Optimize on Windows x64 21H2

[BatchClayderman]

Hello, World!
I have tested the driver on Windows 10 21H2 x64.
Here is a suggestion.

Function ExAllocatePoolWithTag() is used in ProcessReference.cpp and handle.cpp.
When I use the EXE file to ask the driver to delete a file, it leads to BSOD.
There are two reasons for that, from my perspective.

1. ExAllocatePoolWithTag should be replaced by ExAllocatePool2.
2. The vars "m_apc_state" and "handles_pool" should be checked whether it is NULL after allocating.

Thus, I made some changes shown as follows.

ProcessReference.cpp:

NTSTATUS ProcessReference::init(size_t pid, bool attach)
{
	CHECK(PsLookupProcessByProcessId(reinterpret_cast<HANDLE>(pid), &m_process));
	m_attach = attach;
	if (attach)
	{
		m_apc_state = (KAPC_STATE*)ExAllocatePool2(NonPagedPool, sizeof(KAPC_STATE), '2cba');
		if (NULL == m_apc_state)
			m_apc_state = (KAPC_STATE*)ExAllocatePoolZero(NonPagedPool, sizeof(KAPC_STATE), '2cba');
		if (NULL == m_apc_state)
			return STATUS_MEMORY_NOT_ALLOCATED;
		KeStackAttachProcess(m_process, m_apc_state);
	}
	return STATUS_SUCCESS;
}

handle.cpp:

SYSTEM_HANDLE_INFORMATION* get_all_handles()
{
    size_t handles_allocation_size = 0;
    PVOID handles_pool = nullptr;

    for (;;)
    {
        handles_allocation_size += 0x10000;
        handles_pool = ExAllocatePool2(PagedPool, handles_allocation_size, '1cba');
        if (NULL == handles_pool)
            handles_pool = ExAllocatePoolZero(PagedPool, handles_allocation_size, '1cba');

        auto status = ZwQuerySystemInformation(SystemHandleInformation, handles_pool, (ULONG)handles_allocation_size, nullptr);
        if (status == STATUS_INFO_LENGTH_MISMATCH && NULL != handles_pool)
            ExFreePool(handles_pool);
        else
            break;
    }
    return (SYSTEM_HANDLE_INFORMATION*)handles_pool;
}

Thanks for your hard work and helpful codes.

[Rhydon1337]

Hi, it seems very cool.
Would you like to create a pull request?

[BatchClayderman]

A pull request has been created.
As this is my first time creating a pull request, if you couldn't see it, please tell me.
Please only be concerned about the two ".cpp" files mentioned above.
Thanks & Regards.

[Rhydon1337]

I can't see it :)

[BatchClayderman]

I have no access to make a pull request on this issue.
Could you mind your obtaining the related access to me?

[Rhydon1337]

As far as I know, everyone with read permission can create pull requests. Are you sure you are doing it right?

[BatchClayderman]

I have tried it again. It might be seen now.
Sorry for taking up for your time.