0

During the analysis of a piece of code, I have seen that a process is created in a suspended state. The process had one thread. Then they are changing the start address of that thread. After doing that, the thread is started with ResumeThread(). Later, it closes the handle to the process using CloseHandle().

So, my question would be : Is it possible that the thread with the manipulated start address is still running after we close the handle to the corresponding process? Is the thread still running although the process to which it belongs is closed because of the changed starting address or will the thread also closed automatically after CloseHandle(processhandle) ?

Best regards,

2

Is it possible that the thread with the manipulated start address is still running after we close the handle to the corresponding process? Is the thread still running although the process to which it belongs is closed because of the changed starting address or will the thread also closed automatically after CloseHandle(processhandle) ?

Yes. From the official CloseHandle() documentation:

"Closing a thread handle does not terminate the associated thread or remove the thread object. Closing a process handle does not terminate the associated process or remove the process object."

2
  • aah, ok. Thanks. The next time I will look at the documentation. Mar 29 '15 at 16:16
  • the process handle exists in order for the parent process (the one who created it) to further manipulate the process at any point. The act of closing the handle only means that the parent must acquire the process handle again in order to make changes later. Mar 29 '15 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.