Enumerate handles example

test.pas

function GetObjectName(const hObject: THandle): String;
var
  oni: OBJECT_NAME_INFORMATION;
  cbSize: DWORD;
  nts: NTSTATUS;
begin
  Result := '';

  cbSize := SizeOf(oni) - (2 * SizeOf(USHORT));
  oni.Length := 0;
  oni.MaximumLength := cbSize;
  nts := NtQueryObject(hObject, ObjectNameInformation, @oni, cbSize, @cbSize);
  if (nts = STATUS_SUCCESS) and (oni.Length > 0) then
  begin
    Result := oni.Name;
  end;
end;

procedure EnumHandles;
var
  shi: PSYSTEM_HANDLE_INFORMATION;
  cbSize: DWORD;
  cbRet: DWORD;
  nts: NTSTATUS;
  i: Integer;
  hDupHandle: THandle;
  dwErr: DWORD;
  ObjectName: string;
  dwPid: DWORD;
  hProcess: THandle;
begin
  dwPid := GetCurrentProcessId;
  hProcess := GetCurrentProcess;

  cbSize := $5000;
  GetMem(shi, cbSize);
  repeat
    cbSize := cbSize * 2;
    ReallocMem(shi, cbSize);
    nts := NtQuerySystemInformation(SystemHandleInformation, shi, cbSize, @cbRet);
  until nts <> STATUS_INFO_LENGTH_MISMATCH;

  if nts = STATUS_SUCCESS then
  begin
    for i := 0 to shi^.HandleCount - 1 do
    begin
      if shi^.Handles[i].GrantedAccess <> $0012019f then
      begin
        if shi^.Handles[i].ProcessId = dwPid then
        begin
          nts := NtDuplicateObject(hProcess, shi^.Handles[i].Handle,
            GetCurrentProcess, @hDupHandle, 0, 0, 0);

          if nts = STATUS_SUCCESS then
          begin
            ObjectName := GetObjectName(hDupHandle);
            if (ObjectName <> '') and (String(ObjectName).Contains('\Device\ConDrv\')) then
            begin
              CloseHandle(hDupHandle);

              nts := NtDuplicateObject(hProcess, shi^.Handles[i].Handle,
                GetCurrentProcess, @hDupHandle, 0, 0, DUPLICATE_CLOSE_SOURCE);

              if nts = STATUS_SUCCESS then
              begin
                OutputDebugString(PChar(Format('Duplicated Handle with DUPLICATE_CLOSE_SOURCE, new Handle=%d', [hDupHandle])));
              end;
            end;

            if hDupHandle > 0 then
              CloseHandle(hDupHandle);
          end;
        end;
      end;
    end;
  end
  else begin
    dwErr := RtlNtStatusToDosError(nts);
    OutputDebugString(PChar(Format('Failed to read handles, NtQuerySystemInformation failed with %.8x => %d (%s)', [nts, SysErrorMessage(dwErr)])));
  end;

  FreeMem(shi);
end;