#pragma once
#include <vector>
#include "ElhHelper.h"

/* ------------- HANDLE TYPES ------------- */
#define PROCESS_HANDLE_TYPE 0x7
#define THREAD_HANDLE_TYPE	0x8
#define FILE_HANDLE_TYPE	0x25
#define SECTION_HANDLE_TYPE 0x2A
#define KEY_HANDLE_TYPE		0x2C

/* -------------- DESCRIPTOR -------------- */
#define OBJ_INHERIT			0x00000002

class ElhInit {
public:
    typedef struct {
        SYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo;
        LPCWSTR						   handleType;
        std::vector<LPCWSTR>		   handleRights;
        std::wstring				   objectName;
        std::wstring				   procName;
        USHORT						   parentPID;
        std::wstring				   parentName;
    } HANDLE_OBJ;

    static void printBanner();

    static PSYSTEM_HANDLE_INFORMATION getSystemHandleInformation();

    static bool handleBelongsToELH(SYSTEM_HANDLE_TABLE_ENTRY_INFO& handleInfo);
    static bool handleIsInheritable(UCHAR& handleAttributes);
    static bool handleTypeIsInteresting(UCHAR& objectTypeIndex, LPCWSTR& handleType);
    static bool handleAccessIsInteresting(UCHAR& objectTypeIndex, ULONG& grantedAccess, std::vector<LPCWSTR>& accessRights);

    static void findLeakedHandles(PSYSTEM_HANDLE_INFORMATION& pSystemHandleInfo, std::vector<HANDLE_OBJ>& interestingHandles);
};
