Код (Text): PVOID FASTCALL HMValidateHandle( HANDLE h, BYTE bType) { DWORD dwError; KERNEL_PVOID pobj = NULL; PCLIENTINFO pci; GET_CURRENT_CLIENTINFO(); #if DBG != 0 && !defined(_USERK_) /* * We don't want 32 bit apps passing 16 bit handles * we should consider failing this before we get * stuck supporting it (Some VB apps do this). */ if (pci && (h != NULL) && (HMUniqFromHandle(h) == 0) && !(pci->dwTIFlags & TIF_16BIT)) { RIPMSG3(RIP_WARNING, "HMValidateHandle: 32bit process [%d] using 16 bit handle [%#p] bType:%#lx", HandleToUlong(NtCurrentTeb()->ClientId.UniqueProcess), h, (DWORD)bType); } #endif /* * Object can't be located in shared memory. */ UserAssert(bType != TYPE_MONITOR); /* * Validation macro. Falls through if the handle is invalid. */ ValidateHandleMacro(pci, pobj, h, bType); /* * check for secure process */ CHECK_RESTRICTED(); if (pobj != NULL) { return pobj; } switch (bType) { case TYPE_WINDOW: dwError = ERROR_INVALID_WINDOW_HANDLE; break; case TYPE_MENU: dwError = ERROR_INVALID_MENU_HANDLE; break; case TYPE_CURSOR: dwError = ERROR_INVALID_CURSOR_HANDLE; break; case TYPE_ACCELTABLE: dwError = ERROR_INVALID_ACCEL_HANDLE; break; case TYPE_HOOK: dwError = ERROR_INVALID_HOOK_HANDLE; break; case TYPE_SETWINDOWPOS: dwError = ERROR_INVALID_DWP_HANDLE; break; default: dwError = ERROR_INVALID_HANDLE; break; } RIPERR2(dwError, RIP_WARNING, "HMValidateHandle: Invalid:%#p Type:%#lx", h, (DWORD)bType); /* * If we get here, it's an error. */ return NULL; }
Все что у меня есть сорсы обрыл, нету. Хотелось узнать имена двух переменных - [1B8558] и [1B8444] Кусок кода: Код (Text): ;000411D8 HMValidateHandle: mov edi,edi push ebx push esi push edi mov bl,dl mov esi,ecx xor edi,edi invoke PsGetCurrentThread invoke PsGetThreadWin32Thread, eax mov ecx,dword ptr ds:[1B8558] mov edx,dword ptr ds:[ecx+8] mov eax,esi and eax,0FFFF cmp eax,edx jnb short 00041229 lea edx,dword ptr ds:[eax+eax*2] mov eax,dword ptr ds:[1B8444] lea ecx,dword ptr ds:[eax+edx*4] mov eax,esi shr eax,10 cmp ax,word ptr ds:[ecx+A] jnz short 00041263 0004121A: test byte ptr ds:[ecx+9],1 jnz short 00041229 mov al,byte ptr ds:[ecx+8] cmp al,bl jnz short 000411C8 00041227: mov edi,dword ptr ds:[ecx] 00041229: call dword ptr ds:[<&ntoskrnl.PsGetCurrentThread>] ; ntoskrnl.PsGetCurrentThread push eax call dword ptr ds:[<&ntoskrnl.PsGetThreadWin32Thread>] ; ntoskrnl.PsGetThreadWin32Thread test dword ptr ds:[eax+48],20000000 jnz 00041145 00041243: push 1 push esi call 000116ED test eax,eax jnz 00010410 00041253: movzx eax,bl dec eax ; Switch (cases 1..8) cmp eax,7 ja short 00041290 jmp dword ptr ds:[eax*4+41270] 00041263: test ax,ax je short 0004121A cmp ax,0FFFF jnz short 00041229 jmp short 0004121A 00041270: dd win32k_.00041162 ; Switch table used at 0004125C dd win32k_.00041173 dd win32k_.00041184 dd win32k_.000411B7 dd win32k_.000411A6 dd win32k_.00041290 dd win32k_.00041290 dd win32k_.00041195 00041290: mov eax,6 ; Default case of switch 00041256 push eax call 0001377D pop edi pop esi xor eax,eax pop ebx ret 000412A1: test edx,edx mov dword ptr ds:[edi+4],ecx je short 000412F0 mov eax,dword ptr ds:[eax] mov dword ptr ds:[edx],eax jmp short 000412F0
Сорц тебе кинули верный просто макросы не развернуты. Код (Text): #define ValidateHandleMacro(pci, pobj, h, bType) \ StartValidateHandleMacro(h) \ BeginAliveValidateHandleMacro() \ BeginTypeValidateHandleMacro(pobj, bType) \ DESKTOPVALIDATE(pci, pobj) \ EndTypeValidateHandleMacro \ EndAliveValidateHandleMacro() \ EndValidateHandleMacro #define StartValidateHandleMacro(h) \ { \ PHE phe; \ DWORD dw; \ WORD uniq; \ \ /* \ * This is a macro that does an AND with HMINDEXBITS, \ * so it is fast. \ */ \ dw = HMIndexFromHandle(h); \ \ /* \ * Make sure it is part of our handle table. \ */ \ if (dw < gpsi->cHandleEntries) { \ /* \ * Make sure it is the handle \ * the app thought it was, by \ * checking the uniq bits in \ * the handle against the uniq \ * bits in the handle entry. \ */ \ phe = &gSharedInfo.aheList[dw]; \ uniq = HMUniqFromHandle(h); \ if ( uniq == phe->wUniq \ || uniq == 0 \ || uniq == HMUNIQBITS \ ) { 1B8558 - gpsi (PSERVERINFO) 1B8444 - gSharedInfo+0x4 (SHAREDINFO)
