Alex Ionescu wrote:
Looks like the objects aren't being dereferenced
properly. Autochk.exe
is still alive after boot as well.
I've some some testing:
1) Create ExEvent with Nt Function
2) Reference by handle
3) Print New NP Allocs + RefCount
4) Deref
5) Print RefCount
6) Close Handle
7) Print RefCount + Messages in ObpDeleteObject:
(ex/init.c:561) Creating event
******* Dumping non paging pool contents ******
Size 0x28 Tag 0x656e6f4e (None) Allocator 0x80048a45 => The 'hack' for
creating the name. My next patch in my WC does this properly, I will
probably commit it in the next 2-3 hours or so.
Size 0x50 Tag 0x6e657645 (Even) Allocator 0x80049982 => The actual Event
(ex/init.c:584) Refcount of New Event: 2 Header: 8039bd40 => After the
referencing by handle
(ex/init.c:588) Refcount of New Event: 1 => After the ObDeRef
(ob/object.c:877) ObpDeleteObject(Header 8039bd58) => During Ntclose
(ob/object.c:899) Clearing name => The 0x28 block is freed.
(ob/object.c:925) Freeing header at :8039bd40 => The 0x50 block is freed
(ex/init.c:592) Refcount of New Event: cccccccc => After the NT Close.
The header has been de-allocated
So no leaks on this path =(.
Best regards,
Alex Ionescu