XFEEDToolBox

param([Parameter(Mandatory=$true)][int[]]$TargetProcessIds)
$ErrorActionPreference='Stop'
Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;
using System.Text;
public static class LimitedIntegrityProbe {
 [DllImport("kernel32.dll",SetLastError=true)] static extern IntPtr OpenProcess(uint access,bool inherit,int pid);
 [DllImport("kernel32.dll",SetLastError=true,CharSet=CharSet.Unicode)] static extern bool QueryFullProcessImageName(IntPtr process,uint flags,StringBuilder path,ref uint length);
 [DllImport("advapi32.dll",SetLastError=true)] static extern bool OpenProcessToken(IntPtr process,uint access,out IntPtr token);
 [DllImport("advapi32.dll",SetLastError=true)] static extern bool GetTokenInformation(IntPtr token,int kind,IntPtr data,uint length,out uint needed);
 [DllImport("advapi32.dll")] static extern IntPtr GetSidSubAuthorityCount(IntPtr sid);
 [DllImport("advapi32.dll")] static extern IntPtr GetSidSubAuthority(IntPtr sid,uint index);
 [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
 public static object Read(int pid) {
  var p=OpenProcess(0x1000,false,pid);if(p==IntPtr.Zero)return new {pid,error=Marshal.GetLastWin32Error()};
  try {var path=new StringBuilder(32768);uint length=32768;var found=QueryFullProcessImageName(p,0,path,ref length);IntPtr t;
   if(!OpenProcessToken(p,8,out t))return new{pid,path=found?path.ToString():"",tokenError=Marshal.GetLastWin32Error()};
   try {uint needed;GetTokenInformation(t,25,IntPtr.Zero,0,out needed);if(needed<16||needed>4096)throw new InvalidOperationException("Unexpected integrity buffer size");var data=Marshal.AllocHGlobal((int)needed);
    try{if(!GetTokenInformation(t,25,data,needed,out needed))return new{pid,error=Marshal.GetLastWin32Error()};var sid=Marshal.ReadIntPtr(data);var count=Marshal.ReadByte(GetSidSubAuthorityCount(sid));if(count==0)throw new InvalidOperationException("Invalid integrity SID");return new{pid,path=found?path.ToString():"",integrityRid=Marshal.ReadInt32(GetSidSubAuthority(sid,(uint)count-1))};}
    finally{Marshal.FreeHGlobal(data);} }finally{CloseHandle(t);} }finally{CloseHandle(p);} }
}
'@
@($PID)+$TargetProcessIds | Select-Object -Unique | ForEach-Object { [LimitedIntegrityProbe]::Read($_) } | ConvertTo-Json -Depth 4