Recently work more busy, have not had time to see the core programming recently began to read, share notes.
1, the kernel handle after the use of not release will certainly cause a memory leak?
Not necessarily, the kernel handle will be released by the system when the process exits (traversing the kernel handle table, as long as each handle points to a kernel object with a reference count of 0, the kernel will destroy the object, applicable to all kernel objects, resources (GDI objects), memory blocks);
2. How does the kernel object close?
Call CloseHandle (), the kernel looks up the handle table of the process, returns False if the handle is not found (debug throws an exception), and if found, causes the kernel object reference count to point to the handle to subtract one, and if the reference count is 0, the memory used by the object is freed;
3, after the kernel object is created must check the return handle, not all the API call failed to return is NULL, some return is invalid_handle_value (such as: CreateFile);
4, what is the handle exactly?
Different versions of Windows are implemented differently, and the handles are made up of three parts: pointers to kernel object memory blocks, access masks, flags;
5. Three ways for the process to share kernel objects: (Inherit, Name the object, copy the object handle)
5.1 Use object handle inheritance: When a parent-child relationship occurs between processes, the parent process can specify that the object can be inherited when it creates the kernel object. When you create a child process, you specify Binherithandles=true, and the system creates a new, blank process handle table for the child process, and then iterates through the handle table of the parent process, which is copied to the handle table of the child process, all items that contain an "inheritable handle". The location of the copied item is exactly the same as its position in the parent process handle table (this is important because the value of the handle that identifies a kernel object is exactly the same in the parent and child processes), and then the kernel increments the reference count for that kernel object, since two processes are now using that kernel object;
5.1.1 How to make the location of the copied item exactly the same as the position in the parent process handle table: the middle blank position complements the unavailable handle (0x00000000);
The handle table of the 5.1.2 child process is established when the child process is created, and the parent process handle table is copied. Therefore, in the subsequent process, the parent process then creates the kernel object and makes it inheritable, and the child process still cannot inherit the kernel object;
5.1.3 How are shared handles passed between parent-child processes?
1, when the child process is created, pass the handle value through the parameter%u handle;
2, the child process is created after the message is sent, waitforinputidle wait for the child process is complete, and then send the message Postmessage/sendmessage,wparam lparam can be directly passed handle value; (only for programs with message loops)
3, sharing environment variables, slightly.
5.1.4 Changing the handle flag
Sethandleinformation can change whether the handle is inheritable, refuses to close, and gethandleinformation can view the properties that the current process has on the handle. (see MSDN for details)
5.2 Naming the object
5.2.1 the creation of certain kernel objects can be named, Mutex, Event, Semaphore ..., if the object of that name has been created (all kernel object shares share these names, even if the type is different), the handle of the created object is returned, The response copies the handle information to the handle table of the current process;
5.2.2 Terminal namespaces
When naming a kernel object, global\\ the prefix, forcing the specified object into the global namespace; local\\ prefix forces the kernel object into the namespace of the current session;
5.2.3 Copy Object handle
The main use of API DuplicateHandle is to copy the process handle to the handle table of another process, which can be three processes, two processes, and one process for replication.
Most are extracted from the fifth edition of Windows core programming, thanks to the author.
Windows core Programming Note (1)
