Tracking CloseHandle / SetCreateProcessNotifyRoutine

NTDEV
1

Hi this post is seperated into two questions:

It is possbile with help of documented functions to track CloseHandle calls on file object. I need to know which process id is closing a handle to a specific file object?

The other questionis related to the callback registered by SetCreateProcessNotfiyRoutine.
Sometimes the thread in the callback is marked as being terminated. If i try to suspend the thread i am getting a ntsatus value of 0xc000004b - STATUS_THREAD_TERMINATING.
As i said only sometimes so is there a way to determine when and why this happens and can i somehow achieve to suspend in form of deleting this flag for example?

Thanks in advance.

2

When the last handle to FILE_OBJECT is closed, the target driver gets IRP_MJ_CLEANUP in the context of the calling thread/process.

3

Yea but i need to track every CloseHandle on file objects. Not only the last one causing the clean up

4

>Yea but i need to track every CloseHandle on file objects. Not only the last one causing the clean up

What problem are you trying to solve with that?

5

Monitoring contents of files being copied onto the system

6

>Monitoring contents of files being copied onto the system

Oh no, not again. This forum has been through that too many times.

And why do you think the last CloseHandle is not enough?

7

I don’t really need to know whether it is copied or not. I just want to check files after a specific process has closed the handle on it. ( And immediately after or while closing it not any time in the future when all processes are done )

8

>I just want to check files after a specific process has closed the handle on it.

A specific process being Explorer.exe? or cmd.exe? Do you realize you can use any application with File Open/Save dialog to copy files?

9

As i mentioned before i am not interested in copying files. My goal is f.e. to monitor the duration each process on the system has opened a handle. I also don’t need to detect a copying mechanism.

My only question is if it’s possible to track down CloseHandle calls on file objects. Not more, not less.

10

> Hi this post is seperated into two questions:

It is possbile with help of documented functions to track CloseHandle
calls on file object. I need to know which process id is closing a handle
to a specific file object?

What good could this do? See my earlier response to a similar message.
Bottom line: knowing the process ID seems to be completely useless
information anyway, due to duplication and inheritance. Any concept about
this telling you about file object lifetime is misplaced. One CreateFile
call has potentially MANY CloseHandles, and only the last one, not
necessarily issued by the creating process, is the one which initiates the
sequence which eventually causes te file object to evaporate in a puff of
greasy blue smoke. Maybe a filesystem guy can tell us the implications of
pending cache writes on file object lifetime; I freely admit that I have
no idea.

The other questionis related to the callback registered by
SetCreateProcessNotfiyRoutine.
Sometimes the thread in the callback is marked as being terminated. If i
try to suspend the thread i am getting a ntsatus value of 0xc000004b -
STATUS_THREAD_TERMINATING.
As i said only sometimes so is there a way to determine when and why this
happens and can i somehow achieve to suspend in form of deleting this flag
for example?

The use of SuspendThread should be limited; for all practical purposes,
you can safely assume that any program that does this is erroneous. There
are some extremely rare and highly exotic situations in which this API can
be considered, but for everyday programming, it represents something far
below Worst Practice. If you are using it, rewrite your code!

(And don’t say “i’ve never seen it fail”. Don’t worry, it will, on some
mission-critical server in Elbonia; hundreds of pigs will die, and
shrink-wrapped EULA aside, they’ll try to sue you)

Thanks in advance.

Note that it IS common practice to create a thread with the
CREATE_SUSPENDED flag, and issue precisely ONE ResumeThread call, although
it is possible to make valid arguments that this technique violates good
programming practice. I can argue on either side of this case. But
unless you are doing something EXTREMELY off-the-reservation,
SuspendThread is Very Bad Juju. It is one of my indicators for code that
is intrinsically BAD (that’s Broken As Designed) and if I find it, before
I will even consider doing any debugging, I will have to rewrite the code
so it works. Sleep calls are another example of BAD code, and I have yet
to see one used correctly. They are like big flashing neon signs that say
“WARNING!!! CONCURRENT CODE WRITTEN BY TRULY CLUELESS PROGRAMMER HERE!!!”
In 20 years, I can count the valid usages I’ve found of Sleep() on the
thumbs of one hand (I ripped it out anyway, and replaced it with something
more robust. It wasn’t /wrong/, but its usage was a definitely
sub-optimal design)
joe

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

11

Why would this be useful? What do you expect to learn from it.
Generally, when someone asks how to get the process ID, my bogometer
redlines.
joe

Yea but i need to track every CloseHandle on file objects. Not only the
last one causing the clean up

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

12

This usually boils down to

  • Malware
  • Questionable ethical issues about employee privacy
  • People who erroneously think that such monitoring is going to solve
    some problem

The answer to all of the above, in inverse order, are “You don’t fully
understand the problem, or you’d know why your solution cannot work”,
“NO!” and “HELL, NO!!!”
joe

Monitoring contents of files being copied onto the system

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

13

Lets focus to the suspending problem. I am not using SuspendThread. I want to communicate with helps of FltSendMessage in this callback which causes the thread to wait because it is synchronous.

This is not be any kind of malware. Just a monitoring of some resources.

14

>This is not be any kind of malware. Just a monitoring of some resources.

Resources as: Disk space?

15

F.e. kind of monitoring like process explorer does. Which also tracks Handles, process termination, process creation, etc. etc.

16

And Process Explorer or at least its predecessor filemon did this with
monitoring the same calls that you can get in a mini-filter.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@hotmail.de” wrote in message
news:xxxxx@ntdev:

> F.e. kind of monitoring like process explorer does. Which also tracks Handles, process termination, process creation, etc. etc.

17

>>I just want to check files after a specific process has closed the handle

> on it.

A specific process being Explorer.exe? or cmd.exe? Do you realize you can
use any application with File Open/Save dialog to copy files?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

And, of course, the process that closes the last handle may not be the
process that opens the first handle, ref DuplicateHandle and inheritance.
A belief in “the” handle is a serious failure in the specification thus
far.
joe

18

> In 20 years, I can count the valid usages I’ve found of Sleep() on the

Poor man’s pre-Vista disk IO throttling is one case.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com