| 1517 | } |
| 1518 | |
| 1519 | NTSTATUS NtRemoveProcessDebug( |
| 1520 | _In_ HANDLE ProcessHandle, |
| 1521 | _In_ HANDLE DebugObjectHandle |
| 1522 | ) { |
| 1523 | NTSTATUS status; |
| 1524 | PEPROCESS Process, CurrentProcess; |
| 1525 | KPROCESSOR_MODE PreviousMode; |
| 1526 | PDEBUG_OBJECT DebugObject; |
| 1527 | |
| 1528 | PreviousMode = ExGetPreviousMode(); |
| 1529 | |
| 1530 | status = ObReferenceObjectByHandle( |
| 1531 | ProcessHandle, |
| 1532 | PROCESS_SUSPEND_RESUME, |
| 1533 | *PsProcessType, |
| 1534 | PreviousMode, |
| 1535 | (PVOID*)&Process, |
| 1536 | nullptr |
| 1537 | ); |
| 1538 | if (!NT_SUCCESS(status)) { |
| 1539 | return status; |
| 1540 | } |
| 1541 | |
| 1542 | if (PreviousMode == UserMode) { |
| 1543 | CurrentProcess = PsGetCurrentProcess(); |
| 1544 | } |
| 1545 | |
| 1546 | status = ObReferenceObjectByHandle(DebugObjectHandle, |
| 1547 | DEBUG_OBJECT_KILL_ON_CLOSE, |
| 1548 | *DbgkDebugObjectType, |
| 1549 | PreviousMode, |
| 1550 | (PVOID*)&DebugObject, |
| 1551 | nullptr); |
| 1552 | if (!NT_SUCCESS(status)) { |
| 1553 | ObDereferenceObject(Process); |
| 1554 | return status; |
| 1555 | } |
| 1556 | |
| 1557 | status = DbgkClearProcessDebugObject((PEPROCESS)Process, DebugObject); |
| 1558 | |
| 1559 | ObDereferenceObject(DebugObject); |
| 1560 | ObDereferenceObject(Process); |
| 1561 | return status; |
| 1562 | } |
| 1563 | |
| 1564 | BOOLEAN |
| 1565 | DbgkpSuspendProcess( |
nothing calls this directly
no test coverage detected