windows - NtQueryObject hangs on object type number 30 with specific access mask -

-

i have seen ntqueryobject hang duplicated handles these granted access values (handle.grantedaccess access_mask type):

1179785 (integer) --> 0b100100000000010001001 (binary) 1180063 (integer) --> 0b100100000000110011111 (binary) 1180041 (integer) --> 0b100100000000110001001 (binary) 2032127 (integer) --> 0b111110000000111111111 (binary)                              ||||||| |   |                              ||||||| |   |                              ||||||| |   |                              ^^^^^^^ ^   ^  possible culprit bits seem 3rd , 7th bit, 9th 15th bit.

always, handle.objecttypenumber 30. object type number, , how can list of specific rights of type? experiments have kind of shown must bits 0-15 causing hang on object type number of 30 (integer). handle system_handle type defined as:

typedef struct _system_handle {     ulong processid;     byte objecttypenumber;     byte flags;     ushort handle;     pvoid object;     access_mask grantedaccess; } system_handle, *psystem_handle;

i writing forensic tool enumerate open file handles using method described here.

i'm little late, if you're interested in disk-based files, can this:

if(getfiletype(handle) == file_type_disk) {     ... }

the hang happens non-disk files (such pipes). technique, don't need worry handle.grantedaccess @ all.


Comments

Post a Comment

Popular posts from this blog

c++ - QTextObjectInterface with Qml TextEdit (QQuickTextEdit) -

-
i registred handler simple qtextobjectinterface , draws 10x10 red rectangle. when used qtextedit in normal qwidget app, worked. when used qquicktextedit (textedit qml component) in qt quick app, doesn't worked (nothing drawed, rectangle in textedit reserved, because when change cursor position, notice there something, empty space, nothing drawed. qtextobjectinterface intrinsicsize method called (that explains why see there empty space 10x10), drawobject method isn't. i did research , found problem here: qquicktextedit.cpp qt 5.3.0 sources (line 1821) qsgnode *qquicktextedit::updatepaintnode(qsgnode *oldnode, updatepaintnodedata *updatepaintnodedata) { . . . if (textframe->firstposition() > textframe->lastposition() && textframe->frameformat().position() != qtextframeformat::inflow) { updatenodetransform(node, d->document->documentlayout()->frameboundingrect(textframe).topleft()); c...
Read more

javascript - angular ng-required radio button not toggling required off in firefox 33, OK in chrome -

-
i trying toggle required attribute on radio button using angular show html5 popup. i cannot following code function correctly in firefox 33. function correctly in chrome. required property being toggled via checkbox value, in firefox, when set false radio button still acts required , shows html5 required popup. see plnkr below example doesn't work me in ff 33. <!doctype html> <html> <head> <script data-require="angular.js@*" data-semver="1.3.1" src="//code.angularjs.org/1.3.1/angular.js"></script> <link href="style.css" rel="stylesheet" /> <script src="script.js"></script> </head> <body ng-app="myapp"> <script> angular.module('myapp',[]) .controller('mycontroller',['$scope',function($scope) { $scope.foorequired=true; $scope.submitform = function() { $scope.submitmessage = ...
Read more

xcode - Swift Playground - Files are not readable -

-
Image
files not readable in swift playground . how make files readable? same code runs on xcode terminal app, fails on swift playground. demo code below. import foundation println("hello, world!") var fname:string = "/users/holyfield/desktop/com.apple.iconcomposer.plist" var fm:nsfilemanager = nsfilemanager.defaultmanager() if(fm.fileexistsatpath(fname)){ println("file exists") if(fm.isreadablefileatpath(fname)){ println("file readable") var fd:nsdata? = nsdata(contentsoffile: fname) println(fd?.length) let pl = nsdictionary(contentsoffile: fname) println(pl?.count) println(pl?.allkeys) }else{ println("file not readable") } } else{ println("file not exists") } sample images: i have thank nate cook first quick response , solid answer. just case share answer post, title misleading. see nate's answer here: https://stackoverf...
Read more