[ros-kernel] NtDuplicateObject

[<cra...@mi...>]

I have quickly looked at the way NtDuplicateObject works. Maybe it will help you.

NtDuplicateObject()

1) ObReferenceObjectByHandle(SourceProcessHandle, 40h, PsProcessType, ...ProcessObject)
2) decrement current_thread->Tcb.KernelApcDisable
3) KeWaitForSingleObject(ObpInitKillMutant, 0, 0, 0, 0)
4) if (ProcessObject->Pcb.TrapFrame == 0) {
      KeReleaseMutant(ObpInitKillMutant,...)
      increment KernelApcDisable
      do some check here
      HalRequestSoftwareInterrupt(...)
      ObfDereferenceObject(ProcessObject)
      return(STATUS_PROCESS_IS_TERMINATING)
   }
5) if (current_thread->Tcb.ApcState.Process = ProcessObject) {
      KeAttachProcess(Processobject)
   }
6) ObReferenceObjectByHandle(SourceHandle, ...)
7) if (dunno what :))
      KeDetachProcess(ProcessObject)
8) ObReferenceObjectByHandle(TargetProcessHandle, 40h, PsProcessType, ...ProcessObject2)
9) ...
10) ObpIncrementHandleCount(2, current_thread->Tcb.ApcState, 
11) ...
12) ExCreateHandle(...)
13) if (SeDetailedAuditing == 1) {
       SeAuditHandleDuplication(...)
    }
14) KeReleaseMutant(...)
15) ObfDereferenceObject(ProcessObject)
16) ObfDereferenceObject(ProcessObject2)
17) return(NTSTATUS)

here we go.
assuming :
NTSTATUS NtDuplicateObject(in HANDLE       SourceProcessHandle,
			   IN HANDLE       SourceHandle,
			   IN HANDLE       TargetProcessHandle OPTIONAL,
			   OUT PHANDLE     TargetHandle OPTIONAL,
			   IN ACCESS_MASK  DesiredAccess,
			   IN ULONG        HandleAttributes,
			   IN ULONG        Options);

cya