What is a handle? Why is there a handle? Handle

In a broad sense, anything that can extract a large amount of data from a value can be called a handle. The English "handle" is the handle, which is translated into a "handle" in computer science. It is actually a "handle ". Isn't it like a "handle" to pick up a bunch of things from a little thing?

Then, the pointer is actually a "handle", but because the pointer has a more special meaning at the same time-actually corresponds to an address in the memory-so, generally, the pointer is not a "handle ". However, pointers can also be referenced from a 32-bit value to a large amount of data. What is this not a handle?

In Windows, there are many kernel objects (the objects here are not exactly equivalent to "Object-Oriented ".ProgramDesign "the" object "in the word, although it is actually similar), such as opening files, creating threads, program windows, and so on. These important objects are certainly not 4 bytes or 8 bytes fully described. They have a large number of attributes. In order to save such an "object" state, it usually requires hundreds or even thousands of bytes of memory space. How can we transmit the data between programs or internal sub-processes (functions? Are you dragging hundreds of bytes to copy them? Obviously, it will be a waste of efficiency. So what should we do? Of course, it is one way to pass the first address of these objects, but there are at least two disadvantages:

1. Exposes the kernel object itself, so that the Program (rather than the operating system kernel) can modify the internal state of the object at Will (the first address is known, and what else can't be changed ?), This is obviously not allowed by the operating system kernel;
2. The operating system is responsible for regularly sorting out memory. What if the object is removed after some memory is sorted once?

Therefore, the Windows operating system uses the following indirect method: set a table in the address space of the process, and the table header stores some numbers and corresponds to an address, the actual object is referenced by the address. This number does not have any regular relationship with the address in the value. It is purely a ing.

In Windows, this number is called "handle ".

 

Handle is widely used in windows. Unless otherwise stated, handle mentioned below will be limited to the context of processes and threads.

1. Let's talk about handle first.

Handle itself is a 32-bit unsigned integer used to represent a kernel object. It does not point to the actual kernel object. In user mode, a program can never obtain the actual address of a kernel object (generally ). So what is the significance of handle? It is actually used as an index to find the actual address of the corresponding kernel object in a table. So where is this table? EachProcessThere is such a table, called a handle table. The first item in this table is the process's own handle, which is why you always return 0x7fffff when calling getcurrentprocess.

In short, handle is an integer used to "indirectly" represent a kernel object. You can use handle in a program to represent the kernel objects you want to operate on. The kernel objects include: events, threads, processes, mutex, and so on. The most common one is file handle ).

In addition, handle makes sense only in the process to which it belongs. It does not make sense to pass the handle owned by a process to another process. To do so, you need to use duplicatehandle (). Passing handle between multiple processes is another topic, it has nothing to do with what we will discuss here.

2. process ID

First, the process ID is a 32-bit unsigned integer, each process has such an ID, and this ID is unique within the system. The system uses this ID to uniquely identify a process.

In depth, the system may use the process ID to calculate the base address (and the base address of the eprocess structure) representing the kernel object of the process ), for specific calculation formulas, you can ask Microsoft's OS developers.

3. hinstance

Hinstance is also a 32 unsigned integer, which indicates the base address loaded into the memory by the program.