Alex Ionescu wrote:
Looks like the objects aren't being dereferenced properly. Autochk.exe is still alive after boot as well.
I've some some testing:
1) Create ExEvent with Nt Function 2) Reference by handle 3) Print New NP Allocs + RefCount 4) Deref 5) Print RefCount 6) Close Handle 7) Print RefCount + Messages in ObpDeleteObject:
(ex/init.c:561) Creating event ******* Dumping non paging pool contents ****** Size 0x28 Tag 0x656e6f4e (None) Allocator 0x80048a45 => The 'hack' for creating the name. My next patch in my WC does this properly, I will probably commit it in the next 2-3 hours or so. Size 0x50 Tag 0x6e657645 (Even) Allocator 0x80049982 => The actual Event (ex/init.c:584) Refcount of New Event: 2 Header: 8039bd40 => After the referencing by handle (ex/init.c:588) Refcount of New Event: 1 => After the ObDeRef (ob/object.c:877) ObpDeleteObject(Header 8039bd58) => During Ntclose (ob/object.c:899) Clearing name => The 0x28 block is freed. (ob/object.c:925) Freeing header at :8039bd40 => The 0x50 block is freed (ex/init.c:592) Refcount of New Event: cccccccc => After the NT Close. The header has been de-allocated
So no leaks on this path =(.
Best regards, Alex Ionescu