// TestDriver.h
typedef struct {
	PVOID	Object;
	ACCESS_MASK	GrantedAccess;
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct _HANDLE_TABLE_XP {
	ULONG	TableCode;
	CHAR	pad[0x34];
	ULONG	NextHandleNeedingPool;
} HANDLE_TABLE_XP, *PHANDLE_TABLE_XP;

typedef struct _HANDLE_TABLE_2K {
        ULONG	Pad;
	LONG HandleCount;
	PHANDLE_TABLE_ENTRY **Table;
} HANDLE_TABLE_2K, *PHANDLE_TABLE_2K;

typedef struct _EXHANDLE {
	union {
		struct {
			ULONG TagBits : 2;
			ULONG Index : 30;
		};
		HANDLE GenericHandleOverlay;
	};
} EXHANDLE, *PEXHANDLE;

#define LEVEL_CODE_MASK (3)

// TestDriver.c
	do {
		HANDLE	hFile;
		UNICODE_STRING	NameString;
		OBJECT_ATTRIBUTES	ObjAttrs;
		IO_STATUS_BLOCK	IoStatus;
		LARGE_INTEGER	ByteOffset;

		RtlInitUnicodeString(&NameString, L"\\??\\C:\\testfile");
		InitializeObjectAttributes(&ObjAttrs, &NameString, 0, NULL, NULL);
		ntStatus = ZwCreateFile(&hFile, GENERIC_READ, &ObjAttrs, &IoStatus, 0, FILE_ATTRIBUTE_NORMAL, 0, FILE_OPEN_IF, 0, NULL, 0);
		if (!NT_SUCCESS(ntStatus))
			break;

		do {
			PHANDLE_TABLE_XP Table;
			EXHANDLE Handle;
			PHANDLE_TABLE_ENTRY Entry, Entries;
			ULONG TableCode;

			Handle.GenericHandleOverlay = hFile;
			Table = *(PHANDLE_TABLE_XP *)((ULONG)PsGetCurrentProcess() + 0xc4);
			Handle.TagBits = 0;
			// Handle.Index &= ~0x10000000

			if ((ULONG)Handle.GenericHandleOverlay >= Table->NextHandleNeedingPool)
				break;
			TableCode = Table->TableCode & ~LEVEL_CODE_MASK;
			switch (Table->TableCode & LEVEL_CODE_MASK) {
			case 0:
				Entries = (PHANDLE_TABLE_ENTRY)(TableCode);
				Entry = Entries + Handle.Index;
				break;

			case 1:
				Entries = ((PHANDLE_TABLE_ENTRY *)TableCode)[Handle.Index >> 9];
				Entry = Entries + (Handle.Index & 0x1ff);
				break;

			case 2:
				Entries = ((PHANDLE_TABLE_ENTRY **)TableCode)[Handle.Index >> 0x13][(Handle.Index & ~(0 - (1 << 0x13))) >> 9];
				Entry = Entries + (Handle.Index & 0x1ff);
				break;

			default:
				Entry = NULL;
			}
			if (Entry != NULL)
				Entry->GrantedAccess = 0x001f01ff;
		} while (0);

		ByteOffset.QuadPart = 0;
		ntStatus = ZwWriteFile(hFile, NULL, NULL, NULL, &IoStatus, (PVOID)"\x12\x34\x56\x78", 4, &ByteOffset, NULL);

		ZwClose(hFile);
	} while (0);

PHANDLE_TABLE_ENTRY
ExpLookupHandleTableEntry2k (
    IN PHANDLE_TABLE_2K HandleTable,
    IN EXHANDLE Handle
    )
{
    ULONG i,j,k,l;

    l = (Handle.Index >> 24) & 255;
    i = (Handle.Index >> 16) & 255;
    j = (Handle.Index >> 8)  & 255;
    k = (Handle.Index)       & 255;


    if ( l != 0 ) {
        return NULL;
    }

    if (HandleTable->Table[i] == NULL) {
        return NULL;
    }

    if (HandleTable->Table[i][j] == NULL) {
        return NULL;
    }

    return &(HandleTable->Table[i][j][k]);
}