windows内核句柄判断有效

// ZwQueryObject 函数声明（如果头文件中没有）
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryObject(
    _In_opt_ HANDLE Handle,
    _In_ OBJECT_INFORMATION_CLASS ObjectInformationClass,
    _Out_writes_bytes_opt_(ObjectInformationLength) PVOID ObjectInformation,
    _In_ ULONG ObjectInformationLength,
    _Out_opt_ PULONG ReturnLength
);

// 相关枚举定义

// 相关结构体定义
typedef struct _OBJECT_BASIC_INFORMATION {
    ULONG Attributes;
    ACCESS_MASK GrantedAccess;
    ULONG HandleCount;
    ULONG PointerCount;
    ULONG PagedPoolCharge;
    ULONG NonPagedPoolCharge;
    ULONG Reserved[3];
    ULONG NameInfoSize;
    ULONG TypeInfoSize;
    ULONG SecurityDescriptorSize;
    LARGE_INTEGER CreationTime;
} OBJECT_BASIC_INFORMATION, * POBJECT_BASIC_INFORMATION;

typedef struct _OBJECT_TYPE_INFORMATION {
    UNICODE_STRING TypeName;
    ULONG TotalNumberOfObjects;
    ULONG TotalNumberOfHandles;
    ULONG TotalPagedPoolUsage;
    ULONG TotalNonPagedPoolUsage;
    ULONG TotalNamePoolUsage;
    ULONG TotalHandleTableUsage;
    ULONG HighWaterNumberOfObjects;
    ULONG HighWaterNumberOfHandles;
    ULONG HighWaterPagedPoolUsage;
    ULONG HighWaterNonPagedPoolUsage;
    ULONG HighWaterNamePoolUsage;
    ULONG HighWaterHandleTableUsage;
    ULONG InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG ValidAccessMask;
    BOOLEAN SecurityRequired;
    BOOLEAN MaintainHandleCount;
    UCHAR TypeIndex;
    CHAR ReservedByte;
    ULONG PoolType;
    ULONG DefaultPagedPoolCharge;
    ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, * POBJECT_TYPE_INFORMATION;

NTSTATUS ValidateHandle(HANDLE Handle, PCWSTR HandleName)
{
    NTSTATUS status;
    OBJECT_BASIC_INFORMATION objectInfo;
    ULONG returnLength;

    if (Handle == NULL ) {
        DbgPrint("%ws: Handle is NULL or INVALID_HANDLE_VALUE\n", HandleName);
        return STATUS_INVALID_HANDLE;
    }

    status = ZwQueryObject(
        Handle,
        ObjectBasicInformation,
        &objectInfo,
        sizeof(objectInfo),
        &returnLength
    );

    if (!NT_SUCCESS(status)) {
        DbgPrint("%ws: ZwQueryObject failed with status 0x%08X\n", HandleName, status);
        return status;
    }

    //DbgPrint("%ws: Handle is valid (RefCount: %lu)\n", HandleName, objectInfo.ReferenceCount);
    return STATUS_SUCCESS;
}