24H2 checklist

[dmex]

An inside look at Microsoft's development strategy for Windows 11:

https://www.youtube.com/watch?v=s99ZeamF7J0

Microsoft retuning null pointers for information classes has broken enumeration of handles, threads and other objects:

• [ ] SystemModuleInformation (11) RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION.DllBase
• [x] SystemLocksInformation (12) RTL_PROCESS_LOCK_INFORMATION RTL_PROCESS_LOCK_INFORMATION.Address
• [ ] SystemHandleInformation (16) SYSTEM_HANDLE_INFORMATION SYSTEM_HANDLE_INFORMATION.Handles[N].Object
• [x] SystemObjectInformation (17) SYSTEM_OBJECT_INFORMATION SYSTEM_OBJECT_INFORMATION.Object
• [x] SystemExtendedHandleInformation (64) SYSTEM_HANDLE_INFORMATION_EX SYSTEM_HANDLE_INFORMATION_EX.Handles[N].Object
• [x] SystemBigPoolInformation (66) SYSTEM_BIGPOOL_INFORMATION SYSTEM_BIGPOOL_INFORMATION.AllocationInfo[N].VirtualAddress
• [ ] SystemModuleInformationEx (77) RTL_PROCESS_MODULE_INFORMATION_EX RTL_PROCESS_MODULE_INFORMATION_EX.BaseInfo.ImageBase
• [x] SystemFullProcessInformation (148) SYSTEM_EXTENDED_THREAD_INFORMATION.StackBase
• [ ] SYSTEM_EXTENDED_THREAD_INFORMATION.Win32StartAddress if the thread’s Win32StartAddress is a kernel address.
• [ ] SYSTEM_EXTENDED_THREAD_INFORMATION.ThreadInfo.StartAddress
• [ ] ProcessHandleTracing (32) PROCESS_HANDLE_TRACING_QUERY PROCESS_HANDLE_TRACING_QUERY.HandleTrace[N].Stacks
• [x] ProcessWorkingSetWatchEx (42) PROCESS_WS_WATCH_INFORMATION_EX
• [x] PROCESS_WS_WATCH_INFORMATION_EX.BasicInfo.FaultingPc
• [x] PROCESS_WS_WATCH_INFORMATION_EX.BasicInfo.FaultingVa

Steps to reproduce (optional)

Windows 11 - https://windows-internals.com/kaslr-leaks-restriction/

Expected behavior (optional)

Functional

Actual behavior (optional)

Non-functional

Environment (optional)