SYSTEM_HANDLE_INFORMATION - C++ WinAPI - Ответ 1740227

#include <Windows.h>
#include <stdio.h>
 
#define START_ALLOC                 0x1000
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
#define SystemHandleInformation     0x10
 
typedef long (__stdcall *NtQSI)(
    ULONG  SystemInformationClass,
    PVOID  SystemInformation,
    ULONG  SystemInformationLength,
    PULONG ReturnLength
    );
 
typedef struct _SYSTEM_HANDLE_ENTRY {
    ULONG  OwnerPid;
    BYTE   ObjectType;
    BYTE   HandleFlags;
    USHORT HandleValue;
    PVOID  ObjectPointer;
    ULONG  AccessMask;
} SYSTEM_HANDLE_ENTRY, *PSYSTEM_HANDLE_ENTRY;
 
int main()
{
    HMODULE hNtDll    = NULL;
    NtQSI   pNtQSI    = NULL;
    PVOID   pMem      = NULL;
    ULONG   allocSize = START_ALLOC;
    ULONG   retVal    = 0;
    // --------------------------------
    ULONG   hCount    = 0;
    PSYSTEM_HANDLE_ENTRY hFirstEntry = NULL;
    // --------------------------------
    ULONG   i;
 
    hNtDll = LoadLibraryA("NTDLL.dll");
 
    if (!hNtDll)
        return 1;
 
    pNtQSI = (NtQSI)GetProcAddress(hNtDll, "NtQuerySystemInformation");
 
    if (!pNtQSI) {
        FreeLibrary(hNtDll);
        return 2;
    }
    
    pMem = malloc(allocSize);
 
    while (pNtQSI(SystemHandleInformation, pMem, allocSize, &retVal)
        == STATUS_INFO_LENGTH_MISMATCH) {
 
        pMem = realloc(pMem, allocSize *= 2);
    }
 
    hCount = *(ULONG*)pMem;
    hFirstEntry = (PSYSTEM_HANDLE_ENTRY)((PBYTE)pMem + 4);
 
    for (i = 0; i < hCount; ++i)
        printf("PID: %d\r\n\tHandle: %d\r\n",
                hFirstEntry[i].OwnerPid,
                hFirstEntry[i].HandleValue
            );
 
    free(pMem);
    FreeLibrary(hNtDll);
}