Windows core programming notes 1-kernel objects

Because. in the net framework, some previous knowledge points in Win32 are used in many places. If you do not know about the NLP, it will be difficult to learn it. Therefore, you are prepared to take some time to supplement the Windows core knowledge points, the reference book is a classic <windows core programming>. after learning, you can have this foundation to study. <. net Framework Program Design> this classic.

Starting from Chapter 3 kernel objects ....

What are kernel objects and what are their features?
In Windows programming, creating an object such as Hpen pen = new Hpen () is equivalent to creating an object. Windows API has many built-in classes, such as the paint brush class, font class, and rectangle class. objects Created Based on classes are not all kernel objects. So what is the kernel object? What are the basic features of kernel objects?
The kernel object is a memory block allocated by the kernel. This memory block is a data structure that represents various features of the kernel object. And can only be accessed by the kernel. If an application needs to access a kernel object, it must use the functions provided by the operating system ( Windows In terms of security ).
Note: first, the kernel objects are allocated by the kernel and are not instantiated by the customer. Therefore, the new objects are not kernel objects, you must use the system function create * () to create kernel objects (for example, createfilemapping is used to create a file ing kernel object ).
Second, the object also carries data in the data structure. Different from other objects, the data structure can be freely changed. The data structure of the kernel object must comply with the specifications and be fixed. An application can only be created, used, and used to modify data in the kernel object, but cannot change its memory structure status.
Third, creating a kernel object is a handle that returns the object (which can be understood as a special pointer). These handles can be used in the process where the kernel is created, it cannot be used in external processes. We manipulate the kernel object by manipulating the handle. (Note: The handle cannot be used in external processes, rather than kernel objects. kernel objects can be shared among multiple processes .)
Fourth, we can't change the data structure of kernel objects. How can we manipulate these kernel objects? A: Microsoft defines a set of functions, in order to operate the data structure in a good way. We will pass the created handle to these functions, and the system will know which kernel object you want to operate, and then operate according to the system-defined method.
5. the kernel object is allocated and created by the system. Its owner belongs to the kernel rather than the process. Therefore, if the process calls a function to create the kernel object, and then the process stops running, but the kernel object may not be revoked. (In most cases, the kernel object will be revoked. If another process has a handle to this kernel object, it will not be revoked .) Remember: The kernel object may last longer than the process that created the object.
The sixth reason is that multiple processes can share a single kernel object. Therefore, the data structure of the kernel object must contain a counter data member, to indicate how many processes own the kernel object.

Kernel Object Security:
The kernel object can be protected by a security descriptor. The security descriptor describes who created the object, who can use the object, and who has no permission to use the object. So how can we use this security feature?
For example:

Handle createfilemapping (
Handle hfile.
Psecurity_attributes PSA,
DWORD flprotect,
DWORD dwmaximumsizehigh,
DWORD dwmaximunisizelow,
Pctstr psznarne );

Among them, the second parameter psecurity_attributes is about the security parameter. Generally, you can pass in null to indicate the default security.

About other objects in windows. Applications can create objects such as menus, windows, cursors, and brushes. These objects are user objects or graphic device interface objects, rather than kernel objects. They must be separated. To determine whether the created object belongs to the kernel object, check whether the function of the created object has the security descriptor parameter.

Shut down the kernel object and call the system function bool closehandle (handle hobj) to shut down the kernel.