Process description,user and publisher information in dump - windbg

Question

Is there a way to retrieve the process description and publisher from a Windows Kernel crash dump?
I tried !process and !dml_proc. It doesn't show that information.

Answer 1

Description sould be get from exe module.
Example:
0: kd> !PROCESS fffffa800482f940 2
GetPointerFromAddress: unable to read from fffff80397f65000
PROCESS fffffa800482f940
SessionId: 1 Cid: 0e3c Peb: 7f7cfefa000 ParentCid: 04bc
DirBase: 26bcc000 ObjectTable: fffff8a0028f4e80 HandleCount: <Data Not Accessible>
Image: Taskmgr.exe
0: kd> .process /p fffffa800482f940
Implicit process is now fffffa80`0482f940
0: kd> .reload /user
Loading User Symbols
..........................................................
0: kd> lmvm Taskmgr
Browse full module list
start end module name
000007f7`d08c0000 000007f7`d09da000 taskmgr (deferred)
Image path: C:\Windows\system32\taskmgr.exe
Image name: taskmgr.exe
Browse all global symbols functions data
Timestamp: Thu Jul 26 02:07:18 2012 (50107C26)
CheckSum: 00119B41
ImageSize: 0011A000
File version: 6.2.9200.16384
Product version: 6.2.9200.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: Taskmgr.exe
OriginalFilename: Taskmgr.exe
ProductVersion: 6.2.9200.16384
FileVersion: 6.2.9200.16384 (win8_rtm.120725-1247)
FileDescription: Task Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.

Answer 2

i was trying to edit and post clarification to pykd-teams answer but the edit turned out ot be substantial so posted this as an answer
FileDescription from lmvm output refers to description column in Task manager Details tab
Company Name Refers refers to publisher column in startup tab
C:\Windows\system32>wmic Startup where Caption="vmware user process" get /format:list
Caption=VMware User Process
Command="C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
Description=VMware User Process
Location=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name=VMware User Process
SettingID=
User=Public
UserSID=
C:\Windows\system32>reg query hklm\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
VMware User Process REG_SZ "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
you can check by modifiying the FILE_VERSION_INFO in rsrc section of any file that is executed in startup see below an edited publisher in windbg of the same exe as posted above
how to check for validity of the above assertion
open a live kd session
run task manager in target and select a startup
look at details and locate the process name say vmtoolsd.exe
break into kd using ctrl+break
!process 0 0 vmtoolsd.exe
.process /p /r EPROCESS ADDRESS OF vmtoolsd.exe
!dh vmtoolsd find the Data directory SECURITY DIRECTORY and start searching for FILE_VERSION_INFO
loacte the string value of Company Name
use eb Address to edit the Company Name to some random string
execute using g
now execute task manager and you will see the publisher column in startup tab reflecting the random string as publisher
username is not tied to file but to process grab the token
from !process <Eproc> 1 and pass the TOKEN value to !token -n
here is sample script to retrieve user names for each running process
!for_each_process "r $t0=(##c++(((_EPROCESS*) ##Process )->Token.Object)&0xfffffff8);r? $t1=##c++(((_TOKEN*)##(#$t0))->LogonSession->AccountName);r? $t2=##c++(((_EPROCESS *) ##Process )->ImageFileName);.printf \"%mu\t\t\t%ma\\n\",##c++((wchar_t *)#$t1.Buffer),##c++((char*)#$t2)"
should get your results like this
kd> $$>a< getuname4proc.txt
xx-PC$ smss.exe
LOCAL SERVICE svchost.exe
xx taskhost.exe

Answer 3

You can get this information and a lot more by using !ps command from DbgKit.
Note: From a Kernel Memory Dump you can only get User Name. To get User Name, File Description and Company Name you need a Complete Memory Dump.
Copy dbgkit.dll into winext folder (For example: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext)
Open a dump file in WinDbg
Run .load dbgkit command
Run !ps command (to view other commands run !dbgkit.help)