A source process duplicates handles owned by a target process, without the source process having debug privileges. A handle duplication manager running in kernel space receives requests from source processes for duplicates of handles owned by remote target processes. In response to a request, the handle duplication manager accesses address space of a target process, and calls a system object duplication function with a request to duplicate the requested handle(s) of the target process. The handle duplication manager running in kernel space calls the system function so as to simulate the origin of the call as being the target process running in user space. The duplication manager receives the requested duplicate handle(s) from the system function, and returns them to the requesting source process.

 
Web www.patentalert.com

< System and method for heuristic analysis to identify pestware

> Antibodies to vascular endothelial growth factor 2 (VEGF-2)

~ 00412