CODEWITHSUNDEEP
c++winapi
WhimsicalGamez
WhimsicalGamez

Reputation: 31

When i use CloseHandle(); why is Event still visible/running

I believe that calling CloseHandle() only closes the reference made to the handle? But the Event is still visible in Process Explorer, and the desired functionality isn't met.

HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (Process32First(snapshot, &entry) == TRUE)
{
    while (Process32Next(snapshot, &entry) == TRUE)
    {
        if (stricmp(entry.szExeFile, "program.exe") == 0)
        {
            HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, entry.th32ProcessID);
            HANDLE hEvent = OpenEventA(EVENT_ALL_ACCESS,FALSE,"openEvent");
            // Do stuff..

            int sucess = CloseHandle(hEvent);
        }
    }
    count = 0;
}
CloseHandle(snapshot);

Is there something I'm doing wrong? Why would the Event still be visible in Process Explorer?

Upvotes: 0

Views: 160

Answers (1)

IInspectable
IInspectable

Reputation: 51345

Kernel objects are reference counted. Calling CloseHandle decrements the reference count, but the referenced object doesn't get removed, until the final handle to it gets closed.

In the code for OpenEventA to return a non-NULL value, the event referenced by name must already exist (i.e. its reference count must be at least 1). OpenEventA increments the reference count, and CloseHandle decrements it, but it's still at least 1 (unless the other handles to that event object have been closed).

Consequently the event object doesn't get closed, and Process Explorer rightfully reports that the event object still exists.

Upvotes: 1

Related Questions