Update PhCreateProcessSnapshot flags, Fix handle leak
@@ -8576,19 +8576,14 @@ NTSTATUS PhCreateProcessSnapshot(
_In_opt_ HANDLE ProcessId
)
{
- NTSTATUS status;
- HANDLE processHandle = NULL;
+ NTSTATUS status = STATUS_SUCCESS;
+ HANDLE processHandle = ProcessHandle;
HANDLE snapshotHandle = NULL;
if (!PssCaptureSnapshot_Import())
return STATUS_PROCEDURE_NOT_FOUND;
- if (ProcessHandle)
- {
- processHandle = ProcessHandle;
- status = STATUS_SUCCESS;
- }
- else
+ if (!ProcessHandle)
{
status = PhOpenProcess(
&processHandle,
@@ -8602,11 +8597,12 @@ NTSTATUS PhCreateProcessSnapshot(
status = PssCaptureSnapshot_Import()(
processHandle,
- PSS_CAPTURE_VA_CLONE | PSS_CAPTURE_VA_SPACE | PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION |
- PSS_CAPTURE_HANDLE_TRACE | PSS_CAPTURE_HANDLES | PSS_CAPTURE_HANDLE_BASIC_INFORMATION |
- PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION | PSS_CAPTURE_HANDLE_NAME_INFORMATION |
- PSS_CAPTURE_THREADS | PSS_CAPTURE_THREAD_CONTEXT | PSS_CREATE_USE_VM_ALLOCATIONS,
- CONTEXT_ALL,
+ PSS_CAPTURE_VA_CLONE | PSS_CAPTURE_HANDLES | PSS_CAPTURE_HANDLE_NAME_INFORMATION |
+ PSS_CAPTURE_HANDLE_BASIC_INFORMATION | PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION |
+ PSS_CAPTURE_HANDLE_TRACE | PSS_CAPTURE_THREADS | PSS_CAPTURE_THREAD_CONTEXT |
+ PSS_CAPTURE_THREAD_CONTEXT_EXTENDED | PSS_CAPTURE_VA_SPACE | PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION |
+ PSS_CREATE_BREAKAWAY | PSS_CREATE_BREAKAWAY_OPTIONAL | PSS_CREATE_USE_VM_ALLOCATIONS,
+ CONTEXT_ALL, // WOW64_CONTEXT_ALL?
&snapshotHandle
);
status = PhDosErrorToNtStatus(status);
@@ -8626,10 +8622,13 @@ VOID PhFreeProcessSnapshot(
_In_ HANDLE SnapshotHandle,
_In_ HANDLE ProcessHandle
)
+{
+ if (PssQuerySnapshot_Import())
{
PSS_VA_CLONE_INFORMATION processInfo = { 0 };
+ PSS_HANDLE_TRACE_INFORMATION handleInfo = { 0 };
- if (PssQuerySnapshot_Import() && PssQuerySnapshot_Import()(
+ if (PssQuerySnapshot_Import()(
SnapshotHandle,
PSS_QUERY_VA_CLONE_INFORMATION,
&processInfo,
@@ -8642,6 +8641,20 @@ VOID PhFreeProcessSnapshot(
}
}
+ if (PssQuerySnapshot_Import()(
+ SnapshotHandle,
+ PSS_QUERY_HANDLE_TRACE_INFORMATION,
+ &handleInfo,
+ sizeof(PSS_HANDLE_TRACE_INFORMATION)
+ ) == ERROR_SUCCESS)
+ {
+ if (handleInfo.SectionHandle)
+ {
+ NtClose(handleInfo.SectionHandle);
+ }
+ }
+ }
+
if (PssFreeSnapshot_Import())
{
PssFreeSnapshot_Import()(ProcessHandle, SnapshotHandle);
