对象管理

1. 对象目录

         （1）总体结构

          

         （2）具体结构

0: kd> !object \
Object: 88405e30  Type: (84f436a0) Directory
    ObjectHeader: 88405e18 (new version)
    HandleCount: 0  PointerCount: 41
    Directory Object: 00000000  Name: \

0: kd> dt nt!_object_directory 88405e30  
   +0x000 HashBuckets      : [37] 0x8840eed8 _OBJECT_DIRECTORY_ENTRY
   +0x094 Lock             : _EX_PUSH_LOCK
   +0x098 DeviceMap        : (null) 
   +0x09c SessionId        : 0xffffffff
   +0x0a0 NamespaceEntry   : (null) 
   +0x0a4 Flags            : 0

0: kd> dt nt!_object_directory_entry 0x8840eed8 
   +0x000 ChainLink        : 0x8ac87b50 _OBJECT_DIRECTORY_ENTRY
   +0x004 Object           : 0x8840fa28 Void
   +0x008 HashValue        : 0x2b26d

0: kd> !object 0x8840fa28 
Object: 8840fa28  Type: (84f436a0) Directory
    ObjectHeader: 8840fa10 (new version)
    HandleCount: 0  PointerCount: 7
    Directory Object: 88405e30  Name: ArcName

2. 对象类型

         

3. 句柄与句柄表

         （1）总体结构

          

         （2）具体结构

0: kd> !handle

PROCESS 84fad020  SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 00185000  ObjectTable: 88a01b28  HandleCount: 508.
    Image: System

Kernel handle table at 8764d000 with 508 entries in use

0004: Object: 84fad020  GrantedAccess: 001fffff Entry: 88a03008
Object: 84fad020  Type: (84f4ad70) Process
    ObjectHeader: 84fad008 (new version)
        HandleCount: 3  PointerCount: 154


0: kd> dt nt!_handle_table 88a01b28  
   ......

0: kd> dt nt!_handle_table_entry 0x8763aff8 
   ......

4. 重要函数

         （1）总体结构

          

         （2）具体结构

typedef NTSTATUS
(NTAPI *OB_PARSE_METHOD)(
    _In_ PVOID ParseObject,
    _In_ PVOID ObjectType,
    _Inout_ PACCESS_STATE AccessState,
    _In_ KPROCESSOR_MODE AccessMode,
    _In_ ULONG Attributes,
    _Inout_ PUNICODE_STRING CompleteName,
    _Inout_ PUNICODE_STRING RemainingName,
    _Inout_opt_ PVOID Context,
    _In_opt_ PSECURITY_QUALITY_OF_SERVICE SecurityQos,
    _Out_ PVOID *Object
);