From 2d24b4189d4c4e8908ef335ff3d9d93c71ce3a42 Mon Sep 17 00:00:00 2001
From: 66hh <49398720+66hh@users.noreply.github.com>
Date: Sat, 27 Dec 2025 19:51:29 +0800
Subject: [PATCH] Fix VMP NtClose detection

---
 src/windows-emulator/syscalls/object.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/windows-emulator/syscalls/object.cpp b/src/windows-emulator/syscalls/object.cpp
index 99b77746..74201e67 100644
--- a/src/windows-emulator/syscalls/object.cpp
+++ b/src/windows-emulator/syscalls/object.cpp
@@ -6,7 +6,14 @@ namespace syscalls
 {
     NTSTATUS handle_NtClose(const syscall_context& c, const handle h)
     {
+
         const auto value = h.value;
+
+        if (h.h == 0xDEADC0DE)
+        {
+            return STATUS_INVALID_HANDLE;
+        }
+
         if (value.is_pseudo)
         {
             return STATUS_SUCCESS;