Jason Edmeades jason.edmeades@googlemail.com writes:
What I dont understand is why the NtClose for the handle does not remove it from the 'open' list - I think from my reading of the fd_destroy code it will put it onto the closed list if there are other references to the same inode, although thats where my debugging will head next.
Loading a dll keeps a reference to the file object, because it needs to be returned in debug events. Probably it would be possible to reference the mapping object instead and reopen the file from it.