From ecca697c39615666bfc0e960cdc3fcf9b3240a51 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Thu, 11 Mar 2010 06:00:59 +0000
Subject: [PATCH] KPH handle is now protected

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2938 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/phlib/include/ntimport.h |  1 +
 2.x/trunk/phlib/kph.c              | 40 ++++++++++++++++++++++++++++--
 2.x/trunk/phlib/ntimport.c         |  1 +
 3 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/2.x/trunk/phlib/include/ntimport.h b/2.x/trunk/phlib/include/ntimport.h
index c3d8893e1..b84650126 100644
--- a/2.x/trunk/phlib/include/ntimport.h
+++ b/2.x/trunk/phlib/include/ntimport.h
@@ -82,6 +82,7 @@ EXT _NtResumeThread NtResumeThread EQNULL;
 EXT _NtSetContextThread NtSetContextThread EQNULL;
 EXT _NtSetInformationDebugObject NtSetInformationDebugObject EQNULL;
 EXT _NtSetInformationFile NtSetInformationFile EQNULL;
+EXT _NtSetInformationObject NtSetInformationObject EQNULL;
 EXT _NtSetInformationProcess NtSetInformationProcess EQNULL;
 EXT _NtSetInformationThread NtSetInformationThread EQNULL;
 EXT _NtSetInformationToken NtSetInformationToken EQNULL;
diff --git a/2.x/trunk/phlib/kph.c b/2.x/trunk/phlib/kph.c
index bc7f45c00..8b50fa2a9 100644
--- a/2.x/trunk/phlib/kph.c
+++ b/2.x/trunk/phlib/kph.c
@@ -46,9 +46,12 @@ NTSTATUS KphConnect(
     __in_opt PWSTR DeviceName
     )
 {
+    NTSTATUS status;
+    HANDLE kphHandle;
     UNICODE_STRING objectName;
     OBJECT_ATTRIBUTES objectAttributes;
     IO_STATUS_BLOCK isb;
+    OBJECT_HANDLE_FLAG_INFORMATION handleFlagInfo;
 
     if (DeviceName)
         RtlInitUnicodeString(&objectName, DeviceName);
@@ -63,14 +66,33 @@ NTSTATUS KphConnect(
         NULL
         );
 
-    return NtOpenFile(
-        KphHandle,
+    status = NtOpenFile(
+        &kphHandle,
         FILE_GENERIC_READ | FILE_GENERIC_WRITE,
         &objectAttributes,
         &isb,
         FILE_SHARE_READ | FILE_SHARE_WRITE,
         FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT
         );
+
+    if (NT_SUCCESS(status))
+    {
+        // Protect the handle from being closed.
+
+        handleFlagInfo.Inherit = FALSE;
+        handleFlagInfo.ProtectFromClose = TRUE;
+
+        NtSetInformationObject(
+            kphHandle,
+            ObjectHandleFlagInformation,
+            &handleFlagInfo,
+            sizeof(OBJECT_HANDLE_FLAG_INFORMATION)
+            );
+
+        *KphHandle = kphHandle;
+    }
+
+    return status;
 }
 
 NTSTATUS KphConnect2(
@@ -178,6 +200,20 @@ NTSTATUS KphDisconnect(
     __in HANDLE KphHandle
     )
 {
+    OBJECT_HANDLE_FLAG_INFORMATION handleFlagInfo;
+
+    // Unprotect the handle.
+
+    handleFlagInfo.Inherit = FALSE;
+    handleFlagInfo.ProtectFromClose = FALSE;
+
+    NtSetInformationObject(
+        KphHandle,
+        ObjectHandleFlagInformation,
+        &handleFlagInfo,
+        sizeof(OBJECT_HANDLE_FLAG_INFORMATION)
+        );
+
     return NtClose(KphHandle);
 }
 
diff --git a/2.x/trunk/phlib/ntimport.c b/2.x/trunk/phlib/ntimport.c
index 5356b6408..282cb78d6 100644
--- a/2.x/trunk/phlib/ntimport.c
+++ b/2.x/trunk/phlib/ntimport.c
@@ -98,6 +98,7 @@ BOOLEAN PhInitializeImports()
     InitProcReq("ntdll.dll", NtSetContextThread);
     InitProcReq("ntdll.dll", NtSetInformationDebugObject);
     InitProcReq("ntdll.dll", NtSetInformationFile);
+    InitProcReq("ntdll.dll", NtSetInformationObject);
     InitProcReq("ntdll.dll", NtSetInformationProcess);
     InitProcReq("ntdll.dll", NtSetInformationThread);
     InitProcReq("ntdll.dll", NtSetInformationToken);