- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
- 91
- 92
- 93
- 94
- 95
- 96
- 97
- 98
- 99
DWORD getDirectoryIndex()
{
STATIC_OBJECT_ATTRIBUTES(oa, "\\");
HANDLE hFile;
DWORD ObjectTypeIndex = 0;
if (0 <= ZwOpenDirectoryObject(&hFile, DIRECTORY_QUERY, &oa))
{
NTSTATUS status;
PVOID buf = 0, stack = alloca(guz);
DWORD cb = 0, rcb = 0x10000;
do
{
if (cb < rcb) cb = RtlPointerToOffset(buf = alloca(rcb - cb), stack);
if (0 <= (status = ZwQuerySystemInformation(SystemExtendedHanfleInformation, buf, cb, &rcb)))
{
PSYSTEM_HANDLE_INFORMATION_EX pshti = (PSYSTEM_HANDLE_INFORMATION_EX)buf;
if (ULONG NumberOfHandles = (ULONG)pshti->NumberOfHandles)
{
PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles = pshti->Handles;
ULONG_PTR UniqueProcessId = GetCurrentProcessId();
do
{
if (Handles->UniqueProcessId == UniqueProcessId && Handles->HandleValue == (ULONG_PTR)hFile)
{
ObjectTypeIndex = Handles->ObjectTypeIndex;
break;
}
} while (Handles++, --NumberOfHandles);
}
}
} while (STATUS_INFO_LENGTH_MISMATCH == status);
ZwClose(hFile);
}
return ObjectTypeIndex;
}
ZOBJECT_ALL_TYPES_INFORMATION()
{
_TypeInformation = 0, _NumberOfTypes = 0;
if (DWORD DirectoryTypeIndex = getDirectoryIndex())
{
PVOID stack = alloca(guz);
OBJECT_ALL_TYPES_INFORMATION* poati = 0;
DWORD cb = 0, rcb = 0x2000;
NTSTATUS status;
do
{
if (cb < rcb)
{
cb = RtlPointerToOffset(poati = (OBJECT_ALL_TYPES_INFORMATION*)alloca(rcb - cb), stack);
}
if (0 <= (status = ZwQueryObject(0, ObjectAllTypeInformation, poati, cb, &rcb)))
{
if (DWORD NumberOfTypes = poati->NumberOfTypes)
{
if (OBJECT_TYPE_INFORMATION* TypeInformation = (OBJECT_TYPE_INFORMATION*)LocalAlloc(0, rcb))
{
_NumberOfTypes = NumberOfTypes;
_TypeInformation = TypeInformation;
STATIC_UNICODE_STRING_(Directory);
OBJECT_TYPE_INFORMATION* pti = poati->TypeInformation;
PWSTR buf = (PWSTR)(TypeInformation + NumberOfTypes);
int Index = 0;
do
{
if (RtlEqualUnicodeString(&Directory, &pti->TypeName, TRUE))
{
_firstObjectTypeIndex = DirectoryTypeIndex - Index;
}
DWORD Length = pti->TypeName.Length, MaximumLength = pti->TypeName.MaximumLength;
memcpy(buf, pti->TypeName.Buffer, Length);
*TypeInformation = *pti;
TypeInformation++->TypeName.Buffer = buf;
buf = (PWSTR)RtlOffsetToPointer(buf, Length);
pti = (OBJECT_TYPE_INFORMATION*)
(((ULONG_PTR)pti + sizeof(OBJECT_TYPE_INFORMATION) + MaximumLength + sizeof(PVOID)-1) & ~(sizeof(PVOID)-1));
} while (Index++, --NumberOfTypes);
}
}
}
} while (status == STATUS_INFO_LENGTH_MISMATCH);
}
}
Follow us!