Introduction and use of winobj

Address: http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx

Recently reading windowsCore programming",The above briefly mentions how to use winobj to view kernel objects in the current system. MeFind the winobj introduction on the Internet and translate it.The translation is not good. Please give me some advice.

1. Introduction

Winobj is an essential tool for security-oriented system administrators. It can also helpProgramDevelopers solve Kernel Object-related bugs. We can use winobjEasy to viewThe current Kernel Object of the system andNamespace.

Winobj is a 32-bit Windows kernel program that uses the local Windows Kernel API (provided by NTDLL. dll) to access and display information about the namespace of the kernel object manager. Winobj seems to be similar to a program with the same name as Microsoft SDK, but there are many major program errors in the SDK version, which will prevent it from displaying accurate information (for example, its handle and reference count information are completely interrupted ). In addition, our winobj supports more object types. Finally, winobj 2.0 is enhanced in the user interface. It knows how to open the device object and allows you to use the native NT
Security editor to view and change object security information.

2. Running Mode
Winobj can run like any Win32 program without any device driver components. Programs downloaded from the preceding websiteCan run directlyInstall.

For more methods, we need to continue to explore the practices to be continued.