Skip to content

Commit 61eb677

Browse files
mrexodiamrexodia
committed
Merge pull request x64dbg#668 from torusrxxx/patch-2
Handles view
2 parents a960f62 + 17dd12e commit 61eb677

20 files changed

+1486
-499
lines changed

‎src/bridge/_global.cpp

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,7 @@ DBGGETBPLIST _dbg_getbplist;
2424
DBGDBGCMDEXECDIRECT _dbg_dbgcmddirectexec;
2525
DBGGETBRANCHDESTINATION _dbg_getbranchdestination;
2626
DBGSENDMESSAGE _dbg_sendmessage;
27+
DBGGETHANDLECOUNT _dbg_gethandlecount;
28+
DBGENUMHANDLES _dbg_enumhandles;
29+
DBGGETHANDLENAME _dbg_gethandlename;
30+
DBGGETPROCESSINFORMATION _dbg_getProcessInformation;

‎src/bridge/_global.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,11 @@ typedef bool (*DBGDBGCMDEXECDIRECT)(const char* cmd);
3636
typedef duint(*DBGGETBRANCHDESTINATION)(duint addr);
3737
typedef duint(*DBGSENDMESSAGE)(DBGMSG type, void* param1, void* param2);
3838

39+
typedef long (*DBGGETHANDLECOUNT)();
40+
typedef long (*DBGENUMHANDLES)(duint* handles, unsigned char* typeNumbers, unsigned int* grantedAccess, unsigned int maxcount);
41+
typedef bool(*DBGGETHANDLENAME)(char *name, char* typeName, size_t buffersize, duint remotehandle);
42+
typedef PROCESS_INFORMATION* (*DBGGETPROCESSINFORMATION)();
43+
3944
//DBG functions
4045
extern DBGDBGINIT _dbg_dbginit;
4146
extern DBGMEMFINDBASEADDR _dbg_memfindbaseaddr;
@@ -57,5 +62,9 @@ extern DBGGETBPLIST _dbg_getbplist;
5762
extern DBGDBGCMDEXECDIRECT _dbg_dbgcmddirectexec;
5863
extern DBGGETBRANCHDESTINATION _dbg_getbranchdestination;
5964
extern DBGSENDMESSAGE _dbg_sendmessage;
65+
extern DBGGETHANDLECOUNT _dbg_gethandlecount;
66+
extern DBGENUMHANDLES _dbg_enumhandles;
67+
extern DBGGETHANDLENAME _dbg_gethandlename;
68+
extern DBGGETPROCESSINFORMATION _dbg_getProcessInformation;
6069

6170
#endif // _GLOBAL_H

‎src/bridge/bridgemain.cpp

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,10 @@ BRIDGE_IMPEXP const char* BridgeInit()
8383
LOADEXPORT(_dbg_dbgcmddirectexec);
8484
LOADEXPORT(_dbg_getbranchdestination);
8585
LOADEXPORT(_dbg_sendmessage);
86+
LOADEXPORT(_dbg_gethandlecount);
87+
LOADEXPORT(_dbg_gethandlename);
88+
LOADEXPORT(_dbg_enumhandles);
89+
LOADEXPORT(_dbg_getProcessInformation);
8690
return 0;
8791
}
8892

@@ -846,6 +850,26 @@ BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr)
846850
return ARG_NONE;
847851
}
848852

853+
BRIDGE_IMPEXP long DbgGetHandleCount()
854+
{
855+
return _dbg_gethandlecount();
856+
}
857+
858+
BRIDGE_IMPEXP long DbgEnumHandles(duint* handles, unsigned char* typeNumbers, unsigned int* grantedAccess, unsigned int maxcount)
859+
{
860+
return _dbg_enumhandles(handles, typeNumbers, grantedAccess, maxcount);
861+
}
862+
863+
BRIDGE_IMPEXP bool DbgGetHandleName(char *name, char* typeName, size_t buffersize, duint remotehandle)
864+
{
865+
return _dbg_gethandlename(name, typeName, buffersize, remotehandle);
866+
}
867+
868+
BRIDGE_IMPEXP PROCESS_INFORMATION* DbgGetProcessInformation()
869+
{
870+
return _dbg_getProcessInformation();
871+
}
872+
849873
BRIDGE_IMPEXP void GuiDisasmAt(duint addr, duint cip)
850874
{
851875
_gui_sendmessage(GUI_DISASSEMBLE_AT, (void*)addr, (void*)cip);

‎src/bridge/bridgemain.h

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -352,7 +352,7 @@ typedef struct
352352
duint start; //OUT
353353
duint end; //OUT
354354
} LOOP;
355-
355+
#ifndef _NO_ADDRINFO
356356
typedef struct
357357
{
358358
int flags; //ADDRINFOFLAGS (IN)
@@ -363,7 +363,7 @@ typedef struct
363363
FUNCTION function;
364364
LOOP loop;
365365
} ADDRINFO;
366-
366+
#endif
367367
struct SYMBOLINFO_
368368
{
369369
duint addr;
@@ -725,6 +725,11 @@ BRIDGE_IMPEXP bool DbgWinEventGlobal(MSG* message);
725725
BRIDGE_IMPEXP bool DbgIsRunning();
726726
BRIDGE_IMPEXP duint DbgGetTimeWastedCounter();
727727
BRIDGE_IMPEXP ARGTYPE DbgGetArgTypeAt(duint addr);
728+
BRIDGE_IMPEXP long DbgGetHandleCount();
729+
BRIDGE_IMPEXP long DbgEnumHandles(duint* handles, unsigned char* typeNumbers, unsigned int* grantedAccess, unsigned int maxcount);
730+
BRIDGE_IMPEXP bool DbgGetHandleName(char* name, char* typeName, size_t buffersize, duint remotehandle);
731+
BRIDGE_IMPEXP bool DbgGetHandleInfo(duint remotehandle, duint* refcount, duint* access);
732+
BRIDGE_IMPEXP PROCESS_INFORMATION* DbgGetProcessInformation();
728733

729734
//Gui defines
730735
#define GUI_PLUGIN_MENU 0

‎src/dbg/_exports.cpp

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,17 @@ extern "C" DLL_EXPORT bool _dbg_addrinfoset(duint addr, ADDRINFO* addrinfo)
366366
return retval;
367367
}
368368

369+
370+
extern "C" DLL_EXPORT long _dbg_gethandlecount()
371+
{
372+
return HandlerGetActiveHandleCount(fdProcessInfo->dwProcessId);
373+
}
374+
375+
extern "C" DLL_EXPORT PROCESS_INFORMATION* _dbg_getProcessInformation()
376+
{
377+
return fdProcessInfo;
378+
}
379+
369380
extern "C" DLL_EXPORT int _dbg_bpgettypeat(duint addr)
370381
{
371382
static duint cacheAddr;

‎src/dbg/_exports.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ DLL_EXPORT bool _dbg_isdebugging();
1818
DLL_EXPORT bool _dbg_isjumpgoingtoexecute(duint addr);
1919
DLL_EXPORT bool _dbg_addrinfoget(duint addr, SEGMENTREG segment, ADDRINFO* addrinfo);
2020
DLL_EXPORT bool _dbg_addrinfoset(duint addr, ADDRINFO* addrinfo);
21+
DLL_EXPORT long _dbg_gethandlecount();
22+
DLL_EXPORT long _dbg_enumhandles(duint* handles, unsigned char* typeNumbers, unsigned int* grantedAccess, unsigned int maxcount);
23+
DLL_EXPORT bool _dbg_gethandlename(char *name, char* typeName, size_t buffersize, duint remotehandle);
24+
DLL_EXPORT PROCESS_INFORMATION* _dbg_getProcessInformation();
2125
DLL_EXPORT int _dbg_bpgettypeat(duint addr);
2226
DLL_EXPORT bool _dbg_getregdump(REGDUMP* regdump);
2327
DLL_EXPORT bool _dbg_valtostring(const char* string, duint value);

‎src/dbg/debugger.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ char szSymbolCachePath[MAX_PATH] = "";
5353
char sqlitedb[deflen] = "";
5454
PROCESS_INFORMATION* fdProcessInfo = &g_pi;
5555
HANDLE hActiveThread;
56+
HANDLE hProcessToken;
5657
bool bUndecorateSymbolNames = true;
5758
bool bEnableSourceDebugging = true;
5859

@@ -1860,6 +1861,9 @@ static void debugLoopFunction(void* lpParameter, bool attach)
18601861
//set script variables
18611862
varset("$hp", (duint)fdProcessInfo->hProcess, true);
18621863
varset("$pid", fdProcessInfo->dwProcessId, true);
1864+
1865+
if (!OpenProcessToken(fdProcessInfo->hProcess, TOKEN_ALL_ACCESS, &hProcessToken))
1866+
hProcessToken = 0;
18631867
}
18641868

18651869
//set custom handlers
@@ -1933,6 +1937,8 @@ static void debugLoopFunction(void* lpParameter, bool attach)
19331937
dputs("Debugging stopped!");
19341938
varset("$hp", (duint)0, true);
19351939
varset("$pid", (duint)0, true);
1940+
if(hProcessToken)
1941+
CloseHandle(hProcessToken);
19361942
unlock(WAITID_STOP); //we are done
19371943
pDebuggedEntry = 0;
19381944
pDebuggedBase = 0;

‎src/dbg/debugger.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ bool cbSetModuleBreakpoints(const BREAKPOINT* bp);
110110
//variables
111111
extern PROCESS_INFORMATION* fdProcessInfo;
112112
extern HANDLE hActiveThread;
113+
extern HANDLE hProcessToken;
113114
extern char szFileName[MAX_PATH];
114115
extern char szSymbolCachePath[MAX_PATH];
115116
extern bool bUndecorateSymbolNames;

‎src/dbg/enumhandles.cpp

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#include "_global.h"
2+
#include "debugger.h"
3+
#include "TitanEngine\TitanEngine.h"
4+
5+
struct SYSTEM_HANDLE_INFORMATION{
6+
ULONG ProcessId;
7+
UCHAR ObjectTypeNumber;
8+
UCHAR Flags;
9+
USHORT Handle;
10+
PVOID Object;
11+
DWORD GrantedAccess;
12+
};
13+
14+
struct OBJECT_TYPE_INFORMATION
15+
{
16+
UNICODE_STRING Name;
17+
ULONG TotalNumberOfObjects;
18+
ULONG TotalNumberOfHandles;
19+
ULONG TotalPagedPoolUsage;
20+
ULONG TotalNonPagedPoolUsage;
21+
ULONG TotalNamePoolUsage;
22+
ULONG TotalHandleTableUsage;
23+
ULONG HighWaterNumberOfObjects;
24+
ULONG HighWaterNumberOfHandles;
25+
ULONG HighWaterPagedPoolUsage;
26+
ULONG HighWaterNonPagedPoolUsage;
27+
ULONG HighWaterNamePoolUsage;
28+
ULONG HighWaterHandleTableUsage;
29+
ULONG InvalidAttributes;
30+
GENERIC_MAPPING GenericMapping;
31+
ULONG ValidAccess;
32+
BOOLEAN SecurityRequired;
33+
BOOLEAN MaintainHandleCount;
34+
USHORT MaintainTypeList;
35+
DWORD PoolType;
36+
ULONG PagedPoolUsage;
37+
ULONG NonPagedPoolUsage;
38+
};
39+
40+
struct MYHANDLES{
41+
DWORD_PTR HandleCount;
42+
SYSTEM_HANDLE_INFORMATION Handles[1];
43+
};
44+
45+
#ifdef _WIN64
46+
DWORD (*NtQuerySystemInformation)(DWORD SystemInfoClass, void* SystemInfo, DWORD SystemInfoSize, DWORD* ReturnedSize) = nullptr;
47+
#else //x86
48+
DWORD(__stdcall *NtQuerySystemInformation)(DWORD SystemInfoClass, void* SystemInfo, DWORD SystemInfoSize, DWORD* ReturnedSize) = nullptr;
49+
#endif //_WIN64
50+
#ifdef _WIN64
51+
DWORD (*NtQueryObject)(HANDLE ObjectHandle, ULONG ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength) = nullptr;
52+
#else //x86
53+
DWORD(__stdcall *NtQueryObject)(HANDLE ObjectHandle, ULONG ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength) = nullptr;
54+
#endif //_WIN64
55+
56+
extern "C" DLL_EXPORT long _dbg_enumhandles(duint* handles, unsigned char* typeNumbers, unsigned int* grantedAccess, unsigned int maxcount)
57+
{
58+
MYHANDLES* myhandles = (MYHANDLES*)emalloc(16384, "_dbg_enumhandles");
59+
DWORD size = 16384;
60+
DWORD errcode = 0xC0000004;
61+
if (NtQuerySystemInformation == nullptr)
62+
*(FARPROC*)&NtQuerySystemInformation = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQuerySystemInformation");
63+
while (errcode == 0xC0000004)
64+
{
65+
errcode = NtQuerySystemInformation(16, myhandles, size, &size);
66+
if (errcode == 0xC0000004)
67+
{
68+
myhandles = (MYHANDLES*)erealloc(myhandles, size + 16384, "_dbg_enumhandles");
69+
size += 16384;
70+
}
71+
else
72+
{
73+
break;
74+
}
75+
}
76+
if (errcode != 0)
77+
{
78+
efree(myhandles, "_dbg_enumhandles");
79+
return 0;
80+
}
81+
else
82+
{
83+
unsigned int j = 0;
84+
for (unsigned int i = 0; i < myhandles->HandleCount; i++)
85+
{
86+
DWORD pid = fdProcessInfo->dwProcessId;
87+
if (myhandles->Handles[i].ProcessId == pid)
88+
{
89+
handles[j] = myhandles->Handles[j].Handle;
90+
typeNumbers[j] = myhandles->Handles[j].ObjectTypeNumber;
91+
grantedAccess[j] = myhandles->Handles[j].GrantedAccess;
92+
if (++j == maxcount) break;
93+
}
94+
}
95+
efree(myhandles, "_dbg_enumhandles");
96+
return j;
97+
}
98+
}
99+
100+
extern "C" DLL_EXPORT bool _dbg_gethandlename(char *name, char* typeName, size_t buffersize, duint remotehandle)
101+
{
102+
HANDLE hLocalHandle;
103+
if (typeName && DuplicateHandle(fdProcessInfo->hProcess, (HANDLE)remotehandle, GetCurrentProcess(), &hLocalHandle, DUPLICATE_SAME_ACCESS, FALSE, 0))
104+
{
105+
OBJECT_TYPE_INFORMATION* objectTypeInfo = (OBJECT_TYPE_INFORMATION*)emalloc(128, "_dbg_gethandlename");
106+
if (NtQueryObject == nullptr)
107+
*(FARPROC*)&NtQueryObject = GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQueryObject");
108+
if (NtQueryObject(hLocalHandle, 2, objectTypeInfo, 128, NULL) >= 0)
109+
strcpy_s(typeName, buffersize, StringUtils::Utf16ToUtf8(objectTypeInfo->Name.Buffer).c_str());
110+
efree(objectTypeInfo, "_dbg_gethandlename");
111+
CloseHandle(hLocalHandle);
112+
}
113+
wchar_t *buffer;
114+
buffer = (wchar_t*)HandlerGetHandleNameW(fdProcessInfo->hProcess, fdProcessInfo->dwProcessId, (HANDLE)remotehandle, false);
115+
if (buffer)
116+
{
117+
strcpy_s(name, buffersize, StringUtils::Utf16ToUtf8(buffer).c_str());
118+
VirtualFree(buffer, 0, MEM_RELEASE);
119+
return true;
120+
}
121+
return true;
122+
}

‎src/dbg/instruction.cpp

Lines changed: 82 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2390,4 +2390,85 @@ CMDRESULT cbInstrMnemonicbrief(int argc, char* argv[])
23902390
return STATUS_ERROR;
23912391
dputs(MnemonicHelp::getBriefDescription(argv[1]).c_str());
23922392
return STATUS_CONTINUE;
2393-
}
2393+
}
2394+
2395+
2396+
CMDRESULT cbGetPrivilegeState(int argc, char* argv[])
2397+
{
2398+
TOKEN_PRIVILEGES* Privileges;
2399+
DWORD returnLength;
2400+
LUID luid;
2401+
if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
2402+
{
2403+
varset("$result", (duint)0, false);
2404+
return CMDRESULT::STATUS_CONTINUE;
2405+
}
2406+
Privileges = (TOKEN_PRIVILEGES*)emalloc(64 * 16 + 8, "_dbg_getprivilegestate");
2407+
if (GetTokenInformation(hProcessToken, TokenPrivileges, Privileges, 64 * 16 + 8, &returnLength) == 0)
2408+
{
2409+
if (returnLength > 4 * 1024 * 1024)
2410+
{
2411+
varset("$result", (duint)0, false);
2412+
return CMDRESULT::STATUS_CONTINUE;
2413+
}
2414+
Privileges = (TOKEN_PRIVILEGES*)erealloc(Privileges, returnLength, "_dbg_getprivilegestate");
2415+
if (GetTokenInformation(hProcessToken, TokenPrivileges, Privileges, returnLength, &returnLength) == 0)
2416+
{
2417+
efree(Privileges, "_dbg_getprivilegestate");
2418+
return STATUS_ERROR;
2419+
}
2420+
}
2421+
for (unsigned int i = 0; i < Privileges->PrivilegeCount; i++)
2422+
{
2423+
if (4 + sizeof(LUID_AND_ATTRIBUTES) * i > returnLength)
2424+
{
2425+
efree(Privileges, "_dbg_getprivilegestate");
2426+
return STATUS_ERROR;
2427+
}
2428+
if (memcmp(&Privileges->Privileges[i].Luid, &luid, sizeof(LUID)) == 0)
2429+
{
2430+
efree(Privileges, "_dbg_getprivilegestate");
2431+
varset("$result", (duint)(Privileges->Privileges[i].Attributes + 1), false); // 2=enabled, 3=default, 1=disabled
2432+
return STATUS_CONTINUE;
2433+
}
2434+
}
2435+
efree(Privileges, "_dbg_getprivilegestate");
2436+
varset("$result", (duint)0, false);
2437+
return STATUS_CONTINUE;
2438+
}
2439+
2440+
CMDRESULT cbEnablePrivilege(int argc, char* argv[])
2441+
{
2442+
LUID luid;
2443+
if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
2444+
{
2445+
dprintf("Could not find the specified privilege: %s\n", argv[1]);
2446+
return CMDRESULT::STATUS_ERROR;
2447+
}
2448+
TOKEN_PRIVILEGES* Privilege;
2449+
Privilege = (TOKEN_PRIVILEGES*)emalloc(sizeof(LUID_AND_ATTRIBUTES) + 4, "_dbg_enableprivilege");
2450+
Privilege->PrivilegeCount = 1;
2451+
Privilege->Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
2452+
Privilege->Privileges[0].Luid = luid;
2453+
bool ret = AdjustTokenPrivileges(hProcessToken, FALSE, Privilege, sizeof(LUID_AND_ATTRIBUTES) + 4, nullptr, nullptr) != NO_ERROR;
2454+
efree(Privilege, "_dbg_enableprivilege");
2455+
return ret ? CMDRESULT::STATUS_CONTINUE : CMDRESULT::STATUS_CONTINUE;
2456+
}
2457+
2458+
CMDRESULT cbDisablePrivilege(int argc, char* argv[])
2459+
{
2460+
LUID luid;
2461+
if (LookupPrivilegeValueW(nullptr, StringUtils::Utf8ToUtf16(argv[1]).c_str(), &luid) == 0)
2462+
{
2463+
dprintf("Could not find the specified privilege: %s\n", argv[1]);
2464+
return CMDRESULT::STATUS_ERROR;
2465+
}
2466+
TOKEN_PRIVILEGES* Privilege;
2467+
Privilege = (TOKEN_PRIVILEGES*)emalloc(sizeof(LUID_AND_ATTRIBUTES) + 4, "_dbg_disableprivilege");
2468+
Privilege->PrivilegeCount = 1;
2469+
Privilege->Privileges[0].Attributes = 0;
2470+
Privilege->Privileges[0].Luid = luid;
2471+
bool ret = AdjustTokenPrivileges(hProcessToken, FALSE, Privilege, sizeof(LUID_AND_ATTRIBUTES) + 4, nullptr, nullptr) != NO_ERROR;
2472+
efree(Privilege, "_dbg_disableprivilege");
2473+
return ret ? CMDRESULT::STATUS_CONTINUE : CMDRESULT::STATUS_CONTINUE;
2474+
}

‎src/dbg/instruction.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,8 @@ CMDRESULT cbInstrSavedata(int argc, char* argv[]);
8282
CMDRESULT cbInstrMnemonichelp(int argc, char* argv[]);
8383
CMDRESULT cbInstrMnemonicbrief(int argc, char* argv[]);
8484

85+
CMDRESULT cbGetPrivilegeState(int argc, char* argv[]);
86+
CMDRESULT cbEnablePrivilege(int argc, char* argv[]);
87+
CMDRESULT cbDisablePrivilege(int argc, char* argv[]);
88+
8589
#endif // _INSTRUCTION_H

‎src/gui/Src/Gui/GotoDialog.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ void GotoDialog::expressionChanged(bool validExpression, bool validPointer, dsin
9393
QString addrText = QString(" %1").arg(va, sizeof(dsint) * 2, 16, QChar('0')).toUpper();
9494
if(va)
9595
{
96-
ui->labelError->setText(tr("<font color='#00DD00'><b>Correct expression! -></b></font>") + addrText);
96+
ui->labelError->setText(tr("<font color='#00DD00'><b>Correct expression! -&gt; </b></font>") + addrText);
9797
setOkEnabled(true);
9898
expressionText = expression;
9999
}
@@ -135,7 +135,7 @@ void GotoDialog::expressionChanged(bool validExpression, bool validPointer, dsin
135135
addrText = QString(module) + "." + QString("%1").arg(addr, sizeof(dsint) * 2, 16, QChar('0')).toUpper();
136136
else
137137
addrText = QString("%1").arg(addr, sizeof(dsint) * 2, 16, QChar('0')).toUpper();
138-
ui->labelError->setText(tr("<font color='#00DD00'><b>Correct expression! -> </b></font>") + addrText);
138+
ui->labelError->setText(tr("<font color='#00DD00'><b>Correct expression! -&gt; </b></font>") + addrText);
139139
setOkEnabled(true);
140140
expressionText = expression;
141141
}

0 commit comments

Comments
 (0)