Closehandle when supplied with wrong handle raises exception_invalid_handle (0xc0000008) exception, but only when process is debugged. Learn how to specify which exceptions the debugger breaks on, at which point you want the debugger to break, and how breaks are handled. When you try to close an invalid handle, the system throws an exception_invalid_handle exception.
Ntdll!ntclose() or kernel32!closehandle() function, then the exception_invalid_handle (0xc0000008) exception will be raised. In my test app, i call ntclosehandle inside of a try / except block with an invalid handle value. If there is no debugger connected, the process.
If a debugger is present and passes the exception to the debuggee with hardware breakpoints in use, then the debug registers will contain values that reveal the presence of the. We can use this information to. If a process is running under a debugger and an invalid handle is passed to the ntdll!ntclose () or kernel32!closehandle () function, then the exception_invalid_handle (0xc0000008). Debugger interrupts update magic values from inside int3 and int1 exception handlers values are not set if exceptions are handled by the debugger itself example set eax to 0xffffffff.
I noticed that in this case, my debugger doesn't receive the.