win10 1909 解析內核句柄表----ObpKernelHandleTable【目前只考慮兩層句柄表的解析，因爲懶】

因爲win10將句柄表加密了，寫個小工具來實現解密（因爲本人電腦句柄表是二層結構，所以只寫了二層結構實現，一層和三層可以自己實現）：

#include <ntddk.h>
#include "Handle.h"

VOID Unload(PDRIVER_OBJECT pDriverObject)
{
	KdPrint(("end\n"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
	NTSTATUS status = STATUS_SUCCESS;
	KdPrint(("start\n"));
	pDriverObject->DriverUnload = Unload;
	HANDLE hThread;
	PUCHAR System = (PUCHAR)PsInitialSystemProcess;
	//第一步得到內核句柄表
	PHANDLE_TABLE ObpKernelHandleTable;
	ObpKernelHandleTable = (PHANDLE_TABLE)(*(PUINT64)(System + 0x418));

	//第二步通過硬編碼搜索ObTypeIndexTable,ObTypeIndexTable是個指針數組，每個成員指向一個object_type
	PUCHAR  var = (PUCHAR)ObGetObjectType;
	for (int i = 0; i < 50; i++)
	{

		if (*var == 0x48 && *(var + 2) == 0x0d)
		{
			ObTypeIndexTable = *(PLONG32)(var + 3) & 0xFFFFFFFF;
			ObTypeIndexTable = var + 7 + (LONG32)ObTypeIndexTable;
		}
		var++;
	}
	//第二步解析
	AnalyticHandle(ObpKernelHandleTable);

	return status;
}

PVOID NTAPI AnalyticHandle(IN PHANDLE_TABLE HandleTable)
{
	INT64 TableBase = 0;
	INT64 TableLevel = 0;
	PUINT64 varTableEntry = 0;
	PHANDLE_TABLE varHandleTable = HandleTable;
	TableBase = varHandleTable->TableCode;
	TableLevel = TableBase & 3;
	TableBase = TableBase & 0xFFFFFFFFFFFFFFFC;
	int var_i = 0;
	int var_j = 0;
    PUCHAR ObjectHeader = 0;
	if (TableLevel == 1)
	{
		for (; *(PUINT64)TableBase && ((var_i++)<0x200); TableBase += 8)
		{
		    varTableEntry = *(PUINT64)TableBase;
			//因爲第一個和最後一個不用
			varTableEntry += 2;
			var_j = 0;
			while((var_j++) < 0xFF)
			{
				if (*varTableEntry)
				{
									
					ObjectHeader=(((INT64)*varTableEntry) >> 0x10) & 0xFFFFFFFFFFFFFFF0;
					Object = ObjectHeader + 0x30;
					//得到Object_Type
					pObjectType=ObGetObjectType(Object);
					KdPrint(("varTableEntry=%llx,ObjectHeader=%llx,ObjectType=%wZ\n", *varTableEntry,ObjectHeader, &pObjectType->Name));
					//不讓系統卡死
					KSleep(10);
									
				}
				varTableEntry += 2;
				
			}
			
		
		}
		
	}
	return 0;

}
VOID KSleep(LONG MilliSecond)

{

	LARGE_INTEGER Interval = { 0 };

	Interval.QuadPart = DELAY_ONE_MILLISECOND;

	Interval.QuadPart *= MilliSecond;

	KeDelayExecutionThread(KernelMode, 0, &Interval);

}

下面是頭函數：

#include <ntddk.h>
#define DELAY_ONE_MICROSECOND   (-10)
#define DELAY_ONE_MILLISECOND   (DELAY_ONE_MICROSECOND*1000)

typedef struct _HANDLE_TABLE
{
	ULONG NextHandleNeedingPool;
	LONG ExtraInfoPages;
	ULONG64 TableCode;
	PEPROCESS QuotaProcess;
	LIST_ENTRY HandleTableList;
	ULONG UniqueProcessId;
	ULONG Flags;
	ULONG64 HandleContentionEvent;

}HANDLE_TABLE, *PHANDLE_TABLE;

typedef struct _OBJECT_TYPE
{
	LIST_ENTRY TypeList;
	UNICODE_STRING Name;
	PVOID DefaultObject;
	UCHAR Index;
	ULONG TotalNumberOfObjects;
	ULONG TotalNumberOfHandles;
	ULONG HighWaterNumberOfObjects;
	ULONG HighWaterNumberOfHandles;
    //後面暫時用不到，省略
}OBJECT_TYPE, *POBJECT_TYPE;

PVOID NTAPI AnalyticHandle(IN PHANDLE_TABLE HandleTable);
NTKERNELAPI PVOID NTAPI ObGetObjectType(IN PVOID pObject);
PSHORT ObHeaderCookie = 0;
PINT64 ObTypeIndexTable = 0;
UCHAR TypeIndex;
NTKERNELAPI PEPROCESS PsInitialSystemProcess;
PVOID Object;
POBJECT_TYPE pObjectType;
VOID KSleep(LONG MilliSecond);

效果圖：