Перечислять ручки

Question

Перечислять ручки

Я пытаюсь перечислить все дескрипторы каждого процесса и хочу получить их имя, некоторые из них получаются безымянными. Как я могу это исправить? Когда я проверяю это с помощью хакера процесса или проводника процесса, они могут взять это безымянное имя дескриптора.

int wmain(int argc, WCHAR *argv[])

{_NtQuerySystemInformation NtQuerySystemInformation = GetLibraryProcAddress ("ntdll.dll", "NtQuerySystemInformation"); _NtDuplicateObject NtDuplicateObject = GetLibraryProcAddress ("ntdll.dll", "NtDuplicateObject"); _NtQueryObject NtQueryObject = GetLibraryProcAddress ("ntdll.dll", "NtQueryObject"); Статус NTSTATUS; PSYSTEM_HANDLE_INFORMATION handleInfo; ULONG handleInfoSize = 0x10000; ULONG pid; РУЧКА processHandle; УЛОНГ я;

if (argc < 2)
{
    printf("Usage: handles [pid]\n");
    return 1;
}

pid = _wtoi(argv[1]);

if (!(processHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid)))
{
    printf("Could not open PID %d! (Don't try to open a system process.)\n", pid);
    return 1;
}

handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);

/* NtQuerySystemInformation won't give us the correct buffer size, 
   so we guess by doubling the buffer size. */
while ((status = NtQuerySystemInformation(
    SystemHandleInformation,
    handleInfo,
    handleInfoSize,
    NULL
    )) == STATUS_INFO_LENGTH_MISMATCH)
    handleInfo = (PSYSTEM_HANDLE_INFORMATION)realloc(handleInfo, handleInfoSize *= 2);

/* NtQuerySystemInformation stopped giving us STATUS_INFO_LENGTH_MISMATCH. */
if (!NT_SUCCESS(status))
{
    printf("NtQuerySystemInformation failed!\n");
    return 1;
}

for (i = 0; i < handleInfo->HandleCount; i++)
{
    SYSTEM_HANDLE handle = handleInfo->Handles[i];
    HANDLE dupHandle = NULL;
    POBJECT_TYPE_INFORMATION objectTypeInfo;
    PVOID objectNameInfo;
    UNICODE_STRING objectName;
    ULONG returnLength;

    /* Check if this handle belongs to the PID the user specified. */
    if (handle.ProcessId != pid)
        continue;

    /* Duplicate the handle so we can query it. */
    if (!NT_SUCCESS(NtDuplicateObject(
        processHandle,
        handle.Handle,
        GetCurrentProcess(),
        &dupHandle,
        0,
        0,
        0
        )))
    {
        printf("[%#x] Error!\n", handle.Handle);
        continue;
    }

    /* Query the object type. */
    objectTypeInfo = (POBJECT_TYPE_INFORMATION)malloc(0x1000);
    if (!NT_SUCCESS(NtQueryObject(
        dupHandle,
        ObjectTypeInformation,
        objectTypeInfo,
        0x1000,
        NULL
        )))
    {
        printf("[%#x] Error!\n", handle.Handle);
        CloseHandle(dupHandle);
        continue;
    }

    /* Query the object name (unless it has an access of 
       0x0012019f, on which NtQueryObject could hang. */
    if (handle.GrantedAccess == 0x0012019f)
    {
        /* We have the type, so display that. */
        printf(
            "[%#x] %.*S: (did not get name)\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer
            );
        free(objectTypeInfo);
        CloseHandle(dupHandle);
        continue;
    }

    objectNameInfo = malloc(0x1000);
    if (!NT_SUCCESS(NtQueryObject(
        dupHandle,
        ObjectNameInformation,
        objectNameInfo,
        0x1000,
        &returnLength
        )))
    {
        /* Reallocate the buffer and try again. */
        objectNameInfo = realloc(objectNameInfo, returnLength);
        if (!NT_SUCCESS(NtQueryObject(
            dupHandle,
            ObjectNameInformation,
            objectNameInfo,
            returnLength,
            NULL
            )))
        {
            /* We have the type name, so just display that. */
            printf(
                "[%#x] %.*S: (could not get name)\n",
                handle.Handle,
                objectTypeInfo->Name.Length / 2,
                objectTypeInfo->Name.Buffer
                );
            free(objectTypeInfo);
            free(objectNameInfo);
            CloseHandle(dupHandle);
            continue;
        }
    }

    /* Cast our buffer into an UNICODE_STRING. */
    objectName = *(PUNICODE_STRING)objectNameInfo;

    /* Print the information! */
    if (objectName.Length)
    {
        /* The object has a name. */
        printf(
            "[%#x] %.*S: %.*S\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer,
            objectName.Length / 2,
            objectName.Buffer
            );
    }
    else
    {
        /* Print something else. */
        printf(
            "[%#x] %.*S: (unnamed)\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer
            );
    }

    free(objectTypeInfo);
    free(objectNameInfo);
    CloseHandle(dupHandle);
}

free(handleInfo);
CloseHandle(processHandle);

return 0;

}

0

process enumeration handle objectname

Источник

user7497607 23 сен '17 в 20:33

1 ответ

Другие вопросы по тегам process enumeration handle objectname

user7497607 25 сен '17 в 19:56 2017-09-25 19:56 · Answer 1 · 2017-09-25 19:56

{

    pid = _wtoi(argv[1]);

if (!(processHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid)))
{
    printf("Could not open PID %d! (Don't try to open a system process.)\n", pid);
    return 1;
}

handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);

/* NtQuerySystemInformation won't give us the correct buffer size, 
   so we guess by doubling the buffer size. */
while ((status = NtQuerySystemInformation(
    SystemHandleInformation,
    handleInfo,
    handleInfoSize,
    NULL
    )) == STATUS_INFO_LENGTH_MISMATCH)
    handleInfo = (PSYSTEM_HANDLE_INFORMATION)realloc(handleInfo, handleInfoSize *= 2);

/* NtQuerySystemInformation stopped giving us STATUS_INFO_LENGTH_MISMATCH. */
if (!NT_SUCCESS(status))
{
    printf("NtQuerySystemInformation failed!\n");
    return 1;
}

for (i = 0; i < handleInfo->HandleCount; i++)
{
    SYSTEM_HANDLE handle = handleInfo->Handles[i];
    HANDLE dupHandle = NULL;
    POBJECT_TYPE_INFORMATION objectTypeInfo;
    PVOID objectNameInfo;
    UNICODE_STRING objectName;
    ULONG returnLength;

    /* Check if this handle belongs to the PID the user specified. */
    if (handle.ProcessId != pid)
        continue;

    /* Duplicate the handle so we can query it. */
    if (!NT_SUCCESS(NtDuplicateObject(
        processHandle,
        handle.Handle,
        GetCurrentProcess(),
        &dupHandle,
        0,
        0,
        0
        )))
    {
        printf("[%#x] Error!\n", handle.Handle);
        continue;
    }

    /* Query the object type. */
    objectTypeInfo = (POBJECT_TYPE_INFORMATION)malloc(0x1000);
    if (!NT_SUCCESS(NtQueryObject(
        dupHandle,
        ObjectTypeInformation,
        objectTypeInfo,
        0x1000,
        NULL
        )))
    {
        printf("[%#x] Error!\n", handle.Handle);
        CloseHandle(dupHandle);
        continue;
    }

    /* Query the object name (unless it has an access of 
       0x0012019f, on which NtQueryObject could hang. */
    if (handle.GrantedAccess == 0x0012019f)
    {
        /* We have the type, so display that. */
        printf(
            "[%#x] %.*S: (did not get name)\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer
            );
        free(objectTypeInfo);
        CloseHandle(dupHandle);
        continue;
    }

    objectNameInfo = malloc(0x1000);
    if (!NT_SUCCESS(NtQueryObject(
        dupHandle,
        ObjectNameInformation,
        objectNameInfo,
        0x1000,
        &returnLength
        )))
    {
        /* Reallocate the buffer and try again. */
        objectNameInfo = realloc(objectNameInfo, returnLength);
        if (!NT_SUCCESS(NtQueryObject(
            dupHandle,
            ObjectNameInformation,
            objectNameInfo,
            returnLength,
            NULL
            )))
        {
            /* We have the type name, so just display that. */
            printf(
                "[%#x] %.*S: (could not get name)\n",
                handle.Handle,
                objectTypeInfo->Name.Length / 2,
                objectTypeInfo->Name.Buffer
                );
            free(objectTypeInfo);
            free(objectNameInfo);
            CloseHandle(dupHandle);
            continue;
        }
    }

    /* Cast our buffer into an UNICODE_STRING. */
    objectName = *(PUNICODE_STRING)objectNameInfo;

    /* Print the information! */
    if (objectName.Length)
    {
        /* The object has a name. */
        printf(
            "[%#x] %.*S: %.*S\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer,
            objectName.Length / 2,
            objectName.Buffer
            );
    }
    else
    {
        /* Print something else. */
        printf(
            "[%#x] %.*S: (unnamed)\n",
            handle.Handle,
            objectTypeInfo->Name.Length / 2,
            objectTypeInfo->Name.Buffer
            );
    }

    free(objectTypeInfo);
    free(objectNameInfo);
    CloseHandle(dupHandle);
}

free(handleInfo);
CloseHandle(processHandle);

return 0;
}