是否有SYSTEM_HANDLE_ENTRY.ObjectType的可能值列表?
问题描述:
我正在编写一个列出打开的文件句柄的程序。其实我得到的结果太多了。我的列表包含病毒扫描程序之类的东西。我得到一堆对象类型43,看起来不像我想要的。有没有这些值的列表在任何地方?是否有SYSTEM_HANDLE_ENTRY.ObjectType的可能值列表?
答
您可以致电NtQueryObject
与指定ObjectTypesInformation
信息类。这会为您提供有关系统中当前注册的所有对象类型的信息。使用SYSTEM_HANDLE_ENTRY.ObjectType
作为返回数组的索引,以获取有关相应对象类型的信息。或者,您可以使用NtQueryObject
和ObjectTypeInformation
来获取有关给定对象(由其句柄指定)的类型信息。
此代码应检索所有类型的对象的信息。
typedef enum _OBJECT_INFORMATION_CLASS {
ObjectBasicInformation,
ObjectNameInformation,
ObjectTypeInformation,
ObjectTypesInformation,
ObjectHandleFlagInformation,
ObjectSessionInformation,
} OBJECT_INFORMATION_CLASS;
typedef struct _OBJECT_TYPE_INFORMATION {
UNICODE_STRING TypeName;
ULONG TotalNumberOfObjects;
ULONG TotalNumberOfHandles;
ULONG TotalPagedPoolUsage;
ULONG TotalNonPagedPoolUsage;
ULONG TotalNamePoolUsage;
ULONG TotalHandleTableUsage;
ULONG HighWaterNumberOfObjects;
ULONG HighWaterNumberOfHandles;
ULONG HighWaterPagedPoolUsage;
ULONG HighWaterNonPagedPoolUsage;
ULONG HighWaterNamePoolUsage;
ULONG HighWaterHandleTableUsage;
ULONG InvalidAttributes;
GENERIC_MAPPING GenericMapping;
ULONG ValidAccessMask;
BOOLEAN SecurityRequired;
BOOLEAN MaintainHandleCount;
ULONG PoolType;
ULONG DefaultPagedPoolCharge;
ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
typedef struct _OBJECT_TYPES_INFORMATION {
LONG NumberOfTypes;
// OBJECT_TYPE_INFORMATION TypeInformation [1];
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
NTSTATUS QueryObjectTypesInfo(POBJECT_TYPES_INFORMATION *TypesInfo)
{
ULONG StartBufferLength = 28;
ULONG BufferLength = 0;
NTSTATUS status = 0xC0000001;
status = STATUS_SUCCESS;
*TypesInfo = (POBJECT_TYPES_INFORMATION)malloc(StartBufferLength);
if (*TypesInfo != NULL) {
status = NtQueryObject(NULL, ObjectTypesInformation, TypesInfo, StartBufferLength, &BufferLength);
if (status == STATUS_INFO_LENGTH_MISMATCH) {
*TypesInfo = NULL;
while (status == STATUS_INFO_LENGTH_MISMATCH) {
if (*TypesInfo != NULL)
free(*TypesInfo);
*TypesInfo = (POBJECT_TYPES_INFORMATION)malloc(BufferLength);
if (*TypesInfo != NULL)
status = NtQueryObject(NULL, ObjectTypesInformation, *TypesInfo, BufferLength, &BufferLength);
else status = STATUS_INSUFFICIENT_RESOURCES;
}
if (!NT_SUCCESS(status)) {
if (*TypesInfo != NULL) {
free(*TypesInfo);
*TypesInfo = NULL;
}
}
}
} else status = STATUS_INSUFFICIENT_RESOURCES;
return status;
}
正如上面的评论所述,这个东西是相当无证的。然而,上面的代码(稍作修改..例如,你需要得到NtQueryObject
程序的地址,并定义一些NTSTATUS
contants)对我的作品在64位Windows 8.1。
对于一个完整的代码(这是很旧的和在捷克评论),从我的(捷克)网站上下载这个项目: https://jadro-windows.cz/download/ntqueryobject.zip
使用qo.exe --list-types
命令获取类型信息
这些都没有记录由MSFT。你的选择是为类型信息调用Nt/ZwQueryObject(),或者相信其他人对枚举的假设 - 例如。看看Process Hacker项目的源代码。 –