A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #25652  by cziter15
 Thu Apr 16, 2015 8:48 am

I want to control access rights of specific handle.
How to do this from ring0 driver?
What is the best way?
 #25659  by cziter15
 Thu Apr 16, 2015 4:18 pm
I am already using ObRegisterCallbacks and it is working for newly created handles only.
I want to revoke all already existing handles access rights after ObCallbacks registration, because
when someone obtain handle before my ObRegisterCallbacks call, it will still be accessible.
 #25661  by Brock
 Fri Apr 17, 2015 2:22 am

There exists no clean way to do what you're asking. If a handle is acquired before your callback is installed then you are at the mercy of the other processes, for the most part. You could however close existing handles by enumerating all currently active processes, attach to their context and enumerate their handle table for the specific handle you're interested in. It's not pretty but works for handles opened pre-callback installation

KeStackAttachProcess(Process, &ApcState) ---> Enum Handle Table ---> ZwSetInformationObject(TargetHandle, ObjectHandleFlagInformation, &HandleData.ProtectFromClose = FALSE, sizeof(HandleData)) ---> ZwClose(TargetHandle) ---> KeUnstackDetachProcess(&ApcState)

P.S: If you don't mind getting dirtier then you could try setting a new granted access for the handle in the table entry but personally I've never modified the access this way, I've always just closed them for the sake of simplicity.

Best Regards,
 #25667  by cziter15
 Fri Apr 17, 2015 1:18 pm
Thank you Brock. Looks like I have to manually enumerate handles by PEProcess->HandleTable and then remove interesting bits from mask handle by handle.

@Any mod, please change topic "Change ha" to "Change handle access mask". Thanks.
 #25669  by Brock
 Fri Apr 17, 2015 2:36 pm
You're welcome. Sorry that it's not what you wanted to hear but I don't see any other way to achieve what you've asked. Good luck!

Best Regards,
 #25671  by cziter15
 Fri Apr 17, 2015 3:15 pm
Most disadvantage of my concept is to load driver at request, but I have to do that.
So, that's why I have to enumerate and revoke accesses.

On x86 it was soo easy, just by placing hook on ObReferenceObjectByHandle and
then checking handles "on reference handle" instead of "on open/create handle"
 #25679  by Brock
 Sat Apr 18, 2015 2:14 pm
Just remember to install the callback first and then do the enumeration + modification of handle granted access bitmask, otherwise you're susceptible to a race condition

Best Regards,
 #25713  by cziter15
 Wed Apr 22, 2015 8:20 am
RESOLVED the problem using ExpLookupHandleTableEntry unexported function.
Code: Select all
   IN PHANDLE_TABLE 	HandleTable,
   IN EXHANDLE 	LookupHandle