Archived. Extracted from private repos for reference. Written July 2020. No guarantee it compiles or runs on any current version of Windows. Detection status versus modern anti-cheats is unknown.
Kernel-mode window handle manipulation using gpKernelHandleTable from win32kbase.sys. Part of rus_t, a kernel server used in xtc.ninja during mid-2020.
The goal was to read the Win32 thread context associated with an HWND from the kernel handle table, and optionally swap it using PsSetThreadWin32Thread. The use case was hijacking windows for use in overlays/direct drawing in which the current process does not own.
gpKernelHandleTable is an unexported global in win32kbase.sys. Locate it by scanning the module's export table for a function that references it and pattern-matching the surrounding instructions.
To look up an HWND:
word_change = low 16 bits of HWND
entry = gpKernelHandleTable + (word_change + (word_change * 2)) * 8 + 0x8
This is base + index * 24 + 8. Each entry in the table is 24 bytes. The + 0x8 skips the first field of the entry structure to land on the TAG_THREAD_INFO pointer.
TAG_THREAD_INFO is undocumented. The third field (+0x10) is the ETHREAD pointer for the owning thread.
get_context takes an HWND and returns the TAG_THREAD_INFO pointer. The caller must be attached to the session process via KeStackAttachProcess before calling, because gpKernelHandleTable is session-local.
set_context calls PsSetThreadWin32Thread to swap the Win32 thread context of a given thread. This is documented behavior (it is a kernel export) but using it on another process's thread is not a supported scenario. Good luck.
handler.hpp get_context, set_context, TAG_THREAD_INFO declaration
gpKernelHandleTable is not exported and its offset within win32kbase.sys changes with every Windows update. You will need to re-scan on each build. The pattern scan approach worked at the time but there is no guarantee any specific pattern still holds.
Any kernel AC that monitors PsSetThreadWin32Thread calls from non-system threads or valid modules will catch this immediately.