Process/thread identification (WINDOWS core programming)

In general, we will use the GetCurrentProcess () or GetCurrentThread () function to obtain a process handle or thread handle. However, it is worth noting that the function returns only a pseudo handle of its kernel object. When using this pseudo handle, we may not be able to achieve the desired effect in some cases. Example: Code
1 dword winapi ParentThread (PVOID pvParam)
2 {
3 HANDLE hThreadParent = GetCurrentThread ();
4 CreateThread (NULL, 0, ChildThread, (PVOID) hThreadParent, 0, NULL );
5
6}
7
8 dword winapi ChildThread (PVOID pvParam)
9 {
10 HANDLE hThreadParent = (HANDLE) pvParam;
11 FILETIME ftCreationTime, ftExitTime, ftKernelTime, ftUserTime;
12 GetThreadTimes (hThreadParent, & ftCreationTime, & ftExitTime, & ftKernelTime, & ftUserTime );
13
14}
15
16

The parent thread passes its own handle to the subthread. The subthread obtains the CPU usage time of the parent thread in the thread processing function. However, this intent cannot be implemented because a pseudo handle of the parent thread is passed, resulting in the acquisition of the CPU usage time of the subthread.
Definition of a pseudo handle: A handle pointing to the current thread/process.
In the above example, the current thread is a sub-thread, so the pseudo handle passed is the sub-thread handle. The solution requires flexible use of the DuplicateHandle function to convert a pseudo handle to a real handle. 1 BOOL DuplicateHandle (
2 HANDLE hSourceProcess,
3 HANDLE hSource,
4 HANDLE hTargetProcess,
5 PHANDLE phTarget,
6 DWORD dwDesiredAccess,
7 BOOL bInheritHandle,
8 DWORD dwOptions );

The DuplicateHandle function is intended to share the kernel object and copy the handle of the object across process boundaries. The first and third parameters must be the process kernel object handle. The second parameter can be any type of kernel object handle, but cannot be related to the main process handle of the function; the fourth parameter is the copied handle address. It can be seen from the type that it is the handle pointing to the kernel object handle. The last three parameters are not described here, which has little impact on this issue. Code
1 dword winapi ParentThread (PVOID pvParam)
2 {
3 HANDLE hThreadParent ();
4
5 DuplicateHandle (
6 GetCurrentProcess (),
7 GetCurrentThread (),
8 GetCurrentProcess (),
9 & hThreadParent,
10 0, FALSE,
11 DUPLICATE_SAME_ACCESS );
12
13 CreateThread (NULL, 0, ChildThread, (PVOID) hThreadParent, 0, NULL );
14
15}
16
17 dword winapi ChildThread (PVOID pvParam)
18 {
19 HANDLE hThreadParent = (HANDLE) pvParam;
20 FILETIME ftCreationTime, ftExitTime, ftKernelTime, ftUserTime;
21 GetThreadTimes (hThreadParent, & ftCreationTime, & ftExitTime, & ftKernelTime, & ftUserTime );
22 CloseHandle (hThreadParent );
23
24}

Because DuplicateHandle increases the usage count of kernel objects, you must call the CloseHandle () function after the Copied object handle is used up to reduce the Usage Technology of kernel objects. Here, we add that the handle parameter accepted by CloseHandle () must also be a real handle. If a pseudo handle is passed, FALSE is returned and GetLastError () will return ERROR_INVALID_HANDLE.