Question

I need to perform these three steps in vc++ .net

1. Kill the original pipe

2. Make the new pipe

3. Get rid of a running application that is using the new pipe

Using Process explorer and using the button (‘Find Handle or DLL’) and the command (“\Device\NamedPipe\”) I found that the namedpipe I would need to kill and re create would be (“\Device\NamedPipe\C:\Users\Andrew\Desktop\The Library\Media\Games\Nexon\MapleStory\BlackCipher\NexonGuard”).

The references would also be that it has 1 handle.

If possible how would I fetch for pipe names instead of using Process Explorer.

I am simply asking how I can get started on these 3 steps and I would be coding this in vc++ .net.

Answer 1

1. Generally speaking, you can’t. A pipe, like any other executive object (file, registry key, etc.), is not destroyed until all of the handles to that object are closed. You would have to force the process(es) using the pipe to close it for you.

2. You create a new pipe by calling CreatePipe.

3. There is not a documented means of doing this. You would need to walk through each process’ handle table to see if they had a handle to the given pipe, and then call TerminateProcess on that process. Most likely you would need to take the SeDebugPrivilege to do this. (And if you are in fact trying to get around anti cheat systems, taking this privilege and inspecting the guts of the program in question will probably set something off 😉 )

Process explorer achieves #3 by loading into the Kernel (a driver), but that’s not doable from anything like Visual Studio — you would need to learn to write drivers and those are built with the Windows Driver Kit.