From 886d43d7e2e340b41419ba579eb6328ad7b69ee9 Mon Sep 17 00:00:00 2001 From: hakril Date: Mon, 26 Oct 2026 11:15:12 +0100 Subject: [PATCH 1/2] enumerate_handles() now use SystemExtendedHandleInformation to work with big PID --- .../definitions/structures/handle.txt | 76 ++++ .../definitions/structures/winstruct.txt | 34 -- docs/source/winstructs_generated.rst | 386 ++++++++++++------ windows/generated_def/meta.py | 12 + windows/generated_def/winstructs.py | 122 ++++-- windows/winobject/handle.py | 75 +++- windows/winobject/process.py | 2 +- 7 files changed, 496 insertions(+), 211 deletions(-) create mode 100644 ctypes_generation/definitions/structures/handle.txt diff --git a/ctypes_generation/definitions/structures/handle.txt b/ctypes_generation/definitions/structures/handle.txt new file mode 100644 index 00000000..e3cee581 --- /dev/null +++ b/ctypes_generation/definitions/structures/handle.txt @@ -0,0 +1,76 @@ +// SystemHandleInformation + +typedef struct _SYSTEM_HANDLE +{ + DWORD dwProcessId; + BYTE bObjectType; + BYTE bFlags; + WORD wValue; + PVOID pAddress; + DWORD GrantedAccess; +} +SYSTEM_HANDLE; + +typedef struct _SYSTEM_HANDLE64 +{ + DWORD dwProcessId; + BYTE bObjectType; + BYTE bFlags; + WORD wValue; + ULONG64 pAddress; + DWORD GrantedAccess; +} SYSTEM_HANDLE64; + + +typedef struct _SYSTEM_HANDLE_INFORMATION +{ + ULONG HandleCount; + SYSTEM_HANDLE Handles[1]; +} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; + +typedef struct _SYSTEM_HANDLE_INFORMATION64 +{ + ULONG HandleCount; + SYSTEM_HANDLE64 Handles[1]; +} SYSTEM_HANDLE_INFORMATION64, *PSYSTEM_HANDLE_INFORMATION64; + +// SystemExtendedHandleInformation + +typedef struct _SYSTEM_HANDLE_EX +{ + PVOID Object; + HANDLE UniqueProcessId; + HANDLE HandleValue; + ULONG GrantedAccess; + USHORT CreatorBackTraceIndex; + USHORT ObjectTypeIndex; + ULONG HandleAttributes; + ULONG Reserved; +} SYSTEM_HANDLE_EX, *PSYSTEM_HANDLE_EX; + +typedef struct _SYSTEM_HANDLE_INFORMATION_EX +{ + ULONG_PTR HandleCount; + ULONG_PTR Reserved; + SYSTEM_HANDLE_EX Handles[1]; +} SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; + + +typedef struct _SYSTEM_HANDLE_EX64 +{ + ULONG64 Object; + ULONG64 UniqueProcessId; + ULONG64 HandleValue; + ULONG GrantedAccess; + USHORT CreatorBackTraceIndex; + USHORT ObjectTypeIndex; + ULONG HandleAttributes; + ULONG Reserved; +} SYSTEM_HANDLE_EX64, *PSYSTEM_HANDLE_EX64; + +typedef struct _SYSTEM_HANDLE_INFORMATION_EX64 +{ + ULONG64 HandleCount; + ULONG64 Reserved; + SYSTEM_HANDLE_EX64 Handles[1]; +} SYSTEM_HANDLE_INFORMATION_EX64, *PSYSTEM_HANDLE_INFORMATION_EX64; \ No newline at end of file diff --git a/ctypes_generation/definitions/structures/winstruct.txt b/ctypes_generation/definitions/structures/winstruct.txt index 92b54ab5..bbd607d4 100644 --- a/ctypes_generation/definitions/structures/winstruct.txt +++ b/ctypes_generation/definitions/structures/winstruct.txt @@ -1154,40 +1154,6 @@ typedef struct CATALOG_INFO_ WCHAR wszCatalogFile[MAX_PATH]; } CATALOG_INFO; -typedef struct _SYSTEM_HANDLE -{ - DWORD dwProcessId; - BYTE bObjectType; - BYTE bFlags; - WORD wValue; - PVOID pAddress; - DWORD GrantedAccess; -} -SYSTEM_HANDLE; - -typedef struct _SYSTEM_HANDLE64 -{ - DWORD dwProcessId; - BYTE bObjectType; - BYTE bFlags; - WORD wValue; - ULONG64 pAddress; - DWORD GrantedAccess; -} SYSTEM_HANDLE64; - - -typedef struct _SYSTEM_HANDLE_INFORMATION -{ - ULONG HandleCount; - SYSTEM_HANDLE Handles[1]; -} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; - -typedef struct _SYSTEM_HANDLE_INFORMATION64 -{ - ULONG HandleCount; - SYSTEM_HANDLE64 Handles[1]; -} SYSTEM_HANDLE_INFORMATION64, *PSYSTEM_HANDLE_INFORMATION64; - typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION { UNICODE_STRING TypeName; diff --git a/docs/source/winstructs_generated.rst b/docs/source/winstructs_generated.rst index 029f7cfd..cb2a311e 100644 --- a/docs/source/winstructs_generated.rst +++ b/docs/source/winstructs_generated.rst @@ -3814,6 +3814,276 @@ _ATTACH_VIRTUAL_DISK_PARAMETERS :class:`_ANON__ATTACH_VIRTUAL_DISK_PARAMETERS_SUB_UNION_1` +_SYSTEM_HANDLE +'''''''''''''' +.. class:: SYSTEM_HANDLE + + Alias for :class:`_SYSTEM_HANDLE` + +.. class:: _SYSTEM_HANDLE + + .. attribute:: dwProcessId + + :class:`DWORD` + + + .. attribute:: bObjectType + + :class:`BYTE` + + + .. attribute:: bFlags + + :class:`BYTE` + + + .. attribute:: wValue + + :class:`WORD` + + + .. attribute:: pAddress + + :class:`PVOID` + + + .. attribute:: GrantedAccess + + :class:`DWORD` + +_SYSTEM_HANDLE64 +'''''''''''''''' +.. class:: SYSTEM_HANDLE64 + + Alias for :class:`_SYSTEM_HANDLE64` + +.. class:: _SYSTEM_HANDLE64 + + .. attribute:: dwProcessId + + :class:`DWORD` + + + .. attribute:: bObjectType + + :class:`BYTE` + + + .. attribute:: bFlags + + :class:`BYTE` + + + .. attribute:: wValue + + :class:`WORD` + + + .. attribute:: pAddress + + :class:`ULONG64` + + + .. attribute:: GrantedAccess + + :class:`DWORD` + +_SYSTEM_HANDLE_INFORMATION +'''''''''''''''''''''''''' +.. class:: PSYSTEM_HANDLE_INFORMATION + + Pointer to :class:`_SYSTEM_HANDLE_INFORMATION` + +.. class:: SYSTEM_HANDLE_INFORMATION + + Alias for :class:`_SYSTEM_HANDLE_INFORMATION` + +.. class:: _SYSTEM_HANDLE_INFORMATION + + .. attribute:: HandleCount + + :class:`ULONG` + + + .. attribute:: Handles + + :class:`SYSTEM_HANDLE` + +_SYSTEM_HANDLE_INFORMATION64 +'''''''''''''''''''''''''''' +.. class:: PSYSTEM_HANDLE_INFORMATION64 + + Pointer to :class:`_SYSTEM_HANDLE_INFORMATION64` + +.. class:: SYSTEM_HANDLE_INFORMATION64 + + Alias for :class:`_SYSTEM_HANDLE_INFORMATION64` + +.. class:: _SYSTEM_HANDLE_INFORMATION64 + + .. attribute:: HandleCount + + :class:`ULONG` + + + .. attribute:: Handles + + :class:`SYSTEM_HANDLE64` + +_SYSTEM_HANDLE_EX +''''''''''''''''' +.. class:: PSYSTEM_HANDLE_EX + + Pointer to :class:`_SYSTEM_HANDLE_EX` + +.. class:: SYSTEM_HANDLE_EX + + Alias for :class:`_SYSTEM_HANDLE_EX` + +.. class:: _SYSTEM_HANDLE_EX + + .. attribute:: Object + + :class:`PVOID` + + + .. attribute:: UniqueProcessId + + :class:`HANDLE` + + + .. attribute:: HandleValue + + :class:`HANDLE` + + + .. attribute:: GrantedAccess + + :class:`ULONG` + + + .. attribute:: CreatorBackTraceIndex + + :class:`USHORT` + + + .. attribute:: ObjectTypeIndex + + :class:`USHORT` + + + .. attribute:: HandleAttributes + + :class:`ULONG` + + + .. attribute:: Reserved + + :class:`ULONG` + +_SYSTEM_HANDLE_INFORMATION_EX +''''''''''''''''''''''''''''' +.. class:: PSYSTEM_HANDLE_INFORMATION_EX + + Pointer to :class:`_SYSTEM_HANDLE_INFORMATION_EX` + +.. class:: SYSTEM_HANDLE_INFORMATION_EX + + Alias for :class:`_SYSTEM_HANDLE_INFORMATION_EX` + +.. class:: _SYSTEM_HANDLE_INFORMATION_EX + + .. attribute:: HandleCount + + :class:`ULONG_PTR` + + + .. attribute:: Reserved + + :class:`ULONG_PTR` + + + .. attribute:: Handles + + :class:`SYSTEM_HANDLE_EX` + +_SYSTEM_HANDLE_EX64 +''''''''''''''''''' +.. class:: PSYSTEM_HANDLE_EX64 + + Pointer to :class:`_SYSTEM_HANDLE_EX64` + +.. class:: SYSTEM_HANDLE_EX64 + + Alias for :class:`_SYSTEM_HANDLE_EX64` + +.. class:: _SYSTEM_HANDLE_EX64 + + .. attribute:: Object + + :class:`ULONG64` + + + .. attribute:: UniqueProcessId + + :class:`ULONG64` + + + .. attribute:: HandleValue + + :class:`ULONG64` + + + .. attribute:: GrantedAccess + + :class:`ULONG` + + + .. attribute:: CreatorBackTraceIndex + + :class:`USHORT` + + + .. attribute:: ObjectTypeIndex + + :class:`USHORT` + + + .. attribute:: HandleAttributes + + :class:`ULONG` + + + .. attribute:: Reserved + + :class:`ULONG` + +_SYSTEM_HANDLE_INFORMATION_EX64 +''''''''''''''''''''''''''''''' +.. class:: PSYSTEM_HANDLE_INFORMATION_EX64 + + Pointer to :class:`_SYSTEM_HANDLE_INFORMATION_EX64` + +.. class:: SYSTEM_HANDLE_INFORMATION_EX64 + + Alias for :class:`_SYSTEM_HANDLE_INFORMATION_EX64` + +.. class:: _SYSTEM_HANDLE_INFORMATION_EX64 + + .. attribute:: HandleCount + + :class:`ULONG64` + + + .. attribute:: Reserved + + :class:`ULONG64` + + + .. attribute:: Handles + + :class:`SYSTEM_HANDLE_EX64` + _INTERNET_BUFFERSA '''''''''''''''''' .. class:: INTERNET_BUFFERSA @@ -15411,122 +15681,6 @@ CATALOG_INFO_ :class:`WCHAR` ``[MAX_PATH]`` -_SYSTEM_HANDLE -'''''''''''''' -.. class:: SYSTEM_HANDLE - - Alias for :class:`_SYSTEM_HANDLE` - -.. class:: _SYSTEM_HANDLE - - .. attribute:: dwProcessId - - :class:`DWORD` - - - .. attribute:: bObjectType - - :class:`BYTE` - - - .. attribute:: bFlags - - :class:`BYTE` - - - .. attribute:: wValue - - :class:`WORD` - - - .. attribute:: pAddress - - :class:`PVOID` - - - .. attribute:: GrantedAccess - - :class:`DWORD` - -_SYSTEM_HANDLE64 -'''''''''''''''' -.. class:: SYSTEM_HANDLE64 - - Alias for :class:`_SYSTEM_HANDLE64` - -.. class:: _SYSTEM_HANDLE64 - - .. attribute:: dwProcessId - - :class:`DWORD` - - - .. attribute:: bObjectType - - :class:`BYTE` - - - .. attribute:: bFlags - - :class:`BYTE` - - - .. attribute:: wValue - - :class:`WORD` - - - .. attribute:: pAddress - - :class:`ULONG64` - - - .. attribute:: GrantedAccess - - :class:`DWORD` - -_SYSTEM_HANDLE_INFORMATION -'''''''''''''''''''''''''' -.. class:: PSYSTEM_HANDLE_INFORMATION - - Pointer to :class:`_SYSTEM_HANDLE_INFORMATION` - -.. class:: SYSTEM_HANDLE_INFORMATION - - Alias for :class:`_SYSTEM_HANDLE_INFORMATION` - -.. class:: _SYSTEM_HANDLE_INFORMATION - - .. attribute:: HandleCount - - :class:`ULONG` - - - .. attribute:: Handles - - :class:`SYSTEM_HANDLE` - -_SYSTEM_HANDLE_INFORMATION64 -'''''''''''''''''''''''''''' -.. class:: PSYSTEM_HANDLE_INFORMATION64 - - Pointer to :class:`_SYSTEM_HANDLE_INFORMATION64` - -.. class:: SYSTEM_HANDLE_INFORMATION64 - - Alias for :class:`_SYSTEM_HANDLE_INFORMATION64` - -.. class:: _SYSTEM_HANDLE_INFORMATION64 - - .. attribute:: HandleCount - - :class:`ULONG` - - - .. attribute:: Handles - - :class:`SYSTEM_HANDLE64` - __PUBLIC_OBJECT_TYPE_INFORMATION '''''''''''''''''''''''''''''''' .. class:: PPUBLIC_OBJECT_TYPE_INFORMATION diff --git a/windows/generated_def/meta.py b/windows/generated_def/meta.py index 973ef60f..91773db1 100644 --- a/windows/generated_def/meta.py +++ b/windows/generated_def/meta.py @@ -13473,8 +13473,12 @@ 'PSYSTEM_AUDIT_CALLBACK_OBJECT_ACE', 'PSYSTEM_AUDIT_OBJECT_ACE', 'PSYSTEM_BASIC_INFORMATION', +'PSYSTEM_HANDLE_EX', +'PSYSTEM_HANDLE_EX64', 'PSYSTEM_HANDLE_INFORMATION', 'PSYSTEM_HANDLE_INFORMATION64', +'PSYSTEM_HANDLE_INFORMATION_EX', +'PSYSTEM_HANDLE_INFORMATION_EX64', 'PSYSTEM_MANDATORY_LABEL_ACE', 'PSYSTEM_MODULE32', 'PSYSTEM_MODULE64', @@ -13629,8 +13633,12 @@ 'SYSTEM_BASIC_INFORMATION', 'SYSTEM_HANDLE', 'SYSTEM_HANDLE64', +'SYSTEM_HANDLE_EX', +'SYSTEM_HANDLE_EX64', 'SYSTEM_HANDLE_INFORMATION', 'SYSTEM_HANDLE_INFORMATION64', +'SYSTEM_HANDLE_INFORMATION_EX', +'SYSTEM_HANDLE_INFORMATION_EX64', 'SYSTEM_INFO', 'SYSTEM_MANDATORY_LABEL_ACE', 'SYSTEM_MODULE32', @@ -14211,8 +14219,12 @@ '_SYSTEM_BASIC_INFORMATION', '_SYSTEM_HANDLE', '_SYSTEM_HANDLE64', +'_SYSTEM_HANDLE_EX', +'_SYSTEM_HANDLE_EX64', '_SYSTEM_HANDLE_INFORMATION', '_SYSTEM_HANDLE_INFORMATION64', +'_SYSTEM_HANDLE_INFORMATION_EX', +'_SYSTEM_HANDLE_INFORMATION_EX64', '_SYSTEM_INFO', '_SYSTEM_MANDATORY_LABEL_ACE', '_SYSTEM_MODULE32', diff --git a/windows/generated_def/winstructs.py b/windows/generated_def/winstructs.py index d8b9f13c..67389652 100644 --- a/windows/generated_def/winstructs.py +++ b/windows/generated_def/winstructs.py @@ -2078,6 +2078,90 @@ class _ATTACH_VIRTUAL_DISK_PARAMETERS(Structure): ATTACH_VIRTUAL_DISK_PARAMETERS = _ATTACH_VIRTUAL_DISK_PARAMETERS PATTACH_VIRTUAL_DISK_PARAMETERS = POINTER(_ATTACH_VIRTUAL_DISK_PARAMETERS) +class _SYSTEM_HANDLE(Structure): + _fields_ = [ + ("dwProcessId", DWORD), + ("bObjectType", BYTE), + ("bFlags", BYTE), + ("wValue", WORD), + ("pAddress", PVOID), + ("GrantedAccess", DWORD), + ] +SYSTEM_HANDLE = _SYSTEM_HANDLE + +class _SYSTEM_HANDLE64(Structure): + _fields_ = [ + ("dwProcessId", DWORD), + ("bObjectType", BYTE), + ("bFlags", BYTE), + ("wValue", WORD), + ("pAddress", ULONG64), + ("GrantedAccess", DWORD), + ] +SYSTEM_HANDLE64 = _SYSTEM_HANDLE64 + +class _SYSTEM_HANDLE_INFORMATION(Structure): + _fields_ = [ + ("HandleCount", ULONG), + ("Handles", SYSTEM_HANDLE * (1)), + ] +PSYSTEM_HANDLE_INFORMATION = POINTER(_SYSTEM_HANDLE_INFORMATION) +SYSTEM_HANDLE_INFORMATION = _SYSTEM_HANDLE_INFORMATION + +class _SYSTEM_HANDLE_INFORMATION64(Structure): + _fields_ = [ + ("HandleCount", ULONG), + ("Handles", SYSTEM_HANDLE64 * (1)), + ] +PSYSTEM_HANDLE_INFORMATION64 = POINTER(_SYSTEM_HANDLE_INFORMATION64) +SYSTEM_HANDLE_INFORMATION64 = _SYSTEM_HANDLE_INFORMATION64 + +class _SYSTEM_HANDLE_EX(Structure): + _fields_ = [ + ("Object", PVOID), + ("UniqueProcessId", HANDLE), + ("HandleValue", HANDLE), + ("GrantedAccess", ULONG), + ("CreatorBackTraceIndex", USHORT), + ("ObjectTypeIndex", USHORT), + ("HandleAttributes", ULONG), + ("Reserved", ULONG), + ] +PSYSTEM_HANDLE_EX = POINTER(_SYSTEM_HANDLE_EX) +SYSTEM_HANDLE_EX = _SYSTEM_HANDLE_EX + +class _SYSTEM_HANDLE_INFORMATION_EX(Structure): + _fields_ = [ + ("HandleCount", ULONG_PTR), + ("Reserved", ULONG_PTR), + ("Handles", SYSTEM_HANDLE_EX * (1)), + ] +PSYSTEM_HANDLE_INFORMATION_EX = POINTER(_SYSTEM_HANDLE_INFORMATION_EX) +SYSTEM_HANDLE_INFORMATION_EX = _SYSTEM_HANDLE_INFORMATION_EX + +class _SYSTEM_HANDLE_EX64(Structure): + _fields_ = [ + ("Object", ULONG64), + ("UniqueProcessId", ULONG64), + ("HandleValue", ULONG64), + ("GrantedAccess", ULONG), + ("CreatorBackTraceIndex", USHORT), + ("ObjectTypeIndex", USHORT), + ("HandleAttributes", ULONG), + ("Reserved", ULONG), + ] +PSYSTEM_HANDLE_EX64 = POINTER(_SYSTEM_HANDLE_EX64) +SYSTEM_HANDLE_EX64 = _SYSTEM_HANDLE_EX64 + +class _SYSTEM_HANDLE_INFORMATION_EX64(Structure): + _fields_ = [ + ("HandleCount", ULONG64), + ("Reserved", ULONG64), + ("Handles", SYSTEM_HANDLE_EX64 * (1)), + ] +PSYSTEM_HANDLE_INFORMATION_EX64 = POINTER(_SYSTEM_HANDLE_INFORMATION_EX64) +SYSTEM_HANDLE_INFORMATION_EX64 = _SYSTEM_HANDLE_INFORMATION_EX64 + # Self referencing struct tricks class _INTERNET_BUFFERSA(Structure): pass @@ -7345,44 +7429,6 @@ class CATALOG_INFO_(Structure): ] CATALOG_INFO = CATALOG_INFO_ -class _SYSTEM_HANDLE(Structure): - _fields_ = [ - ("dwProcessId", DWORD), - ("bObjectType", BYTE), - ("bFlags", BYTE), - ("wValue", WORD), - ("pAddress", PVOID), - ("GrantedAccess", DWORD), - ] -SYSTEM_HANDLE = _SYSTEM_HANDLE - -class _SYSTEM_HANDLE64(Structure): - _fields_ = [ - ("dwProcessId", DWORD), - ("bObjectType", BYTE), - ("bFlags", BYTE), - ("wValue", WORD), - ("pAddress", ULONG64), - ("GrantedAccess", DWORD), - ] -SYSTEM_HANDLE64 = _SYSTEM_HANDLE64 - -class _SYSTEM_HANDLE_INFORMATION(Structure): - _fields_ = [ - ("HandleCount", ULONG), - ("Handles", SYSTEM_HANDLE * (1)), - ] -PSYSTEM_HANDLE_INFORMATION = POINTER(_SYSTEM_HANDLE_INFORMATION) -SYSTEM_HANDLE_INFORMATION = _SYSTEM_HANDLE_INFORMATION - -class _SYSTEM_HANDLE_INFORMATION64(Structure): - _fields_ = [ - ("HandleCount", ULONG), - ("Handles", SYSTEM_HANDLE64 * (1)), - ] -PSYSTEM_HANDLE_INFORMATION64 = POINTER(_SYSTEM_HANDLE_INFORMATION64) -SYSTEM_HANDLE_INFORMATION64 = _SYSTEM_HANDLE_INFORMATION64 - class __PUBLIC_OBJECT_TYPE_INFORMATION(Structure): _fields_ = [ ("TypeName", UNICODE_STRING), diff --git a/windows/winobject/handle.py b/windows/winobject/handle.py index eb4deea4..55c71e70 100644 --- a/windows/winobject/handle.py +++ b/windows/winobject/handle.py @@ -20,15 +20,15 @@ def process(self): :type: :class:`WinProcess `""" # "TODO: something smart ? :D" # return [p for p in windows.system.processes if p.pid == self.dwProcessId][0] - return windows.WinProcess(pid=self.dwProcessId) + return windows.WinProcess(pid=self.pid) @property def pid(self): - return self.dwProcessId + raise NotImplementedError("{}.pid".format(type(self))) @property def value(self): - return self.wValue + raise NotImplementedError("{}.value".format(type(self))) @windows.utils.fixedpropety @@ -85,10 +85,10 @@ def local_handle(self): """A local copy of the handle, acquired with ``DuplicateHandle`` :type: :class:`int`""" - if self.dwProcessId == windows.current_process.pid: - return self.wValue + if self.pid == windows.current_process.pid: + return self.value res = gdef.HANDLE() - winproxy.DuplicateHandle(self.process.handle, self.wValue, windows.current_process.handle, ctypes.byref(res), dwOptions=gdef.DUPLICATE_SAME_ACCESS) + winproxy.DuplicateHandle(self.process.handle, self.value, windows.current_process.handle, ctypes.byref(res), dwOptions=gdef.DUPLICATE_SAME_ACCESS) return res.value def description(self): @@ -99,47 +99,78 @@ def description(self): return descr_func() def description_Process(self): - proc = windows.WinProcess(handle=self.wValue) + proc = windows.WinProcess(handle=self.value) res = str(proc) del proc._handle return res def description_Thread(self): - thread = windows.WinThread(handle=self.wValue) + thread = windows.WinThread(handle=self.value) res = str(thread) del thread._handle return res def __repr__(self): - return "<{0} value=<0x{1:x}> in process pid={2}>".format(type(self).__name__, self.wValue, self.dwProcessId) + return "<{0} value=<0x{1:x}> in process pid={2}>".format(type(self).__name__, self.value, self.pid) def __del__(self): - if self.dwProcessId == current_process_pid: + if self.pid == current_process_pid: return if hasattr(self, "_local_handle"): return self._close_function(self._local_handle) class Handle(gdef.SYSTEM_HANDLE, BaseSystemHandle): - pass + @property + def pid(self): + return self.dwProcessId + + @property + def value(self): + return self.wValue class HandleWow64(gdef.SYSTEM_HANDLE64, BaseSystemHandle): - pass # For wow64 process + @property + def pid(self): + return self.dwProcessId + + @property + def value(self): + return self.wValue + + +class HandleEx(gdef.SYSTEM_HANDLE_EX, BaseSystemHandle): + @property + def pid(self): + return self.UniqueProcessId + + @property + def value(self): + return self.HandleValue + +class HandleExWow64(gdef.SYSTEM_HANDLE_EX64, BaseSystemHandle): + @property + def pid(self): + return self.UniqueProcessId + + @property + def value(self): + return self.HandleValue def enumerate_handles(): if windows.current_process.is_wow_64: return enumerate_handles_syswow64() size_needed = gdef.ULONG() # Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION) - tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION)() + tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION_EX)() try: - winproxy.NtQuerySystemInformation(gdef.SystemHandleInformation, tmp_buffer, tmp_buffer.real_size, ReturnLength=ctypes.byref(size_needed)) + winproxy.NtQuerySystemInformation(gdef.SystemExtendedHandleInformation, tmp_buffer, tmp_buffer.real_size, ReturnLength=ctypes.byref(size_needed)) except WindowsError as e: pass size = size_needed.value + 0x1000 # In case we have some more handle created - buf = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION)(size=size) + buf = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION_EX)(size=size) size_needed.value = 0 - winproxy.NtQuerySystemInformation(gdef.SystemHandleInformation, buf, buf.real_size, ReturnLength=ctypes.byref(size_needed)) - handle_array = windows.utils.resized_array(buf[0].Handles, buf[0].HandleCount, Handle) + winproxy.NtQuerySystemInformation(gdef.SystemExtendedHandleInformation, buf, buf.real_size, ReturnLength=ctypes.byref(size_needed)) + handle_array = windows.utils.resized_array(buf[0].Handles, buf[0].HandleCount, HandleEx) return list(handle_array) @@ -148,16 +179,16 @@ def enumerate_handles_syswow64(): raise NotImplementedError("Crossing heaven gate x86 -> arm64 not implemented") size_needed = gdef.ULONG() # Should at least be sizeof(gdef.SYSTEM_HANDLE_INFORMATION) - tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION64)() + tmp_buffer = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION_EX64)() try: - windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemHandleInformation, tmp_buffer, tmp_buffer.real_size, ReturnLength=ctypes.byref(size_needed)) + windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemExtendedHandleInformation, tmp_buffer, tmp_buffer.real_size, ReturnLength=ctypes.byref(size_needed)) except WindowsError as e: pass size = size_needed.value + 0x1000 # In case we have some more handle created - buf = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION64)(size=size) + buf = windows.utils.BUFFER(gdef.SYSTEM_HANDLE_INFORMATION_EX64)(size=size) size_needed.value = 0 - windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemHandleInformation, buf, buf.real_size, ReturnLength=ctypes.byref(size_needed)) - handle_array = windows.utils.resized_array(buf[0].Handles, buf[0].HandleCount, HandleWow64) + windows.syswow64.NtQuerySystemInformation_32_to_64(gdef.SystemExtendedHandleInformation, buf, buf.real_size, ReturnLength=ctypes.byref(size_needed)) + handle_array = windows.utils.resized_array(buf[0].Handles, buf[0].HandleCount, HandleExWow64) return list(handle_array) diff --git a/windows/winobject/process.py b/windows/winobject/process.py index 22487b01..9f4212b0 100644 --- a/windows/winobject/process.py +++ b/windows/winobject/process.py @@ -581,7 +581,7 @@ def set_security_descriptor(self, sd): @property # Document ? def handles(self): pid = self.pid - return [h for h in windows.system.handles if h.dwProcessId == pid] + return [h for h in windows.system.handles if h.pid == pid] def __del__(self): # sys.path is not None -> check if python shutdown From e0145907c4587e56d024aededb563d7e7ed42a82 Mon Sep 17 00:00:00 2001 From: hakril Date: Mon, 26 Oct 2026 11:45:14 +0100 Subject: [PATCH 2/2] Fix test --- tests/test_handle.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_handle.py b/tests/test_handle.py index feda7818..5b827032 100644 --- a/tests/test_handle.py +++ b/tests/test_handle.py @@ -5,10 +5,10 @@ @cross_heaven_gates # windows.system.handles def test_handle_process_id(): - handle_with_process = [h for h in windows.system.handles if h.dwProcessId] + handle_with_process = [h for h in windows.system.handles if h.pid] handle = handle_with_process[-1] proc = handle.process - assert proc.pid == handle.dwProcessId == handle.pid + assert proc.pid == handle.UniqueProcessId == handle.pid @cross_heaven_gates # windows.current_process.handles def test_local_handle_type():