Fix missing handle type when NtQueryObject has been hooked by kernel

Author: dmex

ProcessHacker/hndlprv.c

@@ -625,6 +625,19 @@ VOID PhHandleProviderUpdate(
                 NULL
                 );
 
+            // HACK: Some security products block NtQueryObject with ObjectTypeInformation and return an invalid type
+            // so we need to lookup the TypeName using the TypeIndex. We should improve PhGetHandleInformationEx for this case
+            // but for now we'll preserve backwards compat by doing the lookup here. (dmex)
+            if (PhIsNullOrEmptyString(handleItem->TypeName))
+            {
+                PPH_STRING typeName;
+
+                if (typeName = PhGetObjectTypeName(handleItem->TypeIndex))
+                {
+                    PhMoveReference(&handleItem->TypeName, typeName);
+                }
+            }
+
             if (handleItem->TypeName && PhEqualString2(handleItem->TypeName, L"File", TRUE) && KphIsConnected())
             {
                 KPH_FILE_OBJECT_INFORMATION objectInfo;