Example #1
0
 public static extern NtStatus NtEnumerateTransactionObject(
     SafeKernelObjectHandle RootObjectHandle,
     KtmObjectType QueryType,
     ref KtmObjectCursor ObjectCursor,
     int ObjectCursorLength,
     out int ReturnLength
     );
Example #2
0
 internal static IEnumerable <T> GetAccessibleTransactionObjects <T>(
     SafeKernelObjectHandle handle,
     KtmObjectType object_type,
     Func <Guid, NtResult <T> > open_func)
 {
     return(EnumerateTransactionObjects(handle, object_type)
            .Select(open_func)
            .Where(r => r.IsSuccess)
            .Select(r => r.Result)
            .ToList().AsReadOnly());
 }
Example #3
0
 /// <summary>
 /// Enumerate all transaction objects of a specific type.
 /// </summary>
 /// <param name="query_type">The type of object to query.</param>
 /// <returns>The list of enumerated transaction object GUIDs.</returns>
 public static IEnumerable <Guid> EnumerateTransactionObjects(KtmObjectType query_type)
 {
     return(EnumerateTransactionObjects(SafeKernelObjectHandle.Null, query_type));
 }
Example #4
0
        /// <summary>
        /// Enumerate transaction objects of a specific type from a root handle.
        /// </summary>
        /// <param name="root_object_handle">The root handle to enumearate from.</param>
        /// <param name="query_type">The type of object to query.</param>
        /// <returns>The list of enumerated transaction object GUIDs.</returns>
        public static IEnumerable <Guid> EnumerateTransactionObjects(SafeKernelObjectHandle root_object_handle, KtmObjectType query_type)
        {
            List <Guid>     ret    = new List <Guid>();
            KtmObjectCursor cursor = new KtmObjectCursor();
            int             size   = Marshal.SizeOf(cursor);
            NtStatus        status = NtSystemCalls.NtEnumerateTransactionObject(root_object_handle, query_type, ref cursor, size, out int return_length);

            while (status == NtStatus.STATUS_SUCCESS)
            {
                ret.Add(cursor.ObjectIds);
                status = NtSystemCalls.NtEnumerateTransactionObject(root_object_handle, query_type, ref cursor, size, out return_length);
            }
            return(ret.AsReadOnly());
        }
        /// <summary>
        /// Enumerate transaction objects of a specific type from a root handle.
        /// </summary>
        /// <param name="root_object_handle">The root handle to enumearate from.</param>
        /// <param name="query_type">The type of object to query.</param>
        /// <returns>The list of enumerated transaction object GUIDs.</returns>
        public static IEnumerable <Guid> EnumerateTransactionObjects(SafeKernelObjectHandle root_object_handle, KtmObjectType query_type)
        {
            KtmObjectCursor cursor = new KtmObjectCursor();
            int             size   = Marshal.SizeOf(cursor);
            NtStatus        status = NtSystemCalls.NtEnumerateTransactionObject(root_object_handle, query_type, ref cursor, size, out int return_length);

            while (status != NtStatus.STATUS_NO_MORE_ENTRIES)
            {
                yield return(cursor.ObjectIds);

                status = NtSystemCalls.NtEnumerateTransactionObject(root_object_handle, query_type, ref cursor, size, out return_length);
            }
        }