예제 #1
0
        internal void GetIndirectHandleAttribute(AlpcHandleMessageAttribute attribute, NtAlpc port, AlpcMessage message)
        {
            // Indirect handle attributes need to be queried from the port.
            var attr = GetAttribute <AlpcHandleAttrIndirect>(AlpcMessageAttributeFlags.Handle).Result;

            attribute.SetHandles(Enumerable.Range(0, attr.HandleCount).Select(i => port.GetHandleInformation(message, i)));
        }
예제 #2
0
        internal void SetHandleAttribute(AlpcHandleMessageAttribute attribute)
        {
            // If no handle attributes then just zero the buffer.
            if (!attribute.Handles.Any())
            {
                var attr = GetAttribute <AlpcHandleAttr>(AlpcMessageAttributeFlags.Handle);
                attr.Result = new AlpcHandleAttr()
                {
                    Flags         = 0,
                    ObjectType    = 0,
                    Handle        = IntPtr.Zero,
                    DesiredAccess = 0
                };
                return;
            }

            int count = attribute.Handles.Count();

            if (count > 1)
            {
                var attr    = GetAttribute <AlpcHandleAttrIndirect>(AlpcMessageAttributeFlags.Handle);
                var handles = attribute.Handles.Select(h => new AlpcHandleAttr32()
                {
                    Handle        = h.Handle,
                    ObjectType    = h.ObjectType,
                    Flags         = h.Flags,
                    DesiredAccess = h.DesiredAccess
                }
                                                       );
                var handle_buffer = _resources.AddResource(handles.ToArray().ToBuffer());
                attr.Result = new AlpcHandleAttrIndirect()
                {
                    HandleAttrArray = handle_buffer.DangerousGetHandle(),
                    HandleCount     = count,
                    Flags           = AlpcHandleAttrFlags.Indirect
                };
            }
            else
            {
                var attr = GetAttribute <AlpcHandleAttr>(AlpcMessageAttributeFlags.Handle);
                AlpcHandleMessageAttributeEntry handle = attribute.Handles.First();
                attr.Result = new AlpcHandleAttr()
                {
                    Flags         = handle.Flags,
                    ObjectType    = handle.ObjectType,
                    Handle        = new IntPtr(handle.Handle),
                    DesiredAccess = handle.DesiredAccess
                };
            }
        }
예제 #3
0
        internal void GetHandleAttribute(AlpcHandleMessageAttribute attribute, NtAlpc port, AlpcMessage message)
        {
            var attr = GetAttribute <AlpcHandleAttr>(AlpcMessageAttributeFlags.Handle).Result;

            if ((attr.Flags & AlpcHandleAttrFlags.Indirect) == AlpcHandleAttrFlags.Indirect)
            {
                if (port == null || message == null)
                {
                    throw new ArgumentException("Can't rebuild indirect handle attribute without port and message");
                }
                GetIndirectHandleAttribute(attribute, port, message);
            }
            else if (attr.Handle != IntPtr.Zero)
            {
                attribute.SetHandles(new AlpcHandleMessageAttributeEntry[] { new AlpcHandleMessageAttributeEntry(attr) });
            }
            else
            {
                attribute.SetHandles(new AlpcHandleMessageAttributeEntry[0]);
            }
        }