Can't budge handles outside of my process

This is a discussion on Can't budge handles outside of my process within the Windows Programming forums, part of the Platform Specific Boards category; When I try to CloseHandle() a handle in a remote process, it fails. If I have debugging rights will it ...

  1. #1
    Registered User Queatrix's Avatar
    Join Date
    Apr 2005
    Posts
    1,342

    Can't budge handles outside of my process

    When I try to CloseHandle() a handle in a remote process, it fails. If I have debugging rights will it work then?

  2. #2
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,059
    SeDebugPrivilege will work for you.

  3. #3
    Cat without Hat CornedBee's Avatar
    Join Date
    Apr 2003
    Posts
    8,892
    No, it won't. All HANDLEs are process-specific. Obtaining the value of a HANDLE from another process is of no use because it has no meaning within the context of your process. You have to use DuplicateHandle to transfer the handle to your own process first.

    Of course, calling CloseHandle will then only affect the copy. You need a remote thread within the other process to actually affect the handle there.
    All the buzzt!
    CornedBee

    "There is not now, nor has there ever been, nor will there ever be, any programming language in which it is the least bit difficult to write bad code."
    - Flon's Law

  4. #4
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,059
    I stand corrected. I was thinking along the lines of terminating a process.
    Last edited by BobS0327; 01-09-2007 at 06:08 PM.

  5. #5
    Registered User Queatrix's Avatar
    Join Date
    Apr 2005
    Posts
    1,342
    Quote Originally Posted by CornedBee
    Of course, calling CloseHandle will then only affect the copy. You need a remote thread within the other process to actually affect the handle there.
    How does that work? I have never seen any function/code that would assign a thread to a process.

  6. #6
    Cat without Hat CornedBee's Avatar
    Join Date
    Apr 2003
    Posts
    8,892
    CreateRemoteThread(). It doesn't assign, it creates.
    All the buzzt!
    CornedBee

    "There is not now, nor has there ever been, nor will there ever be, any programming language in which it is the least bit difficult to write bad code."
    - Flon's Law

  7. #7
    Yes, my avatar is stolen anonytmouse's Avatar
    Join Date
    Dec 2002
    Posts
    2,544
    I can't think of many valid reasons for corrupting a remote process, but:
    CloseRemoteHandle

  8. #8
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,059
    You have to use DuplicateHandle to transfer the handle to your own process first
    .
    I'll have to stand UNcorrected on this. I initially thought there was something unique about DuplicateHandles making it easy to close handles on remote processes. Well, it seems to me that this is just misinformation. The only way to use DuplicateHandle with a remote process is to establish an IPC transport mechanism such as name pipes, WM_COPYDATA etc. between the two processes. This will allow the handle to be passed back and forth. Thus, it is limited to user processes not system processes. That is, it's nothing more than a very basic client/server model. The following code is an example of the ONLY way DuplicateHandle can be used to close a handle in a LOCAL process. It is for illustrative purposes. It's fully functional but executing the code will probably put your OS in an unstable state. To finish it off, you'll have to add an ExitProcess function and to be really fancy add a DeleteFile function to delete the executable making it a self deleting executable


    Code:
    #include <windows.h>
    #include <stdio.h>
    
    typedef UINT  (WINAPI *WAITFORSINGLEOBJECT)(HANDLE, DWORD); 
    typedef BOOL  (WINAPI *CLOSEHANDLE)(HANDLE);      
    typedef BOOL  (WINAPI *DELETEFILE)(LPCTSTR);     
    typedef VOID  (WINAPI *EXITPROCESS)(DWORD);         
    typedef DWORD (WINAPI *REMOTETHREAD)(LPVOID);    
    
    typedef struct
    {
        WAITFORSINGLEOBJECT   WaitForSingleObject;
        CLOSEHANDLE  CloseHandle;
        HANDLE      hProcess;
        TCHAR       szFileName[MAX_PATH];
    } FUNCTIONINJECT;
    
    #pragma check_stack(off)
    DWORD WINAPI RemoteThread(FUNCTIONINJECT *injectremote)
    {
        injectremote->WaitForSingleObject(injectremote->hProcess, INFINITE);
        injectremote->CloseHandle(injectremote->hProcess);
        return 0;
    }
    #pragma check_stack
    
    BOOL CloseHandle()
    {
        HANDLE hRemoteProcess = NULL;
        STARTUPINFO si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        if(CreateProcess(0, "explorer.exe", 0, 0, FALSE, (CREATE_SUSPENDED | CREATE_NO_WINDOW | IDLE_PRIORITY_CLASS), 0, 0, &si, &pi)){
            CloseHandle(pi.hThread);
            hRemoteProcess = pi.hProcess;
        }
        if(hRemoteProcess == NULL) return FALSE;
        BYTE *code = (BYTE *)VirtualAllocEx(hRemoteProcess, 0, sizeof(FUNCTIONINJECT) + 128, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);
        if(code == NULL){ CloseHandle(hRemoteProcess); return FALSE; };
        FUNCTIONINJECT *remotestruct = (FUNCTIONINJECT *)(code + 128);
        HMODULE hKernel32 = GetModuleHandle("kernel32.dll");
        FUNCTIONINJECT injectlocal;
        injectlocal.WaitForSingleObject =   (WAITFORSINGLEOBJECT)GetProcAddress(hKernel32, "WaitForSingleObject");
        injectlocal.CloseHandle         =  (CLOSEHANDLE)GetProcAddress(hKernel32, "CloseHandle");
        // Duplicate our own process handle for remotestruct process to wait on
        HANDLE hCurrentProcess = GetCurrentProcess();
        DuplicateHandle(hCurrentProcess, hCurrentProcess, hRemoteProcess, &injectlocal.hProcess, 0, FALSE, DUPLICATE_SAME_ACCESS);
        GetModuleFileName(NULL, injectlocal.szFileName, MAX_PATH);
        WriteProcessMemory(hRemoteProcess, code,   RemoteThread, 128, 0);
        WriteProcessMemory(hRemoteProcess, remotestruct, &injectlocal, sizeof(injectlocal), 0);
        DWORD  dwThreadId = 0;
        HANDLE hThread = CreateRemoteThread(hRemoteProcess, NULL, 0, (REMOTETHREAD)code, remotestruct, 0, &dwThreadId);
        if(hThread != 0) CloseHandle(hThread);
        return TRUE;
    }
    
    int main(void)
    {
        CloseHandle();
        return 0;
    }
    Last edited by BobS0327; 01-11-2007 at 07:26 PM.

  9. #9
    Cat without Hat CornedBee's Avatar
    Join Date
    Apr 2003
    Posts
    8,892
    Quote Originally Posted by BobS0327
    .
    I'll have to stand UNcorrected on this. I initially thought there was something unique about DuplicateHandles making it easy to close handles on remote processes. Well, it seems to me that this is just misinformation.
    Uh, I explicitly said that DuplicateHandle won't help you with closing handles, because you'd only be closing the copy. I didn't spread any misinformation.
    All the buzzt!
    CornedBee

    "There is not now, nor has there ever been, nor will there ever be, any programming language in which it is the least bit difficult to write bad code."
    - Flon's Law

  10. #10
    Registered User
    Join Date
    Mar 2005
    Location
    Mountaintop, Pa
    Posts
    1,059
    Well, the OP poster was concerned about the inability to budge handles outside his process as in remote process. The DuplicateHandle function creates a CLONE of the original handle. They are exactly the same right down to the same security and access rights. Neither handle can be used to manipulate anything outside the local process unless SeDebugPrivilege is established. But you said that this debug level will NOT work. So, unless SeDugPrivilege is set, DuplicateHandle function is worthless if there is a requirement to access a remote process.

    BTW, I have test case code that uses the DuplicateHandle function to terminate a remote user processes with/without SeDebugPrivilege to support my claim and will post it if you like.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. init adopts zombie process?
    By password636 in forum Linux Programming
    Replies: 4
    Last Post: 07-01-2009, 10:05 AM
  2. create a child process that creates a child process
    By cus in forum Linux Programming
    Replies: 9
    Last Post: 01-13-2009, 01:14 PM
  3. Replies: 3
    Last Post: 10-15-2008, 09:24 AM
  4. Problem with forking a process
    By Unitedroad in forum C Programming
    Replies: 10
    Last Post: 10-04-2007, 01:43 AM
  5. process programming
    By St0rM-MaN in forum Linux Programming
    Replies: 2
    Last Post: 09-15-2007, 07:53 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21