Windows句柄表分配算法分析 zz

作者:_achillis

转载请注明原作者及出处,谢谢.

前置知识:Windows句柄表的基本结构
本文以WRK1.2的代码为参考,主要分析Windows句柄表的分配算法,其实只要了解了句柄表的结构,就很容易理解在分配句柄表过程中的每一步操作是何含义,理解之后你会感觉,这个其实算不上什么算法,只能叫做一个规则吧

一、首先来看ExCreateHandleTable(),该函数创建一个HANDLE_TABLE结构;
其过程是调用ExpAllocateHandleTable()完成申请HANDLE_TABLE的工作,然后把申请到的HANDLE_TABLE放到句柄表双链中去
所有进程的HANDLE_TABLE就这样连接在一起(如果有人用过ZwQuerySystemInformation枚举系统中的所有句柄时,就是沿着 这条双向链表走的),而PspCidTable也由该函数创建,但这后又被从该双链中移除,成为一个独立的句柄表(谁让它特殊~)
//核心是下面两句
HandleTable = ExpAllocateHandleTable( Process, TRUE );//创建句柄表
InsertTailList( &HandleTableListHead, &HandleTable->HandleTableList );//放入双向链表中
=======================================================
PHANDLE_TABLE
ExpAllocateHandleTable (
IN PEPROCESS Process OPTIONAL,
IN BOOLEAN DoInit
);
过程分析:
1.申请一块PagedPool作为HANDLE_TABLE,大小为sizeof(HANDLE_TABLE)
2.为HANDLE_TABLE申请一块PagePool内存作为第一个一级表,大小为PAGE_SIZE,以后的一级表由ExpAllocateLowLevelTable来申请

1. //设置TableCode为刚申请的一级表,这里其实隐含了句柄表为一级这个事实
2. HandleTable->TableCode = (ULONG_PTR)HandleTableTable;
3. //下面是对这个刚申请的一级表进行初始化
5. HandleEntry = &HandleTableTable[0]; //第一个HANDLE_TABLE_ENTRY
7. HandleEntry->NextFreeTableEntry = EX_ADDITIONAL_INFO_SIGNATURE;//-2,作为标志;
8. HandleEntry->Value = 0; //对象值为0,对应于无效句柄NULL
10. //
11. // For duplicate calls we skip building the free list as we rebuild it manually as
12. // we traverse the old table we are duplicating
13. //
14. if (DoInit) { //这个参数在普通调用时为TRUE,仅在复制句柄表时则为False,因为复制时并不需要重新分配句柄
15. HandleEntry++; //从第二个HANDLE_TABLE_ENTRY开始
16. //
17. //   Now setup the free list.   We do this by chaining together the free
18. //   entries such that each free entry give the next free index (i.e.,
19. //   like a fat chain).   The chain is terminated with a 0.   Note that
20. //   we’ll skip handle zero because our callers will get that value
21. //   confused with null.
22. //
25. for (i = 1; i < LOWLEVEL_COUNT – 1; i += 1) {
27. HandleEntry->Value = 0; //对象值初始化为0
28. //FreeHandle即自由的,未被使用的句柄
29. HandleEntry->NextFreeTableEntry = (i+1)*HANDLE_VALUE_INC; //构建FreeHandle列表,在初始化时,每一个HANDLE_TABLE_ENTRY都指向下一个句柄.这里的NextFreeTableEntry的值准确说是下一个FreeHandle,这样构成了一个单向链表一样的结构
30. HandleEntry++;
31. }
32. //对最后一项作特殊处理
33. HandleEntry->Value = 0;
34. HandleEntry->NextFreeTableEntry = 0; //最后一项的NextFreeTableEntry为0
36. HandleTable->FirstFree = HANDLE_VALUE_INC; //把刚初始化完的句柄表的FirstFree设为4,即第一个可用句柄
38. }
41. HandleTable->NextHandleNeedingPool = LOWLEVEL_COUNT * HANDLE_VALUE_INC; //一级表最大句柄
43. //
44. //   Setup the necessary process information
45. //
47. HandleTable->QuotaProcess = Process; //设置所属的Process
48. HandleTable->UniqueProcessId = PsGetCurrentProcess()->UniqueProcessId; //调置所属Process的ProcessId
49. HandleTable->Flags = 0;

=============================================================================================================
二、申请低级表,即最底层一级的表.每个HANDLE_TABLE的第一个一级表在创建HANDLE_TABLE时就被创建了,ExpAllocateLowLevelTable用于提供在其它时候创建一级表的支持,比如句柄表已经为二级时再申请句柄表时只需要申请创建一个一级表并加入二级表中即可.

1. PHANDLE_TABLE_ENTRY
2. ExpAllocateLowLevelTable (
3. IN PHANDLE_TABLE HandleTable,
4. IN BOOLEAN DoInit
5. )
7. /*++
9. Routine Description:
11. This worker routine allocates a new low level table
13. Note: The caller must have already locked the handle table
15. Arguments:
17. HandleTable – Supplies the handle table being used
19. DoInit – If FALSE the caller (duplicate) doesn’t need the free list maintained
21. Return Value:
23. Returns – a pointer to a low-level table if allocation is
24. successful otherwise the return value is null.
26. –*/
28. {
29. ULONG k;
30. PHANDLE_TABLE_ENTRY NewLowLevel = NULL, HandleEntry;
31. ULONG BaseHandle;
33. //
34. //   Allocate the pool for lower level
35. //
37. NewLowLevel = ExpAllocateTablePagedPoolNoZero( HandleTable->QuotaProcess,
38. TABLE_PAGE_SIZE
39. );//申请内存,大小为一级表的大小TABLE_PAGE_SIZE
41. if (NewLowLevel == NULL) {
42. return NULL;
43. }
45. //
46. //   We stamp with EX_ADDITIONAL_INFO_SIGNATURE to recognize in the future this
47. //   is a special information entry
48. //
49. //下面三行代码为初始化,这个同刚创建HANDLE_TABLE时创建第一个一级表时的工作基本相同,不多说
50. HandleEntry = &NewLowLevel[0];
52. HandleEntry->NextFreeTableEntry = EX_ADDITIONAL_INFO_SIGNATURE;
53. HandleEntry->Value = 0;
55. //
56. // Initialize the free list within this page if the caller wants this
57. //
58. if (DoInit) {
60. HandleEntry++;
61. //
62. //   Now add the new entries to the free list.   To do this we
63. //   chain the new free entries together.   We are guaranteed to
64. //   have at least one new buffer.   The second buffer we need
65. //   to check for.
66. //
67. //   We reserve the first entry in the table to the structure with
68. //   additional info
69. //
70. //
71. //   Do the guaranteed first buffer
72. //
73. //这里是构建FreeHandleList,也是将每一个HANDLE_TABLE_ENTRY的NextFreeTableEntry指向下一个可用句柄.
74. //但是由于这里不是第一个一级表,所以句柄值的计算稍有不同,需要考虑加上前面的部分
75. BaseHandle = HandleTable->NextHandleNeedingPool + 2 * HANDLE_VALUE_INC;
76. //BaseHandle 是当前新分配的句柄表中的最小句柄+4,即未申请本表时的最大Handle(句柄表的最大Handle即 HandleTable->NextHandleNeedingPool)再加上8,也就是说跳过了第一个用作无效标记的 HANDLE_TABLE_ENTRY(占一个句柄索引),以第二个作为新句柄表起始点的HANDLE_TABLE_ENTRY为起始点(因为第二个 HANDLE_TABLE_ENTRY才是有效的,因此从这里开始构建FreeHandleList的话,它的下一个FreeHandle应该指向第三个 HANDLE_TABLE_ENTRY,而第三个HANDLE_TABLE_ENTRY的句柄在当前句柄表内的偏移为 2*HANDLE_VALUE_INC=8)
77. for (k = BaseHandle; k < BaseHandle + (LOWLEVEL_COUNT – 2) * HANDLE_VALUE_INC; k += HANDLE_VALUE_INC) {
79. //k的值为BaseHandle开始,以HANDLE_VALUE_INC递增,增量为4
80. HandleEntry->NextFreeTableEntry = k; //这里构建了FreeHandleList,可以实验观察之
81. HandleEntry->Value = 0;
82. HandleEntry++;
83. }
84. HandleEntry->NextFreeTableEntry = 0; //最后一个置0,作为结束标记
85. HandleEntry->Value = 0;
86. }
89. return NewLowLevel;
90. }