Handles#

Handles are tokens used to identify and reference system resource such as memory blocks, processes, threads, files, registry keys and device drivers. Handles are usually integers or pointer values.

Windows Object Handles#

Windows object handles are issued and managed by the kernel.

Internally, the kernel defines a handle as a C/C++ union called HANDLE_TABLE_ENTRY. The context in which the handle is being used determines the union definition that applies.

NOTE

The HANDLE_TABLE_ENTRY is an undocumented Windows structure and may vary between Windows major and minor releases.

1
union _HANDLE_TABLE_ENTRY {
2
    volatile long long VolatileLowValue;
3
    long long LowValue;
4
    struct {
5
        struct _HANDLE_TABLE_ENTRY_INFO* volatile InfoTable;
6
        long long HighValue;
7
        union _HANDLE_TABLE_ENTRY* NextFreeHandleEntry;
8
        struct _EXHANDLE LeafHandleValue;
9
    };
10
    long long RefCountField;
11
    unsigned long long Unlocked:1;
12
    unsigned long long RefCnt:16;
13
    unsigned long long Attributes:3;
14
    struct {
15
        unsigned long long ObjectPointerBits:44;
16
        unsigned long GrantedAccessBits:25;
17
        unsigned long NoRightsUpgrade:1;
18
        unsigned long Spare1:6;
19
    };
20
    unsigned long Spare2;
21
};

Process Handles#

In a process context, the HANDLE_TABLE_ENTRY is interpreted as follows:

1
struct _HANDLE_TABLE_ENTRY {
2
    unsigned long long ObjectPointerBits:44;
3
    unsigned long GrantedAccessBits:25;
4
    unsigned long NoRightsUpgrade:1;
5
    unsigned long Spare1:6;
6
};

To obtain a resource handle, a process typically opens the resource using Win32 API calls, OpenProcess, OpenFile. A process can open multiple handles to the same resource. In this scenario, the ObjectPointerBits are similar but the GrantedAccessBits might defer based on the requested and granted access permissions.

NOTE

The Win32 API is well documented and provides definitions for API calls to work with resource handles.

TIP

Handles obtained when a process is in kernel mode are normally granted higher access rights to resources. To prevent handle leaks, it is important for processes to close handles when done working with the resources. This also helps in preventing malicious applications from hijacking handles to protected system resources.

The Windows kernel also closes all handles obtained by a process when it terminates or is killed.

Locating Process Handles#

Each process is represented in the kernel by a C/C++ structure called the EPROCESS.

NOTE

The EPROCESS structure is enormous and undocumented. For brevity, the definition is shortened to the interesting part.

struct _EPROCESS {
    // ...                                     // 0x0-0x560
    struct _EPROCESS_QUOTA_BLOCK* QuotaBlock;  // 0x568
    struct _HANDLE_TABLE* ObjectTable;         // 0x570
    VOID* DebugPort;                           // 0x578
    struct _EWOW64PROCESS* WoW64Process;       // 0x580
    // ...                                     // 0x588-0x70
}

The ObjectTable member of the EPROCESS points to another C/C++ structure called the HANDLE_TABLE. The HANDLE_TABLE provides valuable information needed to enumerate all handles opened by a process as well as all handles opened by other processes in the system.

Basically, if you locate the HANDLE_TABLE for one process, you can locate for any other process in the system including the kernel and protected Windows processes.

NOTE

The definition of the HANDLE_TABLE is again shortened for brevity. This is also an undocumented structure.

struct HANDLE_TABLE {
    unsigned long NextHandleNeedingPool;
    long ExtraInfoPages;
    volatile unsigned long long TableCode;
    struct _EPROCESS* QuotaProcess;
    struct _LIST_ENTRY HandleTableList;
    ULONG UniqueProcessId;
    //....
};

The NextHandleNeedingPool, TableCode, and HandleTableList are very important members of the HANDLE_TABLE.

1
struct _LIST_ENTRY {
2
    struct _LIST_ENTRY* Flink;  //0x0
3
    struct _LIST_ENTRY* Blink;  //0x8
4
};

HANDLE_TABLE* pNextTable = (HANDLE_TABLE*)((unsigned long long)pHandleTable->HandleTableList - offsetof(HANDLE_TABLE, HandleTableList) );

# Get the layout from the TableCode
int layout = HandleTable.TableCode & 3;

# Get page pointer from the TableCode
void* page_pointer  = (void*)(HandleTable.TableCode & ~3);

# in x64
max_entries = (4096 / 16) - 1 = 255

# in x86
max_entries = (4096 / 8) - 1 = 511

page_pointer
├── handle_table_entry_00
├── handle_table_entry_01
└── handle_table_entry_02

page_pointer
├── page_pointer_A
|   ├── handle_table_entry_A0
|   ├── handle_table_entry_A1
|   └── ...
└── page_pointer_B
    ├── handle_table_entry_Bx
    ├── handle_table_entry_Bx
    └── ...

page_pointer
├── page_pointer_A
|   ├── page_pointer_A0
|   |   ├── handle_table_entry_A00
|   |   ├── handle_table_entry_A01
|   |   └── ...
|   ├── page_pointer_A1
|   |   ├── handle_table_entry_A10
|   |   ├── handle_table_entry_A11
|   |   └── ...
|   └── ....
└── page_pointer_B
    ├── page_pointer_B0
    |   ├── handle_table_entry_B00
    |   ├── handle_table_entry_B01
    |   └── ...
    ├── page_pointer_B1
    |   ├── handle_table_entry_B10
    |   ├── handle_table_entry_B11
    |   └── ...
    └── ...

Summary#

• Each process is represented by an EPROCESS structure in the kernel.
• The ObjectTable member or the EPROCESS points to the process’s handle table, HANDLE_TABLE.
• The HandleTableList member of the handle table is an entry in a circular doubly linked list of all handle tables in the system.
• The TableCode member of the handle table, points to a page whose interpretation depends on the lower 2 bits of its value known as the layout.
• Each handle is unique with its own set of attributes.

Conclusion#

You now have a much better understanding of how object handles work in Windows. Given a debugger like livekd or windbg, you are now armed with enough information to manually traverse your way around the kernel to find the various object handles.

WARNING

The post makes several references to undocumented internal Windows structures. These structures are subject to change with changes in Windows releases and updates. Make sure to get updated structures for your specific Windows build.

WARNING

The information given herein is for educational purposes only.
This gives a deaper understanding of the playing field leading to even more secure software solutions.