On Thu, Apr 11, 2019 at 2:27 PM Derek Lesho <dereklesho52@gmail.com> wrote:

Jacek says that duplicating and closing the sent handle in
kernel_object_from_handle every time would add unecessary overhead.
---
��dlls/ntoskrnl.exe/ntoskrnl.c | 17 +++++++++++++++--
��1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
index 80a6fa89f7..03f6d78759 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c
@@ -2500,6 +2500,7 @@ PEPROCESS WINAPI IoGetCurrentProcess(void)

��static void *create_thread_object( HANDLE handle )
��{
+�� NTSTATUS status;
�� THREAD_BASIC_INFORMATION info;
�� struct _KTHREAD *thread;

@@ -2508,8 +2509,20 @@ static void *create_thread_object( HANDLE handle )
�� thread->header.Type = 6;
�� thread->header.WaitListHead.Blink = INVALID_HANDLE_VALUE; /* mark as kernel object */

-�� if (!NtQueryInformationThread( handle, ThreadBasicInformation, &info, sizeof(info), NULL ))
+�� if (!(status = NtQueryInformationThread( handle, ThreadBasicInformation, &info, sizeof(info), NULL )))
�� thread->id = info.ClientId;
+�� else if (status == STATUS_ACCESS_DENIED)
+�� {
+�� HANDLE info_handle;
+��
+�� DuplicateHandle( GetCurrentProcess(), handle, GetCurrentProcess(),
+�� &info_handle, THREAD_QUERY_LIMITED_INFORMATION, FALSE, 0);
+
+�� if (!NtQueryInformationThread( handle, ThreadBasicInformation, &info, sizeof(info), NULL ))
+�� thread->id = info.ClientId;
+
+�� NtClose( info_handle );
+�� }

�� thread->critical_region = FALSE;

@@ -2539,7 +2552,7 @@ PRKTHREAD WINAPI KeGetCurrentThread(void)
�� HANDLE handle = GetCurrentThread();

�� /* FIXME: we shouldn't need it, GetCurrentThread() should be client thread already */
-�� if (GetCurrentThreadId() == request_thread) handle = OpenThread( 0, FALSE, client_tid );
+�� if (GetCurrentThreadId() == request_thread) handle = OpenThread( THREAD_QUERY_LIMITED_INFORMATION, FALSE, client_tid );

�� kernel_object_from_handle( handle, PsThreadType, (void**)&thread );
�� if (handle != GetCurrentThread()) NtClose( handle );
--
2.20.1