| 230 | } |
| 231 | |
| 232 | VOID DbgkpFreeDebugEvent( |
| 233 | _In_ PDEBUG_EVENT DebugEvent |
| 234 | ) { |
| 235 | NTSTATUS status; |
| 236 | |
| 237 | switch (DebugEvent->ApiMsg.ApiNumber){ |
| 238 | case DbgKmCreateProcessApi: |
| 239 | if (DebugEvent->ApiMsg.u.CreateProcess.FileHandle != nullptr) { |
| 240 | status = ObCloseHandle(DebugEvent->ApiMsg.u.CreateProcess.FileHandle, KernelMode); |
| 241 | } |
| 242 | break; |
| 243 | case DbgKmCreateThreadApi: |
| 244 | if (DebugEvent->ApiMsg.u.LoadDll.FileHandle != nullptr) { |
| 245 | status = ObCloseHandle(DebugEvent->ApiMsg.u.LoadDll.FileHandle, KernelMode); |
| 246 | } |
| 247 | break; |
| 248 | } |
| 249 | ObDereferenceObject(DebugEvent->Process); |
| 250 | ObDereferenceObject(DebugEvent->Thread); |
| 251 | ExFreePool(DebugEvent); |
| 252 | } |
| 253 | |
| 254 | NTSTATUS PsResumeThread( |
| 255 | _In_ PETHREAD Thread, |