hi there,
I tried to make an aplication that monitors the handle of a process.
I used ZwQuerySystemInformation with the SytemHandleInformation class,
this returns a vector of Objects in the system associated with a
process ID of the process that holds the object. I managed to get the
object types easily, object names as well.
I just had an issue, how do I get the handles associated with each
object(for example u have the object for the current process PEPROCESS
cProcess, and you can call ObOpebObjectByPointer() and make a lot of
handles associated with that object with different security and
different access masks ). I managed to get object handle count, for
each object.
Or how can I get the handle_table associated with a process, I know
there is a function called ObReferenceProcessHandleTable but it is not
documented and I cannot import it from ntoskrnl.exe.
or
NTKERNELAPI
PHANDLE_TABLE
ExCreateHandleTable (
__in_opt struct _EPROCESS *Process
); but the same problem not documented, nowhere to get it from.
If u know other places I can get these function pointers from except
ntoskrnl.exe or ntdll.dll please help, or i u have any solutions to
this issue;
thank you in advance