[Autogenerated] You may be wondering how does cross Explorer,
able to close a handle in another process.
So one option you might be considering is that
cross Explorer has a kernel driver, maybe its kernel driver,
is doing the closing in some kernel way.
So it's definitely possible, but that's not actually how it works.
Instead there is another way.
That you can actually use from user mode as well in order to
close the handle in a different process.
If you have enough power in terms of security the close handle,
API can only close the handle, in the current process,
you cannot close the handle in a different process just by calling close
handle in order to close a handle different process.
Here's what you need.
To do The first thing you need.
To do is to open, a handle, to that target process with the process,
loop handle, access mask at the very least,
and then Once you have that you can call duplicate handle,
API that we've seen already in previous modules,
but you need to use the last flags.
You can specify there with duplicate closed source Essentially,
you're saying I would like to close the source of the duplication
essentially trying to duplicate from that process back,
to your process.
In fact, you can duplicate back.
To null, indicating you're only interested in really closing.
That source handle, and that is it,
this is all you need to do If you are able to get a handle,
to the target process for the process.
Loop handle, access mask, which you can do for many processes.
And Also, of course,
it depends on whether you're running with admin privileges or not.
You will not be able to do that with protected processes,
but you will be able to do that with other processes
given if you have enough permissions,
and then you'll be able to call duplicate handle with
duplicate close source and do the deed,
press explore by the way is able to close a handle in any
process including protected processes.
And That's because it opens a handle,
to the target process using its kernel driver if it's running elevated,
so it gets that extra, power that allows a kernel component,
to open, a handle with any access mask, to any process.
So it actually has some more power in this regard,
but its still using the same procedure in order to close
the handle in a different process.
I'm not going to show you in the code example for that I'm
going to Leave that as an exercise for you dear,
viewer, and If you have questions,
just uh just go ahead and and post them on the discussion board.