10 replies to this topic

[White Scorpion]

Hi all,

i'm trying to get the handle to a file which is already opened with OF_SHARE_DENY_WRITE
by injecting code into the process which opened the file and then write to the file using the new handle. I've tried GetModuleHandle to get the handle, but it returns "module not found". Also i've tried reopening the file since i'm in the same process, but it returns "sharing violation". Anyone has a clue on how to do this?

Thanks in advance!

[belgther]

I think the handles are saved somewhere in a process table. But I don't know where. Because you can see the handle list easily with Softice or Olly, well, olly can be explained with another mechanism, but how about softice?

[White Scorpion]

I thought so too, but indeed where?

Process explorer from sysinternals can show all open handles as well, so it must be possible, but how?

[belgther]

looks like it's being done by GetProp and EnumProps functions, but I am not sure...

[aapje]

i think it is possible to hook the closefile from the process you are injected to and make the call to its orgional function to close the handle

[White Scorpion]

@belgther > i would have to test it, but from reading it you have to specify a valid window name... i will go deeper into it...

@aapje > i don't want to close it, i just want to borrow it for a second to make some adjustments

[belgther]

WS, but window names can also be got by EnumWindows, as far as I know.

[aapje]

@belgther > i would have to test it, but from reading it you have to specify a valid window name... i will go deeper into it...

@aapje > i don't want to close it, i just want to borrow it for a second to make some adjustments

<{POST_SNAPBACK}>

yes but if you detour open or close file you can log the handle and use that handle to write to the file (not 100% if that would work but i think so because you get the same handle that the process uses so you should be able to write using it)

[White Scorpion]

@aapje > i don't have a clue what you mean

@belgther > i've tried GetProp with several values for the first parameter (GetModuleHandle(NULL), etc) and with the 2nd value a string to the filename. unfortunately the function always returns "File not found".

Any other ideas guys?

[JonJon]

try using NtQuerySystemInformation


see: http://www.osronline.../thread199.html

[White Scorpion]

Thanks JonJon, i didn't think about that one.. I will give it a go