2

#include "ntddk.h"
#include <stdlib.h>
#include "LDasm.c"
#define EPROC_NAME_OFFSET 0x1FC

typedef struct _HANDLE_TABLE_ENTRY_INFO
{
 ULONG AuditMask;
} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;
typedef struct _HANDLE_TABLE_ENTRY
{
 union
 {
  PVOID Object;
  ULONG ObAttributes;
  PHANDLE_TABLE_ENTRY_INFO InfoTable;
  ULONG Value;
 };
 union
 {
  union
  {
   ACCESS_MASK GrantedAccess;
   struct
   {
    USHORT GrantedAccessIndex;
    USHORT CreatorBackTraceIndex;
   };
  };
  LONG NextFreeTableEntry;
 };
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
typedef struct _HANDLE_TABLE
{
 ULONG        Flags;
 LONG         HandleCount;
 PHANDLE_TABLE_ENTRY **Table;
 PEPROCESS       QuotaProcess;
 HANDLE        UniqueProcessId;
 LONG         FirstFreeTableEntry;
 LONG         NextIndexNeedingPool;
 ERESOURCE       HandleTableLock;
 LIST_ENTRY       HandleTableList;
 KEVENT        HandleContentionEvent;
} HANDLE_TABLE , *PHANDLE_TABLE ;
typedef NTSTATUS (__stdcall *EXENUMHANDLETABLE)(PULONG HandleTable, PVOID Callback, PVOID Param, PHANDLE Handle OPTIONAL);

NTSTATUS DriverEntry(PDRIVER_OBJECT pObj, PUNICODE_STRING pString);
VOID DriverUnload(PDRIVER_OBJECT pObj);
ULONG GetFunctionAddr(IN PCWSTR FunctionName);
BOOLEAN EnumHandleCallback(PHANDLE_TABLE_ENTRY HandleTableEntry,HANDLE Handle,PVOID EnumParameter);
NTSTATUS PsLookupProcessByProcessId(IN ULONG ulProcId, OUT PEPROCESS * pEProcess);

PHANDLE_TABLE pPspCidTable = NULL;
EXENUMHANDLETABLE ExEnumHandleTable = NULL;

ULONG GetFunctionAddr(IN PCWSTR FunctionName)
{
 UNICODE_STRING UniCodeFunctionName;
 RtlInitUnicodeString( &UniCodeFunctionName, FunctionName );
 return (ULONG)MmGetSystemRoutineAddress( &UniCodeFunctionName );
}
void GetPspCidTable()
{
 PUCHAR cPtr;
 unsigned char * pOpcode;
 ULONG Length;

 for (cPtr = (PUCHAR)PsLookupProcessByProcessId;
  cPtr < (PUCHAR)PsLookupProcessByProcessId + PAGE_SIZE;
  cPtr += Length)
 {
  Length = SizeOfCode(cPtr, &pOpcode);

  if (!Length) break;

  if (*(PUSHORT)cPtr == 0x35FF && *(pOpcode + 6) == 0xE8)
  {
   pPspCidTable = **(PVOID **)(pOpcode + 2);
   break;
  }
 }
}
BOOLEAN EnumHandleCallback(PHANDLE_TABLE_ENTRY HandleTableEntry,HANDLE Handle,PVOID EnumParameter)
{
 NTSTATUS    ntStatus;
 HANDLE      Cid;
 PEPROCESS   Process;
 PETHREAD    Thread;
 ULONG  uWalkTableCount;
 ULONG       uWalkTablePage = 0;
 if(EnumParameter== HandleTableEntry)
 {
  return TRUE;
 }
 else
 {    
  for(uWalkTableCount=0;uWalkTableCount<0x100;uWalkTableCount++)
  {
   if(HandleTableEntry->Object)
   {
    Cid=(HANDLE)((1024*uWalkTablePage)+(uWalkTableCount<<2));

    if (Cid> (PVOID)4)
    {
     ntStatus = PsLookupProcessByProcessId( Cid, &Process );
     if(NT_SUCCESS(ntStatus))
     {
      DbgPrint("PID:%4d/tNAME:/t%-16s/n",
       Cid, ((PUCHAR)Process+EPROC_NAME_OFFSET) );
      ObDereferenceObject( Process );
     }
    }
    else
    {
     if (Cid== 0)
     {
      DbgPrint("PID:%4d/tNAME:/tIdle/n",0);  
     }
     else
     {
      DbgPrint("PID:%4d/tNAME:/tSystem/n",4);  
     }
    }
   }
  }
  uWalkTablePage++;

  return FALSE;
 }
}
VOID DriverUnload(PDRIVER_OBJECT pObj)
{
 DbgPrint("Unloading now/r/n");
}
NTSTATUS DriverEntry( IN PDRIVER_OBJECT    DriverObject,IN PUNICODE_STRING RegistryPath )
{
 HANDLE h;

 DbgPrint("Loading/r/n");
 DriverObject->DriverUnload = DriverUnload;

 ExEnumHandleTable = (EXENUMHANDLETABLE)GetFunctionAddr(L"ExEnumHandleTable");
 if ( ExEnumHandleTable == NULL )
 {
  DbgPrint("Get ExEnumHandleTable Addr Error!!");
  return STATUS_DEVICE_CONFIGURATION_ERROR;
 }
 DbgPrint("Address of ExEnumHandleTable:%x/n",ExEnumHandleTable);

 GetPspCidTable();
 DbgPrint("CidTable:%x/n",pPspCidTable);
 ExEnumHandleTable(pPspCidTable, EnumHandleCallback, NULL, &h );
 return STATUS_SUCCESS;
}