Help for using of Zw or NtquerySystemInformation

All development related issues welcome

Moderator: Moderator Team

Post Reply
Posts: 3
Joined: Tue Jun 05, 2012 6:15 am

Help for using of Zw or NtquerySystemInformation

Post by programmer.cpp1986 »

I used "Zw or NtquerySystemInformation" to obtain all the object handles but for using of NtquerySystemInformation the return value is NULL and for using of ZwquerySystemInformation some parts of return value is NULL or its memory is access denied.
The structure of the return value was casted to PSYSTEM_HANDLE_INFORMATION. I tested both 16 and 64 as the first input value for calling this function.
For example, the Object part of the return value has a FileName part that is a UNICODE_STRING, but for some enteries FileName has a Length and the MaxLength is not zero and the BUFFER value is 0 or pointed to the part of memory that has the "access violation" error.
I get this problem at this line of my code after calling this function:

DbgPrint("%wZ \r\n", FileObject->FileName);

Anybody can solve this problem and help me?

I used this function to get the object handles:
NTSTATUS PhEnumHandles(
static ULONG initialBufferSize = 0x4000;
NTSTATUS status;
PVOID buffer;
ULONG bufferSize;

bufferSize = initialBufferSize;
buffer = PhAllocate(bufferSize);

while ((status = ZwQuerySystemInformation(
bufferSize *= 2;

if (bufferSize > PH_LARGE_BUFFER_SIZE)

buffer = ExAllocatePool(bufferSize);

if (!NT_SUCCESS(status))
return status;

if (bufferSize <= 0x100000) initialBufferSize = bufferSize;

return status;

Posts: 16
Joined: Thu Sep 29, 2005 3:00 pm

Re: Help for using of Zw or NtquerySystemInformation

Post by ekohl »

NtQuerySystemInformation.SystemHandleInformation is not fully implemented. If you have a look at ntoskrnl\ex\sysinfo.c, you will see that the current implementation only fills UniqueProcessId for each handle.

You are free to implement the missing parts.

Post Reply

Who is online

Users browsing this forum: DotBot [Crawler] and 1 guest