I was looking at the docs for DuplicateHandle
the other day and noticed that DuplicateHandle is able to copy registry key handles (HKEY
s). Reading up on this a bit more in the SysInternals book seems to indicate that registry key handles are plain kernel objects, similar to file handles. Yet CloseHandle
can't close HKEY
s, and RegCloseKey
can't close other kinds of kernel objects.
Why the distinction?
CloseHandle()
it says: > Closing a thread handle does not terminate the associated thread or remove the thread object. Closing a process handle does not terminate the associated process or remove the process object. To remove a thread object, you must terminate the thread, then close all handles to the thread. For more information, see Terminating a Thread. To remove a process object, you must terminate the process, then close all handles to the process. There could be similar operations done while closing a registry key. – yasouser Mar 6 '12 at 22:26