Updated to v1.1.11

Author: James Forshaw

NtApiDotNet/NtApiDotNet.Core.csproj

@@ -7,7 +7,7 @@
     <Authors>James Forshaw</Authors>
     <Company>Google Inc.</Company>
     <Product>NtApiDotNet</Product>
-    <FileVersion>1.1.10.0</FileVersion>
+    <FileVersion>1.1.11.0</FileVersion>
     <Copyright>Copyright © Google Inc. 2016, 2017, 2018</Copyright>
     <AssemblyVersion>1.0.0.0</AssemblyVersion>
     <PackageLicenseUrl>https://www.apache.org/licenses/LICENSE-2.0</PackageLicenseUrl>

NtApiDotNet/NtApiDotNet.nuspec

@@ -11,6 +11,17 @@
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <description>A .NET class library to access native NT API system calls</description>
     <releaseNotes>
+1.1.11
+------
+* Improved New-NtToken including adding missing IL
+* Added new NTSTATUS codes from 1709
+* Changes to native process creation
+* Added OverrideChildProcessCreation for Win32 process
+* Added display of process trust labels from tokens.
+* Fixed IsChildProcessRestricted on 1709 and above (changed structure)
+* Fixed named pipe server in TokenViewer
+* Added -All parameter to Show-NtToken to display list of tokens.
+
 1.1.10
 ------
 * Added support for extended handle information to allow for PIDs > 64k.

NtApiDotNet/Properties/AssemblyInfo.cs

@@ -33,5 +33,5 @@
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
 [assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.1.10.0")]
-[assembly: AssemblyInformationalVersion("1.1.10")]
+[assembly: AssemblyFileVersion("1.1.11.0")]
+[assembly: AssemblyInformationalVersion("1.1.11")]

NtObjectManager/NtObjectManager.Core.csproj

@@ -7,7 +7,7 @@
     <Authors>James Forshaw</Authors>
     <Company>Google Inc.</Company>
     <Product>NtObjectManager</Product>
-    <FileVersion>1.1.10.0</FileVersion>
+    <FileVersion>1.1.11.0</FileVersion>
     <Copyright>Copyright © Google Inc. 2016, 2017, 2018</Copyright>
     <AssemblyVersion>1.0.0.0</AssemblyVersion>
     <PackageLicenseUrl>https://www.apache.org/licenses/LICENSE-2.0</PackageLicenseUrl>

NtObjectManager/NtObjectManager.psd1

@@ -18,7 +18,7 @@
 RootModule = 'NtObjectManager.psm1'
 
 # Version number of this module.
-ModuleVersion = '1.1.10'
+ModuleVersion = '1.1.11'
 
 # Supported PSEditions
 # CompatiblePSEditions = @()
@@ -94,7 +94,17 @@ PrivateData = @{
         ProjectUri = 'https://github.com/google/sandbox-attacksurface-analysis-tools'
 
         # ReleaseNotes of this module
-        ReleaseNotes = '1.1.10
+        ReleaseNotes = '1.1.11
+------
+* Improved New-NtToken including adding missing IL
+* Added new NTSTATUS codes from 1709
+* Changes to native process creation
+* Added OverrideChildProcessCreation for Win32 process
+* Added display of process trust labels from tokens.
+* Fixed IsChildProcessRestricted on 1709 and above (changed structure)
+* Fixed named pipe server in TokenViewer
+* Added -All parameter to Show-NtToken to display list of tokens.
+1.1.10
 ------
 * Added support for extended handle information to allow for PIDs > 64k.
 * Added basic New-NtToken cmdlet and system call.

NtObjectManager/Properties/AssemblyInfo.cs

@@ -33,5 +33,5 @@
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
 [assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.1.10.0")]
-[assembly: AssemblyInformationalVersion("1.1.10")]
+[assembly: AssemblyFileVersion("1.1.11.0")]
+[assembly: AssemblyInformationalVersion("1.1.11")]

README.txt

@@ -1,6 +1,6 @@
 sandbox-attacksurface-analysis-tools
 
-(c) Google Inc. 2015, 2016, 2017
+(c) Google Inc. 2015, 2016, 2017, 2018
 Developed by James Forshaw
 
 This is a small suite of tools to test various properties of sandboxes on Windows. Many of the checking
@@ -21,6 +21,17 @@ with .NET Core 2.0 by building the specific project files.
 
 Release Notes:
 
+1.1.11
+------
+* Improved New-NtToken including adding missing IL
+* Added new NTSTATUS codes from 1709
+* Changes to native process creation
+* Added OverrideChildProcessCreation for Win32 process
+* Added display of process trust labels from tokens.
+* Fixed IsChildProcessRestricted on 1709 and above (changed structure)
+* Fixed named pipe server in TokenViewer
+* Added -All parameter to Show-NtToken to display list of tokens.
+
 1.1.10
 ------
 * Added support for extended handle information to allow for PIDs > 64k.