Summary of Windows Kernel Object handle inheritance

Object handle inheritance

 

There are three common mechanisms for sharing kernel objects across process boundaries:For object naming, copying object handles, and using object handles for inheritance.

 

Windows supports "inheritance of object handles" instead of inheriting objects. (The kernel object is essentially a memory block allocated by the operating system kernel and can only be accessed by the operating system kernel. The handle identifies the created kernel object, which is related to the process. The handle value can be considered as an index value of the Process Handle table, which identifies the location of the kernel object in the Process Handle table. Process Handle table, which can be imagined as an array composed of data structures .)

To use the inheritance of object handles, two steps are required.

Step 1: Create an inherited handle. The parent process must allocate and initialize a SECURITY_ATTRIBUTES structure, and assign a value of bInheritHandle to TRUE, and pass the address of the structure to the specific Create function. (Setting the bInheritHandle of the structure member to TRUE only indicates that the kernel object can be inherited. Can the sub-process be inherited? Also, refer to the CreateProcess call parameters in step 2)

 

Step 2: A child process is generated by the parent process by calling the CreateProcess function and passing TRUE to the bInheritHandles parameter. This value indicates to the system that a sub-process can inherit the "inherited handle" from the parent process handle table ". (The "extensible handle" refers to the object in step 1 that sets the member bInheritHandle to TRUE .)

 

To sum up, the member bInheritHandle of the SECURITY_ATTRIBUTES structure only determines whether the child process created in the parent process can be inherited, also refer to bInheritHandles of the parent process in CreateProcess call. This parameter determines whether the child process is eligible to inherit the "asset" of the parent process. What is the significance of those assets that can be inherited by the company. Ha, write it here, I suddenly think of A metaphor of A's taste: A's father is dead. Normally, A can inherit his father's property (the handle of the inherited object ), but his father's wife, he cannot inherit (the handle of the object that cannot be inherited ). Now let's consider another situation, that is, A's father wrote his will before he died, so that A cannot inherit anything from him (bInheritHandles in CreateProcess is FALSE ), then A cannot get anything from his father.

 

If you want to better understand the functions of these two bInheritHandle, you can refer to the program P88 in "Windows core programming 5th", which is a very good description of this mechanism. It also details the functions of psaProcess and psaThread in CreateProcess calls.

 

PS: most of the above are taken from the original Chinese words in the book, and a small part of them summarize their own words. If there are any mistakes, please point them out, thank you.