Hi folks .
I have been written a code for enumerating open handles in a system (process handle enumeration) && (of-course it's based on napalm code)
however, napalm code was a C++ code, & I converted it to C .
but there's some problems that is blind to me .
here's the code :
if anyone could guide at this case, it would be appreciated as always .
Thanks pals .
Genius
I have been written a code for enumerating open handles in a system (process handle enumeration) && (of-course it's based on napalm code)
however, napalm code was a C++ code, & I converted it to C .
but there's some problems that is blind to me .
here's the code :
Code: Select all
I have been cut the most part of the real code for revealing the problem, as I realized the problem is on dwSize & pHandleInfo, the binary could be done for me on the building phase but the code seems not working as well & has few problems.#define _WIN32_WINNT 0x0501
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <stdlib.h>
#include <tchar.h>
#include "ex.h"
#include <Shlwapi.h>
#include <Psapi.h>
#define OBJ_CASE_INSENSITIVE 0x00000040L
typedef struct _UUNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UUNICODE_STRING;
typedef VOID *POBJECT;
typedef UNICODE_STRING *PUNICODE_STRING;
typedef const UNICODE_STRING *PCUNICODE_STRING;
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#define STATUS_BUFFER_OVERFLOW ((NTSTATUS)0x80000005L)
typedef UUNICODE_STRING OBJECT_NAME_INFORMATION;
typedef UUNICODE_STRING *POBJECT_NAME_INFORMATION;
typedef struct _SYSTEM_HANDLE {
ULONG uIdProcess;
UCHAR ObjectType; // OB_TYPE_* (OB_TYPE_TYPE, etc.)
UCHAR Flags; // HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.)
USHORT Handle;
POBJECT pObject;
ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
typedef struct _SSYSTEM_HANDLE_INFORMATION {
ULONG uCount;
SYSTEM_HANDLE Handles[1];
} SSYSTEM_HANDLE_INFORMATION, *PSSYSTEM_HANDLE_INFORMATION;
NTSTATUS RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN Client)
{
NTSTATUS Status;
HANDLE Token;
LUID LuidPrivilege;
TOKEN_PRIVILEGES NewPrivileges, OldPrivileges;
ULONG Length;
if (Client)
Status = NtOpenThreadToken(NtCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &Token);
else
Status = NtOpenProcessToken(NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &Token);
if (STATUS_SUCCESS != Status) return Status;
LuidPrivilege.LowPart = Privilege;
LuidPrivilege.HighPart = 0;
NewPrivileges.PrivilegeCount = 1;
NewPrivileges.Privileges[0].Luid = LuidPrivilege;
if (Enable)
NewPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
NewPrivileges.Privileges[0].Attributes = 0;
Status = NtAdjustPrivilegesToken(Token, FALSE, &NewPrivileges, sizeof(TOKEN_PRIVILEGES), &OldPrivileges, &Length);
NtClose(Token);
if (Status == STATUS_NOT_ALL_ASSIGNED) return STATUS_PRIVILEGE_NOT_HELD;
return Status;
};
int __cdecl main(int argc, char **argv)
{
DWORD dwSize = sizeof(SSYSTEM_HANDLE_INFORMATION);
NTSTATUS NtStatus;
PSSYSTEM_HANDLE_INFORMATION pHandleInfo = (PSSYSTEM_HANDLE_INFORMATION)malloc(sizeof(dwSize));
if(RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE)==STATUS_SUCCESS){
printf("\nDebug Privilege ok ");
}
NtStatus = NtQuerySystemInformation(SystemHandleInformation, &pHandleInfo, dwSize, &dwSize);
if(NtStatus == STATUS_SUCCESS)
{
printf("\nNtQuery is ok ...");
}
else if(NtStatus == STATUS_INFO_LENGTH_MISMATCH){
printf("\nLength mismatch !");
pHandleInfo=NULL;
NtStatus = NtQuerySystemInformation(SystemHandleInformation, pHandleInfo, dwSize, &dwSize);
if(NtStatus == STATUS_SUCCESS){
printf(" Found %d Handles.\n\n", pHandleInfo->uCount);
}
}
_getch();
return 0;
}if anyone could guide at this case, it would be appreciated as always .
Thanks pals .
Genius
- Individuality
