[R00tKit]

hi
it use

KeStackAttachProcess -> ZwClose -> KeUnstackDetachProcess

method??

in my first speedy check it dont close handle in user mode with DUPLICATE_CLOSE_SOURCE

[everdox]

you should not be doing that. use NtDuplicateObject.

[EP_X0FF]

hi
it use

KeStackAttachProcess -> ZwClose -> KeUnstackDetachProcess

method??

in my first speedy check it dont close handle in user mode with DUPLICATE_CLOSE_SOURCE

PsLookupProcessByProcessId
KeAttachProcess
ObReferenceObjectByHandle
NtClose
ObfDereferenceObject
KeDetachProcess
ObDereferenceObject

There is function called from it dispatch routine, for v15 it's at 0x10002030.

[R00tKit]

so my guess is true :)
thanks :)