|
|
在《[5-7]强制解锁文件》里，用以下代码关闭句柄：- VOID ForceCloseHandle(PEPROCESS Process, ULONG64 HandleValue)
- {
- HANDLE h;
- KAPC_STATE ks;
- OBJECT_HANDLE_FLAG_INFORMATION ohfi;
- if( Process==NULL )
- return;
- if( !MmIsAddressValid(Process) )
- return;
- KeStackAttachProcess(Process, &ks);
- h=(HANDLE)HandleValue;
- ohfi.Inherit=0;
- ohfi.ProtectFromClose=0;
- ObSetHandleAttributes(h, &ohfi, KernelMode);
- ZwClose(h);
- KeUnstackDetachProcess(&ks);
- }
|
|
发表于 2016-8-25 08:52:33
发表于 2016-8-25 08:59:03
