how does procexp close a mutex held by another process?

Question

I am trying to close a mutex that is being held by a process on Windows using Win32 functions. This can be done using procexp but I need to do it programmatically without using the procexp GUI.

Method1: I tried injecting a dll into the processs using EasyHook and then tried the following from the injected thread: - OpenMutex
- ReleaseMutex It gave me the ERROR_NOT_OWNER error probably because the release was called on a different thread than the one that called AcquireMutex.

Method2: After injecting the dll, I tried to hook for CreateMutex using mHook. The hooked CreateMutex just called back the original CreateMutex. But this would just crash the application.

I can use procexp to close the mutex but I need to do it programmatically. How does procexp do it? How can it be done programmatically without any kernel mode code?

Answer 1

Use NtQuerySystemInformation() to retrieve an array of open handles, loop through the array until you find the desired mutex handle in the target process, then close it using DuplicateHandle() by specifying the DUPLICATE_CLOSE_SOURCE flag.

The following article explains it in more detail:

HOWTO: Enumerate handles