Skip to content
This repository has been archived by the owner on Oct 2, 2024. It is now read-only.

add ability to query handles associated with a given win-def:process58_test #94

Open
djhaynes opened this issue Aug 19, 2013 · 2 comments

Comments

@djhaynes
Copy link
Contributor

Need to be able to enumerate all handles associate with a process. This
includes:

  • Sockets (source, dest, sourceport, destport, protocol)
  • Mutants (name)
  • Others: File, Registry, Pipes, etc

Handle information is available via NtQuerySystemInformation
(http://msdn.microsoft.com/en-us/library/ms724509(v=vs.85).aspx). Note that the
GetProcessHandleCount Function is preferred
(http://msdn.microsoft.com/en-us/library/ms683214(v=vs.85).aspx) since it is a
supported api.

This request does overlap in part with the Mutex community suggestion, handles
could be considered system wide objects outside of the scope of the Process
Object.

Details of this request are outlined in the following developer list message:
http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html
See slide 10.

@djhaynes
Copy link
Contributor Author

This item will be deferred in version 5.10. handle information should be
addressed more broadly once there is better community understanding of how this
sort of test will be used.

@djhaynes
Copy link
Contributor Author

This is a duplicate of #12.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant