Added inheritable handles to native process creation.

Author: tyranid

NtApiDotNet/NtProcess.cs

@@ -188,6 +188,11 @@ private static NtProcessCreateResult Create(NtProcessCreateConfig config, string
                     dispose.Add(ProcessAttribute.SecureProcess(trustlet_config));
                 }
 
+                if (config.InheritHandleList.Count > 0)
+                {
+                    dispose.Add(ProcessAttribute.HandleList(config.InheritHandleList.Select(o => o.Handle)));
+                }
+
                 var attr_list = dispose.AddResource(ProcessAttributeList.Create(dispose.OfType<ProcessAttribute>().Concat(config.AdditionalAttributes)));
                 create_info.Data.InitFlags = config.InitFlags;
                 if (config.CaptureAdditionalInformation)

NtApiDotNet/NtProcessCreateConfig.cs

@@ -168,6 +168,12 @@ public sealed class NtProcessCreateConfig
         /// Redirection DLL path. Only supported from 1903.
         /// </summary>
         public string RedirectionDllName { get; set; }
+
+        /// <summary>
+        /// Inheritable handles.
+        /// </summary>
+        public List<NtObject> InheritHandleList { get; }
+
         #endregion
 
         #region Public Methods
@@ -209,6 +215,7 @@ public NtProcessCreateConfig()
             AdditionalAttributes = new List<ProcessAttribute>();
             ProcessDesiredAccess = ProcessAccessRights.MaximumAllowed;
             ThreadDesiredAccess = ThreadAccessRights.MaximumAllowed;
+            InheritHandleList = new List<NtObject>();
         }
         #endregion
     }

NtApiDotNet/ProcessAttribute.cs

@@ -127,8 +127,8 @@ public static ProcessAttribute ProtectionLevel(PsProtection protection)
 
         public static ProcessAttribute HandleList(IEnumerable<SafeHandle> handles)
         {
-            return new ProcessAttribute(ProcessAttributeNum.HandleList, false, true, false,
-              new SafeHandleListHandle(handles.Select(h => NtObject.DuplicateHandle(h.ToSafeKernelHandle()))));
+            return new ProcessAttribute(ProcessAttributeNum.HandleList, false, true, false, 
+                handles.Select(h => h.DangerousGetHandle()).ToArray().ToBuffer());
         }
 
         public static ProcessAttribute SecureProcess(NtProcessTrustletConfig trustlet_config)

NtObjectManager/NtObjectManager.psm1

@@ -1288,7 +1288,8 @@ function New-NtProcessConfig {
         [switch]$TerminateOnDispose,
         [switch]$Win32Path,
         [switch]$CaptureAdditionalInformation,
-        [switch]$Secure
+        [switch]$Secure,
+        [NtApiDotNet.NtObject[]]$InheritHandle
     )
 
     if ($Win32Path) {
@@ -1315,6 +1316,9 @@ function New-NtProcessConfig {
     }
     $config.CaptureAdditionalInformation = $CaptureAdditionalInformation
     $config.Secure = $Secure
+    if ($null -ne $InheritHandle) {
+        $config.InheritHandleList.AddRange($InheritHandle)
+    }
 
     return $config
 }