Function DbgkClearProcessDebugObject

KernelLibrary/kDbgSys.cpp:1888–1941

}

NTSTATUS DbgkClearProcessDebugObject(
	_In_ PEPROCESS Process,
	_In_ PDEBUG_OBJECT SourceDebugObject
) {
	NTSTATUS status = STATUS_SUCCESS;
	PDEBUG_OBJECT DebugObject = nullptr;
	PDEBUG_EVENT DebugEvent;
	LIST_ENTRY TempList;
	PLIST_ENTRY Entry;

	ExAcquireFastMutex(g_pDbgkpProcessDebugPortMutex);

	auto process = Process;
	/*DebugObject = (PDEBUG_OBJECT)process->DebugPort;
	if (DebugObject == nullptr || (DebugObject != SourceDebugObject && SourceDebugObject != nullptr)) {
		DebugObject = nullptr;
		status = STATUS_PORT_NOT_SET;
	}
	else {
		process->DebugPort = nullptr;
		status = STATUS_SUCCESS;
	}*/
	ExReleaseFastMutex(g_pDbgkpProcessDebugPortMutex);

	if (NT_SUCCESS(status)) {
		DbgkpMarkProcessPeb(Process);
	}

	if (DebugObject) {
		InitializeListHead(&TempList);

		ExAcquireFastMutex(&DebugObject->Mutex);
		for (Entry = DebugObject->EventList.Flink; Entry != &DebugObject->EventList;) {
			DebugEvent = CONTAINING_RECORD(Entry, DEBUG_EVENT, EventList);
			Entry = Entry->Flink;
			// һ������������ͬʱ���Զ�������Խ���
			if (DebugEvent->Process == Process) {
				RemoveEntryList(&DebugEvent->EventList);
				InsertTailList(&TempList, &DebugEvent->EventList);
			}
		}
		ExReleaseFastMutex(&DebugObject->Mutex);

		ObDereferenceObject(DebugObject);

		while (!IsListEmpty(&TempList)) {
			Entry = RemoveHeadList(&TempList);
			DebugEvent = CONTAINING_RECORD(Entry, DEBUG_EVENT, EventList);
			DebugEvent->Status = STATUS_DEBUGGER_INACTIVE;
			DbgkpWakeTarget(DebugEvent);
		}
	}
	return status;
}

NTSTATUS NtSetInformationDebugObject(
	_In_ HANDLE DebugObjectHandle,