Replace the CreateEvent/OpenEvent patches with their Nt counterparts like NtOpenEvent and NtCreateE…

sandbox/win/src/interceptors_64.h

Index: sandbox/win/src/interceptors_64.h
===================================================================
--- sandbox/win/src/interceptors_64.h	(revision 229897)
+++ sandbox/win/src/interceptors_64.h	(working copy)
@@ -153,24 +153,16 @@
 // -----------------------------------------------------------------------
 // Interceptors handled by the sync dispatcher.
 
-// Interception of CreateEventW on the child process.
-SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateEventW64(
-    LPSECURITY_ATTRIBUTES security_attributes, BOOL manual_reset,
-    BOOL initial_state, LPCWSTR name);
+// Interception of NtCreateEvent/NtOpenEvent on the child process.
+SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtCreateEvent64(
+    PHANDLE event_handle, ACCESS_MASK desired_access,
+    POBJECT_ATTRIBUTES object_attributes, EVENT_TYPE event_type,
+    BOOLEAN initial_state);
 
-// Interception of CreateEventA on the child process.
-SANDBOX_INTERCEPT HANDLE WINAPI TargetCreateEventA64(
-    LPSECURITY_ATTRIBUTES security_attributes, BOOL manual_reset,
-    BOOL initial_state, LPCSTR name);
+SANDBOX_INTERCEPT NTSTATUS WINAPI TargetNtOpenEvent64(
+    PHANDLE event_handle, DWORD desired_access,

[rvargas (doing something else), 2013/10/23 01:36:57]

nit: I would argue for ACCESS_MASK here

[ananta, 2013/10/23 06:20:18]

Done.

+    POBJECT_ATTRIBUTES object_attributes);
 
-// Interception of OpenEventW on the child process.
-SANDBOX_INTERCEPT HANDLE WINAPI TargetOpenEventW64(
-    ACCESS_MASK desired_access, BOOL inherit_handle, LPCWSTR name);
-
-// Interception of OpenEventA on the child process.
-SANDBOX_INTERCEPT HANDLE WINAPI TargetOpenEventA64(
-    ACCESS_MASK desired_access, BOOL inherit_handle, LPCSTR name);
-
 }  // extern "C"
 
 }  // namespace sandbox