hi i release give thanks back community for help. i hope this work not test but i think should work and allow external cheat have handle.
so driver use dkom trick replace be driver callback with own custom that allow to obtain handle via stack push. it use a fix too at zwduplicateobject pointer.
1: load driver – dsefix detected so must use other way, cannot test sign. you figure this part i think.
thank and enjoy.