OVALProject/Sandbox — Issue #12: add the ability to query handles associated with a windows process
Author: djhaynes
Created: 2012-03-05 14:36:39+00:00
State: open

Need to be able to enumerate all handles associate with a process. This includes:
- Sockets (source, dest, sourceport, destport, protocol)
- Mutants (name)
- Others: File, Registry, Pipes, etc

Handle information is available via NtQuerySystemInformation (http://msdn.microsoft.com/en-us/library/ms724509(v=vs.85).aspx). Note that the GetProcessHandleCount Function is preferred (http://msdn.microsoft.com/en-us/library/ms683214(v=vs.85).aspx) since it is a supported API.

This request does overlap in part with the Mutex community suggestion, handles could be considered system wide objects outside of the scope of the Process Object.

Please see slide 10 of the slides attached to the following oval-developer-list post.

http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html