Windows内核对象管理深度解析：从句柄到安全描述符的实现与漏洞利用

+-----------------------+  <- 对象体起始地址 (Body)
|   Object Body         |
|   (e.g., EPROCESS)    |
+-----------------------+  <- 对象体偏移 - 0x30 (典型)
|   _OBJECT_HEADER      |
|   - PointerCount      |
|   - HandleCount       |
|   - TypeIndex         |
|   - SecurityDescriptor|
|   - ...               |
+-----------------------+  <- 对象头起始
|   (可选头: QUOTA, HANDLEINFO, etc.) |
+-----------------------+

POBJECT_TYPE ObGetObjectType(PVOID ObjectBody) {
    POBJECT_HEADER header = OBJECT_HEADER_FROM_BODY(ObjectBody);
    return ObpTypeObjectType[header->TypeIndex];
}

#include <ntddk.h>

NTSTATUS EnumerateHandlesForProcess(HANDLE ProcessId) {
    PEPROCESS pTarget = NULL;
    NTSTATUS status = PsLookupProcessByProcessId(ProcessId, &pTarget);
    if (!NT_SUCCESS(status)) return status;

    // 获取句柄表地址（不同Windows版本偏移不同，此处动态获取）
    PHANDLE_TABLE pHandleTable = *(PHANDLE_TABLE*)((PUCHAR)pTarget + 0x4f8); // Win10 x64偏移，请根据实际更新
    if (!pHandleTable) {
        ObDereferenceObject(pTarget);
        return STATUS_UNSUCCESSFUL;
    }

    // 获取句柄表锁
    FAST_MUTEX* pMutex = &pHandleTable->HandleTableMutex;
    KeAcquireGuardedMutex(pMutex);

    // 遍历句柄表（简化：仅遍历一级表，实际需处理多层页表）
    ULONG TableSize = pHandleTable->TableSize;
    PHANDLE_TABLE_ENTRY pEntry = (PHANDLE_TABLE_ENTRY*)pHandleTable->Table;
    for (ULONG i = 0; i < TableSize; i++) {
        HANDLE_TABLE_ENTRY entry = pEntry[i];
        if (!(entry.ObjectPointerBits & 0x1)) continue; // 空闲项
        PVOID ObjectBody = (PVOID)(entry.ObjectPointerBits & ~0xF);
        POBJECT_HEADER pHeader = OBJECT_HEADER_FROM_BODY(ObjectBody);
        POBJECT_TYPE pType = ObGetObjectType(ObjectBody);
        DbgPrint("[Handle 0x%X] Type: %ws, Access: 0x%X, Body: %p\n",
                 (HANDLE)(i << 2), pType->Name.Buffer, entry.GrantedAccess, ObjectBody);
    }

    KeReleaseGuardedMutex(pMutex);
    ObDereferenceObject(pTarget);
    return STATUS_SUCCESS;
}

NTSTATUS GetObjectSecurityDescriptor(PVOID ObjectBody) {
    POBJECT_HEADER pHeader = OBJECT_HEADER_FROM_BODY(ObjectBody);
    PSECURITY_DESCRIPTOR pSD = (PSECURITY_DESCRIPTOR)pHeader->SecurityDescriptor;
    if (!pSD) return STATUS_NO_SECURITY_ON_OBJECT;

    // 安全描述符可能是自相对格式，需先转换成绝对格式
    SECURITY_DESCRIPTOR absoluteSD;
    ULONG sdSize = sizeof(SECURITY_DESCRIPTOR);
    RtlAbsoluteToSelfRelativeSD(pSD, &absoluteSD, &sdSize);

    PACL pDacl = NULL;
    BOOLEAN present, defaulted;
    SeQuerySecurityDescriptorInfo(NULL, &pDacl, &present, &defaulted, pSD, &sdSize, NULL);
    if (present && pDacl) {
        DbgPrint("DACL has %u ACEs\n", pDacl->AceCount);
    }
    return STATUS_SUCCESS;
}

NTSTATUS GrantFullAccessToProcess(PEPROCESS Process) {
    POBJECT_HEADER pHeader = OBJECT_HEADER_FROM_BODY(Process);
    // 构造一个允许所有访问的DACL（实际应调用SeCreateSecurityDescriptor等API）
    // 此仅为简化演示，真实场景需分配非页池并设置正确ACE。
    PACL pNewDacl = NULL; // 需实际构造
    NTSTATUS status = SeSetSecurityDescriptorInfo(NULL, &pNewDacl, &pHeader->SecurityDescriptor,
                                                   SE_OBJECT_TYPE_PROCESS, FALSE, FALSE);
    return status;
}

NTSTATUS DetectHandleLessProcess() {
    PSYSTEM_HANDLE_INFORMATION pInfo = NULL;
    ULONG size = 0;
    ZwQuerySystemInformation(SystemHandleInformation, NULL, 0, &size);
    pInfo = (PSYSTEM_HANDLE_INFORMATION)ExAllocatePool(NonPagedPool, size);
    if (!pInfo) return STATUS_NO_MEMORY;

    ZwQuerySystemInformation(SystemHandleInformation, pInfo, size, &size);

    // 统计每个PID的句柄数
    for (ULONG i = 0; i < pInfo->NumberOfHandles; i++) {
        // 忽略无效
    }
    // 然后对比进程列表，若EPROCESS存在但句柄数为0且未终止，则可能是隐藏对象。

    ExFreePool(pInfo);
    return STATUS_SUCCESS;
}

NTSTATUS EnumerateDeviceObjects() {
    UNICODE_STRING deviceDir = RTL_CONSTANT_STRING(L"\\Device");
    OBJECT_ATTRIBUTES attr;
    InitializeObjectAttributes(&attr, &deviceDir, OBJ_CASE_INSENSITIVE, NULL, NULL);
    HANDLE hDir;
    NTSTATUS status = ZwOpenDirectoryObject(&hDir, DIRECTORY_QUERY, &attr);
    if (!NT_SUCCESS(status)) return status;

    ULONG bufSize = 0x1000;
    POBJECT_DIRECTORY_INFORMATION pInfo = (POBJECT_DIRECTORY_INFORMATION)ExAllocatePool(PagedPool, bufSize);
    ULONG returnLen;
    status = ZwQueryDirectoryObject(hDir, pInfo, bufSize, FALSE, TRUE, &returnLen, NULL);
    if (NT_SUCCESS(status)) {
        for (ULONG i = 0; pInfo[i].Name.Buffer; i++) {
            DbgPrint("Object: %wZ, Type: %wZ\n", &pInfo[i].Name, &pInfo[i].TypeName);
        }
    }
    ExFreePool(pInfo);
    ZwClose(hDir);
    return status;
}

VOID ProcessCreateNotify(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create) {
    if (!Create) return;
    PEPROCESS pProcess;
    if (NT_SUCCESS(PsLookupProcessByProcessId(ProcessId, &pProcess))) {
        POBJECT_HEADER pHeader = OBJECT_HEADER_FROM_BODY(pProcess);
        DbgPrint("[Process %d] HandleCount=%d, PointerCount=%d, SD=%p\n",
                 ProcessId, pHeader->HandleCount, pHeader->PointerCount, pHeader->SecurityDescriptor);
        ObDereferenceObject(pProcess);
    }
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath) {
    PsSetCreateProcessNotifyRoutine(ProcessCreateNotify, FALSE);
    return STATUS_SUCCESS;
}

VOID DriverUnload(PDRIVER_OBJECT pDriver) {
    PsSetCreateProcessNotifyRoutine(ProcessCreateNotify, TRUE);
}