Problem with NtQuerySystemInformation with some w10

Question

Problem with NtQuerySystemInformation with some w10

im working over foreing code, its an antihack for a mmorpg game. Being said that, the code present crash or false detection in some Windows 10 users (it works always great for 7 and 8.1), te problem came from a function that uses NtQuerySystemInformation and then compare process handles.

Thx for any who can help or give a hint. Im gonna leave the code for you:

ProcessQuery.h

#pragma once

typedef LONG KPRIORITY;

typedef NTSTATUS(WINAPI*NTQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);

#define STATUS_SUCCESS ((NTSTATUS)0x00000000)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004)
#define STATUS_DATA_ERROR ((NTSTATUS)0xC000003E)
#define SystemExtendedProcessInformation ((SYSTEM_INFORMATION_CLASS)57)
#define SystemHandleInformation ((SYSTEM_INFORMATION_CLASS)16)
#define SystemExtendedHandleInformation ((SYSTEM_INFORMATION_CLASS)64)
#define SystemKernelDebuggerInformation ((SYSTEM_INFORMATION_CLASS)35)

enum THREAD_STATE
{
    Running = 2,
    Waiting = 5,
};

enum KWAIT_REASON
{
    Executive = 0,
    FreePage = 1,
    PageIn = 2,
    PoolAllocation = 3,
    DelayExecution = 4,
    Suspended = 5,
    UserRequest = 6,
    WrExecutive = 7,
    WrFreePage = 8,
    WrPageIn = 9,
    WrPoolAllocation = 10,
    WrDelayExecution = 11,
    WrSuspended = 12,
    WrUserRequest = 13,
    WrEventPair = 14,
    WrQueue = 15,
    WrLpcReceive = 16,
    WrLpcReply = 17,
    WrVirtualMemory = 18,
    WrPageOut = 19,
    WrRendezvous = 20,
    Spare2 = 21,
    Spare3 = 22,
    Spare4 = 23,
    Spare5 = 24,
    WrCalloutStack = 25,
    WrKernel = 26,
    WrResource = 27,
    WrPushLock = 28,
    WrMutex = 29,
    WrQuantumEnd = 30,
    WrDispatchInt = 31,
    WrPreempted = 32,
    WrYieldExecution = 33,
    WrFastMutex = 34,
    WrGuardedMutex = 35,
    WrRundown = 36,
    MaximumWaitReason = 37,
};

struct CLIENT_ID
{
    PVOID UniqueProcess;
    PVOID UniqueThread;
};

struct SYSTEM_THREAD_INFO
{
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER CreateTime;
    ULONG WaitTime;
    PVOID StartAddress;
    CLIENT_ID ClientId;
    KPRIORITY Priority;
    LONG BasePriority;
    ULONG ContextSwitches;
    ULONG ThreadState;
    KWAIT_REASON WaitReason;
};

struct SYSTEM_EXTENDED_THREAD_INFO
{
    SYSTEM_THREAD_INFO ThreadInfo;
    PVOID StackBase;
    PVOID StackLimit;
    PVOID Win32StartAddress;
    PVOID TebAddress; // since VISTA
    ULONG Reserved1;
    ULONG Reserved2;
    ULONG Reserved3;
};

struct SYSTEM_PROCESS_INFO
{
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER WorkingSetPrivateSize; // since VISTA
    ULONG HardFaultCount; // since WIN7
    ULONG NumberOfThreadsHighWatermark; // since WIN7
    ULONGLONG CycleTime; // since WIN7
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SessionId;
    ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
    SIZE_T PeakVirtualSize;
    SIZE_T VirtualSize;
    ULONG PageFaultCount;
    SIZE_T PeakWorkingSetSize;
    SIZE_T WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
    SYSTEM_THREAD_INFO Threads[1];
};

struct SYSTEM_EXTENDED_PROCESS_INFO
{
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER WorkingSetPrivateSize; // since VISTA
    ULONG HardFaultCount; // since WIN7
    ULONG NumberOfThreadsHighWatermark; // since WIN7
    ULONGLONG CycleTime; // since WIN7
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SessionId;
    ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
    SIZE_T PeakVirtualSize;
    SIZE_T VirtualSize;
    ULONG PageFaultCount;
    SIZE_T PeakWorkingSetSize;
    SIZE_T WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
    SYSTEM_EXTENDED_THREAD_INFO Threads[1];
};

struct SYSTEM_HANDLE_ENTRY_INFO
{
    USHORT UniqueProcessId;
    USHORT CreatorBackTraceIndex;
    UCHAR ObjectTypeIndex;
    UCHAR HandleAttributes;
    USHORT HandleValue;
    PVOID Object;
    ULONG GrantedAccess;
};

struct SYSTEM_HANDLE_INFO
{
    ULONG NumberOfHandles;
    SYSTEM_HANDLE_ENTRY_INFO Handles[1];
};

struct SYSTEM_HANDLE_ENTRY_INFO_EX
{
    PVOID Object;
    ULONG UniqueProcessId;
    ULONG HandleValue;
    ULONG GrantedAccess;
    USHORT CreatorBackTraceIndex;
    USHORT ObjectTypeIndex;
    ULONG HandleAttributes;
    ULONG Reserved;
};

struct SYSTEM_HANDLE_INFO_EX
{
    ULONG NumberOfHandles;
    ULONG Reserved;
    SYSTEM_HANDLE_ENTRY_INFO_EX Handles[1];
};

struct SYSTEM_KERNEL_DEBUGGER_INFO
{
    BOOLEAN DebuggerEnabled;
    BOOLEAN DebuggerNotPresent;
};

class CProcessQuery
{
public:
    CProcessQuery();
    virtual ~CProcessQuery();
    void Start();
    void Close();
    bool Fetch(SYSTEM_INFORMATION_CLASS SysInfoClass,DWORD QuerySize);
    SYSTEM_HANDLE_INFO* GetHandleInfo();
    SYSTEM_HANDLE_INFO_EX* GetExtendedHandleInfo();
    SYSTEM_KERNEL_DEBUGGER_INFO* GetKernelDebuggerInfo();
    SYSTEM_PROCESS_INFO* GetProcessInfoByID(HANDLE ProcessId);
    SYSTEM_EXTENDED_PROCESS_INFO* GetExtendedProcessInfoByID(HANDLE ProcessId);
    SYSTEM_THREAD_INFO* GetThreadInfoByID(SYSTEM_PROCESS_INFO* lpSystemProcessInfo,HANDLE ThreadId);
    SYSTEM_EXTENDED_THREAD_INFO* GetExtendedThreadInfoByID(SYSTEM_EXTENDED_PROCESS_INFO* lpSystemProcessInfo,HANDLE ThreadId);
public:
    static NTQUERYSYSTEMINFORMATION m_NtQuerySystemInformation;
private:
    BYTE* m_QueryData;
    DWORD m_QuerySize;
    NTSTATUS m_QueryStatus;
};

ProcessQuery.cpp:

void CProcessQuery::Start() // OK
{
    this->m_QueryData = 0;

    this->m_QuerySize = 0;

    this->m_QueryStatus = STATUS_SUCCESS;
}

void CProcessQuery::Close() // OK
{
    this->m_QueryData = ((this->m_QueryData==0)?(BYTE*)0:((HeapFree(GetProcessHeap(),0,this->m_QueryData)==0)?(BYTE*)0:(BYTE*)0));

    this->m_QuerySize = 0;

    this->m_QueryStatus = STATUS_SUCCESS;
}

bool CProcessQuery::Fetch(SYSTEM_INFORMATION_CLASS SysInfoClass,DWORD QuerySize) // OK
{
    while(this->m_QueryData != 0 || (this->m_QueryData=(BYTE*)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(this->m_QuerySize=((this->m_QuerySize<QuerySize)?QuerySize:this->m_QuerySize)))) != 0)
    {
        DWORD ReturnLength;

        if((this->m_QueryStatus=CProcessQuery::m_NtQuerySystemInformation(SysInfoClass,this->m_QueryData,this->m_QuerySize,&ReturnLength)) == STATUS_INFO_LENGTH_MISMATCH)
        {
            this->m_QueryData = ((this->m_QueryData==0)?(BYTE*)0:((HeapFree(GetProcessHeap(),0,this->m_QueryData)==0)?(BYTE*)0:(BYTE*)0));
            this->m_QuerySize = ReturnLength;
        }
        else
        {
            return ((this->m_QueryStatus==STATUS_SUCCESS)?1:0);
        }
    }

    return 0;
}

SYSTEM_HANDLE_INFO* CProcessQuery::GetHandleInfo() // OK
{
    return ((SYSTEM_HANDLE_INFO*)this->m_QueryData);
}

SYSTEM_HANDLE_INFO_EX* CProcessQuery::GetExtendedHandleInfo() // OK
{
    return ((SYSTEM_HANDLE_INFO_EX*)this->m_QueryData);
}

SYSTEM_KERNEL_DEBUGGER_INFO* CProcessQuery::GetKernelDebuggerInfo() // OK
{
    return ((SYSTEM_KERNEL_DEBUGGER_INFO*)this->m_QueryData);
}

SYSTEM_PROCESS_INFO* CProcessQuery::GetProcessInfoByID(HANDLE ProcessId) // OK
{
    SYSTEM_PROCESS_INFO* lpSystemProcessInfo = (SYSTEM_PROCESS_INFO*)this->m_QueryData;

    while(true)
    {
        if(lpSystemProcessInfo->UniqueProcessId == ProcessId)
        {
            return lpSystemProcessInfo;
        }

        if(lpSystemProcessInfo->NextEntryOffset == 0)
        {
            break;
        }

        lpSystemProcessInfo = (SYSTEM_PROCESS_INFO*)((BYTE*)lpSystemProcessInfo+lpSystemProcessInfo->NextEntryOffset);
    }

    return 0;
}

SYSTEM_EXTENDED_PROCESS_INFO* CProcessQuery::GetExtendedProcessInfoByID(HANDLE ProcessId) // OK
{
    SYSTEM_EXTENDED_PROCESS_INFO* lpSystemProcessInfo = (SYSTEM_EXTENDED_PROCESS_INFO*)this->m_QueryData;

    while(true)
    {
        if(lpSystemProcessInfo->UniqueProcessId == ProcessId)
        {
            return lpSystemProcessInfo;
        }

        if(lpSystemProcessInfo->NextEntryOffset == 0)
        {
            break;
        }

        lpSystemProcessInfo = (SYSTEM_EXTENDED_PROCESS_INFO*)((BYTE*)lpSystemProcessInfo+lpSystemProcessInfo->NextEntryOffset);
    }

    return 0;
}

SYSTEM_THREAD_INFO* CProcessQuery::GetThreadInfoByID(SYSTEM_PROCESS_INFO* lpSystemProcessInfo,HANDLE ThreadId) // OK
{
    SYSTEM_THREAD_INFO* lpSystemThreadInfo = lpSystemProcessInfo->Threads;

    for(DWORD n=0;n < lpSystemProcessInfo->NumberOfThreads;n++,lpSystemThreadInfo++)
    {
        if(lpSystemThreadInfo->ClientId.UniqueThread == ThreadId)
        {
            return lpSystemThreadInfo;
        }
    }

    return 0;
}

SYSTEM_EXTENDED_THREAD_INFO* CProcessQuery::GetExtendedThreadInfoByID(SYSTEM_EXTENDED_PROCESS_INFO* lpSystemProcessInfo,HANDLE ThreadId) // OK
{
    SYSTEM_EXTENDED_THREAD_INFO* lpSystemThreadInfo = lpSystemProcessInfo->Threads;

    for(DWORD n=0;n < lpSystemProcessInfo->NumberOfThreads;n++,lpSystemThreadInfo++)
    {
        if(lpSystemThreadInfo->ThreadInfo.ClientId.UniqueThread == ThreadId)
        {
            return lpSystemThreadInfo;
        }
    }

    return 0;
}

Scan Function:

bool HANDLE_PROTECTION_INIT() // OK
{
    CProcessQuery ProcessQuery;

    HANDLE HandleValue = OpenProcess(PROCESS_VM_READ,0,GetCurrentProcessId());

    if(ProcessQuery.Fetch(SystemExtendedHandleInformation,sizeof(SYSTEM_HANDLE_INFO_EX)) != 0)
    {
        SYSTEM_HANDLE_INFO_EX* lpSystemHandleInfo = ProcessQuery.GetExtendedHandleInfo();

        if(lpSystemHandleInfo != 0)
        {
            SYSTEM_HANDLE_ENTRY_INFO_EX* lpSystemHandleEntryInfo = lpSystemHandleInfo->Handles;

            if(lpSystemHandleEntryInfo != 0)
            {
                for(DWORD n=0;n < lpSystemHandleInfo->NumberOfHandles;n++,lpSystemHandleEntryInfo++)
                {
                    if(lpSystemHandleEntryInfo->UniqueProcessId == GetCurrentProcessId() && lpSystemHandleEntryInfo->HandleValue == ((DWORD)HandleValue))
                    {
                        HandleProtectionNumber = (DWORD)lpSystemHandleEntryInfo->ObjectTypeIndex;
                        HandleProtectionObject = (DWORD)lpSystemHandleEntryInfo->Object;
                        ProcessQuery.Close();
                        return 1;
                    }
                }
            }
        }
    }

    ProcessQuery.Close();

    return 0;
}

bool HANDLE_PROTECTION_SCAN() // THIS FUNCTION IS CALLED IN A THREAD EVERY 2000 MS.
{
    if(gMemoryGuardSwitch == 0 || (gMemoryGuardNumber & MEMORY_GUARD_NUMBER_HANDLE) == 0)
    {
        return 1;
    }

    static CProcessQuery ProcessQuery;

    std::map<DWORD,std::vector<DWORD>> HandleProtectionTable;

    if(ProcessQuery.Fetch(SystemExtendedHandleInformation,sizeof(SYSTEM_HANDLE_INFO_EX)) != 0)
    {
        SYSTEM_HANDLE_INFO_EX* lpSystemHandleInfo = ProcessQuery.GetExtendedHandleInfo();

        if(lpSystemHandleInfo != 0)
        {
            SYSTEM_HANDLE_ENTRY_INFO_EX* lpSystemHandleEntryInfo = lpSystemHandleInfo->Handles;

            if(lpSystemHandleEntryInfo != 0)
            {
                for(DWORD n=0;n < lpSystemHandleInfo->NumberOfHandles;n++,lpSystemHandleEntryInfo++)
                {
                    if(lpSystemHandleEntryInfo->UniqueProcessId != GetCurrentProcessId() && lpSystemHandleEntryInfo->ObjectTypeIndex == HandleProtectionNumber && lpSystemHandleEntryInfo->Object == ((LPVOID)HandleProtectionObject) && (lpSystemHandleEntryInfo->GrantedAccess & PROCESS_VM_WRITE) != 0)
                    {
                        std::map<DWORD,std::vector<DWORD>>::iterator it = HandleProtectionTable.find(lpSystemHandleEntryInfo->UniqueProcessId);

                        if(it == HandleProtectionTable.end())
                        {
                            HandleProtectionTable.insert(std::pair<DWORD,std::vector<DWORD>>(lpSystemHandleEntryInfo->UniqueProcessId,std::vector<DWORD>(1,lpSystemHandleEntryInfo->HandleValue)));
                            continue;
                        }
                        else
                        {
                            if(it->second.size() >= MAX_HANDLE_PROTECTION_COUNT)
                            {
                                CGDetect(CLIENT_DISCONNECT_MEMORY_DETECTION, 0, 0);
                                //CHClientDisconnectSend(CLIENT_DISCONNECT_MEMORY_DETECTION,0,lpSystemHandleEntryInfo->UniqueProcessId);
                                return 0;
                            }
                            else
                            {
                                it->second.push_back(lpSystemHandleEntryInfo->HandleValue);
                                continue;
                            }
                        }
                    }
                }
            }
        }
    }

    return 1;
}

Memory Guard Struct:

enum eMemoryGuardNumber
{
    MEMORY_GUARD_NUMBER_NONE = 0,
    MEMORY_GUARD_NUMBER_HANDLE = 1,
    MEMORY_GUARD_NUMBER_INJECT = 2,
};
if(IsWindows10OrGreater)
    {
        DWORD gMemoryGuardNumber = 8;
    }
    else
    {
        DWORD gMemoryGuardNumber = 3;
    }

memory

handle

asked on Stack Overflow Apr 1, 2020 by

Ivan Perazzo • edited Apr 1, 2020 by

Ivan Perazzo

1 Answer

Well, in case is usefull to someone, problem is handlecount if different in w7 than in w10... have to put up to 12 in w10 for correctly use

answered on Stack Overflow Apr 24, 2020 by

Ivan Perazzo

User contributions licensed under CC BY-SA 3.0