getting a list of kernel objects windows

Question

• HI!

I bet more than a week and I can not form a complete picture of how you can get a list of kernel objects .My algorithm is as follows :

• 1) Connecting NTDLL.dll (LoadLibrary)
• 2) GetProcAddress (variable_Library_name, "NtQueryDirectoryObject") and the pre-announcement structures : _OBJDIR_INFORMATION, _OBJECT_ATTRIBUTES
• 3) Trying to apply a function NtOpenDirectoryObject for a list of objects

Here is a piece of code that is responsible for the use of the function NtOpenDirectoryObject:

 OBJDIR_INFORMATION *ssinfo  =(OBJDIR_INFORMATION* ) HeapAlloc(GetProcessHeap(), 0, 0x800);
           ///////////////////////
                    HANDLE hFile,hThread,hMapFile;
  HMODULE hNtdll ,hKernel;
  DWORD dwThreadId;
  OBJECT_ATTRIBUTES obj;
  WCHAR  * uString=L"\\BaseNamedObjects";
  UNICODE_STRING str;
  DWORD i,a,iStrLen,b=0;
  char sObjName[30],sTmp[50];
  LPVOID lpMapAddress;
  FARPROC pWinExec,pExitThread;
  bool bFound;
  char* sCommand;
            /////////////////////////////////////////////////////////////////
            NtQueryDirectoryObject = (NTQUERYDIRECTORYOBJECT )GetProcAddress(hinstLib,"NtQueryDirectoryObject");
            InitializeObjectAttributes (&obj, &str, 0, 0, 00);
            NtOpenDirectoryObject(&hFile,0x20001,&obj);

The full code (including struct definitions) is at: http://pastebin.com/pDNb3GTn

When calling a function with parameters NtOpenDirectoryObject get an exception c0000005, which means that access is blocked .

tell me please, am I doing smth wrong, and where is my mistake. Is it possible to not to use the native api? Thank you for your help

Answer 1

Exception c0000005 is an Access Violation. That does not mean that access was blocked. It means invalid memory was accessed, such as if a NULL/uninitialized pointer were accessed, or if you are not aligning data correctly and accessing something out of bounds of what you have allocated.

As Andrew mentioned, you are not initializing the UNICODE_STRING at all. Try this instead:

hNtdll = LoadLibrary("ntdll.dll");
NtOpenDirectoryObject = (NTOPENDIRECTORYOBJECT) GetProcAddress(hNtdll, "NtOpenDirectoryObject");
...
if (NtOpenDirectoryObject)
{ 
    // add these three lines
    str.Length = lstrlenW(uString) * sizeof(WCHAR);  
    str.MaximumLength = str.Length; 
    str.Buffer = uString;

    InitializeObjectAttributes (&obj, &str, 0, NULL, NULL);
    NtOpenDirectoryObject(&hFile, 0x20001, &obj);
}