns the impersonation level.

Implementation Details

Corresponds to _TOKEN.ImpersonationLevel.

pub fn token_flags(&self) -> Result<WindowsTokenFlags, VmiError>

Returns the token flags.

Implementation Details

Corresponds to _TOKEN.TokenFlags.

pub fn token_in_use(&self) -> Result<bool, VmiError>

Returns whether the token is currently in use.

Only meaningful for primary tokens. Impersonation tokens leave the field clear.

Implementation Details

Corresponds to _TOKEN.TokenInUse.

pub fn user_and_group_count(&self) -> Result<u32, VmiError>

Returns the number of entries in UserAndGroups. The first entry is the user SID, the rest are group SIDs.

Implementation Details

Corresponds to _TOKEN.UserAndGroupCount.

pub fn restricted_sid_count(&self) -> Result<u32, VmiError>

Returns the number of entries in RestrictedSids.

Implementation Details

Corresponds to _TOKEN.RestrictedSidCount.

pub fn primary_group(&self) -> Result<WindowsSid<'a, Driver>, VmiError>

Returns the primary group SID.

Implementation Details

Corresponds to _TOKEN.PrimaryGroup.

pub fn user_and_groups( &self, ) -> Result<impl Iterator<Item = Result<WindowsSidAndAttributes<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Returns an iterator over the token’s user SID followed by every group SID. The first entry is always the user, the rest are groups.

Implementation Details

Walks _TOKEN.UserAndGroups.

pub fn restricted_sids( &self, ) -> Result<impl Iterator<Item = Result<WindowsSidAndAttributes<'a, Driver>, VmiError>> + use<'a, Driver>, VmiError>

Returns an iterator over the token’s restricted SIDs. Empty when the token is not a restricted token.

Implementation Details

Walks _TOKEN.RestrictedSids.

pub fn privileges_present(&self) -> Result<u64, VmiError>

Returns the _SEP_TOKEN_PRIVILEGES.Present bitmap. Each set bit is a privilege whose LUID LowPart equals the bit position.

Implementation Details

Corresponds to _TOKEN.Privileges.Present.

pub fn privileges_enabled(&self) -> Result<u64, VmiError>

Returns the _SEP_TOKEN_PRIVILEGES.Enabled bitmap.

Implementation Details

Corresponds to _TOKEN.Privileges.Enabled.

pub fn privileges_enabled_by_default(&self) -> Result<u64, VmiError>

Returns the _SEP_TOKEN_PRIVILEGES.EnabledByDefault bitmap.

Implementation Details

Corresponds to _TOKEN.Privileges.EnabledByDefault.

pub fn privileges( &self, ) -> Result<impl Iterator<Item = WindowsTokenPrivilege>, VmiError>

Returns an iterator over privileges present in this token.

Trait Implementations

impl<'a, Driver> From<WindowsToken<'a, Driver>> for WindowsObject<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from(value: WindowsToken<'a, Driver>) -> Self

Converts to this type from the input type.

impl<'a, Driver> FromWindowsObject<'a, Driver> for WindowsToken<'a, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn from_object( object: WindowsObject<'a, Driver>, ) -> Result<Option<Self>, VmiError>

Attempts to convert a WindowsObject into a specific object type.

impl<Driver> VmiVa for WindowsToken<'_, Driver>

where Driver: VmiRead, Driver::Architecture: ArchAdapter<Driver>,

fn va(&self) -> Va

Returns the virtual address.