KPH handle is now protected

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2938 21ef857c-d57f-4fe0-8362-d861dc6d29cd

2.x/trunk/phlib/include/ntimport.h

@@ -82,6 +82,7 @@ EXT _NtResumeThread NtResumeThread EQNULL;
 EXT _NtSetContextThread NtSetContextThread EQNULL;
 EXT _NtSetInformationDebugObject NtSetInformationDebugObject EQNULL;
 EXT _NtSetInformationFile NtSetInformationFile EQNULL;
+EXT _NtSetInformationObject NtSetInformationObject EQNULL;
 EXT _NtSetInformationProcess NtSetInformationProcess EQNULL;
 EXT _NtSetInformationThread NtSetInformationThread EQNULL;
 EXT _NtSetInformationToken NtSetInformationToken EQNULL;

2.x/trunk/phlib/kph.c

@@ -46,9 +46,12 @@ NTSTATUS KphConnect(
     __in_opt PWSTR DeviceName
     )
 {
+    NTSTATUS status;
+    HANDLE kphHandle;
     UNICODE_STRING objectName;
     OBJECT_ATTRIBUTES objectAttributes;
     IO_STATUS_BLOCK isb;
+    OBJECT_HANDLE_FLAG_INFORMATION handleFlagInfo;
 
     if (DeviceName)
         RtlInitUnicodeString(&objectName, DeviceName);
@@ -63,14 +66,33 @@ NTSTATUS KphConnect(
         NULL
         );
 
-    return NtOpenFile(
-        KphHandle,
+    status = NtOpenFile(
+        &kphHandle,
         FILE_GENERIC_READ | FILE_GENERIC_WRITE,
         &objectAttributes,
         &isb,
         FILE_SHARE_READ | FILE_SHARE_WRITE,
         FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT
         );
+
+    if (NT_SUCCESS(status))
+    {
+        // Protect the handle from being closed.
+
+        handleFlagInfo.Inherit = FALSE;
+        handleFlagInfo.ProtectFromClose = TRUE;
+
+        NtSetInformationObject(
+            kphHandle,
+            ObjectHandleFlagInformation,
+            &handleFlagInfo,
+            sizeof(OBJECT_HANDLE_FLAG_INFORMATION)
+            );
+
+        *KphHandle = kphHandle;
+    }
+
+    return status;
 }
 
 NTSTATUS KphConnect2(
@@ -178,6 +200,20 @@ NTSTATUS KphDisconnect(
     __in HANDLE KphHandle
     )
 {
+    OBJECT_HANDLE_FLAG_INFORMATION handleFlagInfo;
+
+    // Unprotect the handle.
+
+    handleFlagInfo.Inherit = FALSE;
+    handleFlagInfo.ProtectFromClose = FALSE;
+
+    NtSetInformationObject(
+        KphHandle,
+        ObjectHandleFlagInformation,
+        &handleFlagInfo,
+        sizeof(OBJECT_HANDLE_FLAG_INFORMATION)
+        );
+
     return NtClose(KphHandle);
 }
 

2.x/trunk/phlib/ntimport.c

@@ -98,6 +98,7 @@ BOOLEAN PhInitializeImports()
     InitProcReq("ntdll.dll", NtSetContextThread);
     InitProcReq("ntdll.dll", NtSetInformationDebugObject);
     InitProcReq("ntdll.dll", NtSetInformationFile);
+    InitProcReq("ntdll.dll", NtSetInformationObject);
     InitProcReq("ntdll.dll", NtSetInformationProcess);
     InitProcReq("ntdll.dll", NtSetInformationThread);
     InitProcReq("ntdll.dll", NtSetInformationToken);