找互拆体的句柄

阿杰

1. HANDLE GetProcessKernelObject(DWORD ProcessId)
   
2. {
   
3. 
   
4. HMODULE hNtDll = NULL;
   
5. ZWQUERYSYSTEMINFORMATION pfnZwQuerySystemInformation = NULL;
   
6. NTQUERYOBJECT pfnNtQueryObject = NULL;
   
7. PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = NULL;
   
8. POBJECT_ALL_INFORMATION pAllInfo =NULL;
   
9. POBJECT_NAME_INFORMATION pNameInfo = NULL;
   
10. 
    
11. 
    
12. ULONG nNumberHandle =0;
    
13. NTSTATUS ntStatus = 0;
    
14. ULONG ulSize,ulCount;
    
15. char cBuffer[0x80000],cInfoBuffer[0x10000];
    
16. 
    
17. hNtDll = GetModuleHandle(TEXT("ntdll.dll"));
    
18. pfnZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
    
19. pfnNtQueryObject = (NTQUERYOBJECT)GetProcAddress(hNtDll,"NtQueryObject");
    
20. 
    
21. ntStatus = pfnZwQuerySystemInformation(SystemHandleInformation,cBuffer,0x80000,&ulSize);
    
22. 
    
23. if(NT_SUCCESS(ntStatus))
    
24. {
    
25. DWORD n = ulSize/sizeof(SYSTEM_HANDLE_INFORMATION);
    
26. nNumberHandle = *(PULONG)cBuffer;
    
27. pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION)(cBuffer +4);
    
28. ulCount = 0;
    
29. 
    
30. for(ULONG i=0;i!=nNumberHandle;++i)
    
31. {
    
32. 
    
33. if(pSysHandleInfo[i].ProcessId != ProcessId)
    
34. continue;
    
35. 
    
36. 
    
37. ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo[i].Handle,ObjectAllInformation,cInfoBuffer,0x10000,&ulSize);
    
38. ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo[i].Handle,ObjectNameInformation,cInfoBuffer,0x10000,&ulSize);
    
39. if(NT_SUCCESS(ntStatus))
    
40. {
    
41. pAllInfo = (POBJECT_ALL_INFORMATION)cInfoBuffer;
    
42. pNameInfo = (POBJECT_NAME_INFORMATION)cInfoBuffer;
    
43. if(_tcsstr(pNameInfo->NameBuffer,TEXT("QQGame_Mutex")) !=NULL)
    
44. {
    
45. return (HWND)pSysHandleInfo[i].Handle;
    
46. }
    
47. }
    
48. }
    
49. }
    
50. return NULL;
    
51. }
    
52. 
    

复制代码

346022142

:loveliness::loveliness:谢谢了  收下之

upring

必须赞 楼主好厉害

luqi_44

受教了

luqi_44

受教了