Function DbgkpCloseObject

KernelLibrary/kDbgSys.cpp:2142–2195

}

VOID DbgkpCloseObject(
	_In_ PEPROCESS Process,
	_In_ PVOID Object,
	_In_ ACCESS_MASK GrantedAccess,
	_In_ ULONG_PTR ProcessHandleCount,
	_In_ ULONG_PTR SystemHandleCount
) {
	PDEBUG_OBJECT DebugObject = (PDEBUG_OBJECT)Object;
	PDEBUG_EVENT DebugEvent;
	PLIST_ENTRY	Entry;
	BOOLEAN Deref;

	if (SystemHandleCount > 1) {
		return;
	}

	ExAcquireFastMutex(&DebugObject->Mutex);

	DebugObject->Flags |= DEBUG_OBJECT_DELETE_PENDING;

	Entry = DebugObject->EventList.Flink;
	InitializeListHead(&DebugObject->EventList);
	ExReleaseFastMutex(&DebugObject->Mutex);

	KeSetEvent(&DebugObject->EventsPresent, 0, FALSE);

	// ö��ϵͳ�ڵ����н��̣��������ij�����̵�DebugObject�ֶε�ֵ��Ҫ�رյĶ�����ͬ��������Ϊ0
	for (Process = PsGetNextProcess(nullptr); Process != nullptr; Process = PsGetNextProcess(Process)) {
		auto process = Process;
		/*if (process->DebugPort == DebugObject) {
			Deref = FALSE;
			ExAcquireFastMutex(&DbgkpProcessDebugPortMutex);
			if (process->DebugPort == DebugObject) {
				process->DebugPort = nullptr;
				Deref = TRUE;
			}
			ExReleaseFastMutex(&DbgkpProcessDebugPortMutex);

			if (Deref) {
				if (DebugObject->Flags & DEBUG_OBJECT_KILL_ON_CLOSE) {
					PsTerminateProcess(Process, STATUS_DEBUGGER_INACTIVE);
				}
				ObDereferenceObject(DebugObject);
			}
		}*/
	}

	while (Entry != &DebugObject->EventList) {
		DebugEvent = CONTAINING_RECORD(Entry, DEBUG_EVENT, EventList);
		Entry = Entry->Flink;
		DebugEvent->Status = STATUS_DEBUGGER_INACTIVE;
		DbgkpWakeTarget(DebugEvent);
	}
}