Process ID is unique across the whole system. Process handle is unique for
each process. ZwDuplicateObject accepts handles only, not process IDs.


"MountainKing" <MountainKing@discussions.microsoft.com> wrote in message
news:5B0CF879-DC62-440E-AB65-A1E9176596A3@microsoft.com...

Sorry for not being clear enough.

Each process has a process id which is unique across the system. A [file,
process, section etc.] handle is meaningful within its own process only. Say
we have processes A, B and C with IDs 10, 20 and 30.

A has an open handle to B, hB=0xA4, and two open handles to C, hC1=0xA8,
hC2=0x120.
B has handles to A and C, hA=0xC8 and hC=0xA4.

As you see, handle=0xA4 may point to process B in the context of A, and to
process C in the context of B. Handle=0xA8 may point to process C in the
context of process A, but may point say to an event, file or be completely
invalid in the context of process B.

You have to resolve process ids to handles to use ZwDuplicate which accepts
handles only.


<nospam@cristalink.com> wrote in message
news:Ov2TKmxfEHA.3536@TK2MSFTNGP12.phx.gbl...

nospam@cristalink.com wrote:
unless it's a kernel handle.

-sd

Thank you. Mr.nospam
I really appreciate your help.

"nospam@cristalink.com" wrote: