#include "ntddk.h"
#include <stdlib.h>
#include "LDasm.c"
#define EPROC_NAME_OFFSET 0x1FC
typedef struct _HANDLE_TABLE_ENTRY_INFO
{
ULONG AuditMask;
} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;
typedef struct _HANDLE_TABLE_ENTRY
{
union
{
PVOID Object;
ULONG ObAttributes;
PHANDLE_TABLE_ENTRY_INFO InfoTable;
ULONG Value;
};
union
{
union
{
ACCESS_MASK GrantedAccess;
struct
{
USHORT GrantedAccessIndex;
USHORT CreatorBackTraceIndex;
};
};
LONG NextFreeTableEntry;
};
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
typedef struct _HANDLE_TABLE
{
ULONG Flags;
LONG HandleCount;
PHANDLE_TABLE_ENTRY **Table;
PEPROCESS QuotaProcess;
HANDLE UniqueProcessId;
LONG FirstFreeTableEntry;
LONG NextIndexNeedingPool;
ERESOURCE HandleTableLock;
LIST_ENTRY HandleTableList;
KEVENT HandleContentionEvent;
} HANDLE_TABLE , *PHANDLE_TABLE ;
typedef NTSTATUS (__stdcall *EXENUMHANDLETABLE)(PULONG HandleTable, PVOID Callback, PVOID Param, PHANDLE Handle OPTIONAL);
NTSTATUS DriverEntry(PDRIVER_OBJECT pObj, PUNICODE_STRING pString);
VOID DriverUnload(PDRIVER_OBJECT pObj);
ULONG GetFunctionAddr(IN PCWSTR FunctionName);
BOOLEAN EnumHandleCallback(PHANDLE_TABLE_ENTRY HandleTableEntry,HANDLE Handle,PVOID EnumParameter);
NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);
PHANDLE_TABLE pPspCidTable = NULL;
EXENUMHANDLETABLE ExEnumHandleTable = NULL;
ULONG GetFunctionAddr(IN PCWSTR FunctionName)
{
UNICODE_STRING UniCodeFunctionName;
RtlInitUnicodeString( &UniCodeFunctionName, FunctionName );
return (ULONG)MmGetSystemRoutineAddress( &UniCodeFunctionName );
}
void GetPspCidTable()
{
PUCHAR cPtr;
unsigned char * pOpcode;
ULONG Length;
for (cPtr = (PUCHAR)PsLookupProcessByProcessId;
cPtr < (PUCHAR)PsLookupProcessByProcessId + PAGE_SIZE;
cPtr += Length)
{
Length = SizeOfCode(cPtr, &pOpcode);
if (!Length) break;
if (*(PUSHORT)cPtr == 0x35FF && *(pOpcode + 6) == 0xE8)
{
pPspCidTable = **(PVOID **)(pOpcode + 2);
break;
}
}
}
BOOLEAN EnumHandleCallback(PHANDLE_TABLE_ENTRY HandleTableEntry,HANDLE Handle,PVOID EnumParameter)
{
NTSTATUS ntStatus;
HANDLE Cid;
PEPROCESS Process;
PETHREAD Thread;
ULONG uWalkTableCount;
ULONG uWalkTablePage = 0;
if(EnumParameter== HandleTableEntry)
{
return TRUE;
}
else
{
for(uWalkTableCount=0;uWalkTableCount<0x100;uWalkTableCount++)
{
if(HandleTableEntry->Object)
{
Cid=(HANDLE)((1024*uWalkTablePage)+(uWalkTableCount<<2));
if (Cid> (PVOID)4)
{
ntStatus = PsLookupProcessByProcessId( Cid, &Process );
if(NT_SUCCESS(ntStatus))
{
DbgPrint("PID:%4d/tNAME:/t%-16s/n",
Cid, ((PUCHAR)Process+EPROC_NAME_OFFSET) );
ObDereferenceObject( Process );
}
}
else
{
if (Cid== 0)
{
DbgPrint("PID:%4d/tNAME:/tIdle/n",0);
}
else
{
DbgPrint("PID:%4d/tNAME:/tSystem/n",4);
}
}
}
}
uWalkTablePage++;
return FALSE;
}
}
VOID DriverUnload(PDRIVER_OBJECT pObj)
{
DbgPrint("Unloading now/r/n");
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath )
{
HANDLE h;
DbgPrint("Loading/r/n");
DriverObject->DriverUnload = DriverUnload;
ExEnumHandleTable = (EXENUMHANDLETABLE)GetFunctionAddr(L"ExEnumHandleTable");
if ( ExEnumHandleTable == NULL )
{
DbgPrint("Get ExEnumHandleTable Addr Error!!");
return STATUS_DEVICE_CONFIGURATION_ERROR;
}
DbgPrint("Address of ExEnumHandleTable:%x/n",ExEnumHandleTable);
GetPspCidTable();
DbgPrint("CidTable:%x/n",pPspCidTable);
ExEnumHandleTable(pPspCidTable, EnumHandleCallback, NULL, &h );
return STATUS_SUCCESS;
}