Wvc_01 _ Kernel Object

The kernel object is a memory block allocated by the kernel. The memory block is a data structure and can only be accessed and modified by the kernel. Kernel objects can be used by systems or applications to manage various resources.

In applications, you often need to call Win32 API functions to create various kernel objects, such as file objects, file ing objects, process objects, and thread objects.

The kernel object is owned by the kernel, not by the process.

In addition to kernel objects, there are also user objects, such as menus, windows, painting brushes, and fonts.

When a function is called to create a kernel object, the function returns a handle to identify the object.

Process kernel object handle table

When each process is initialized, the system assigns a handle table to it. The handle table is only used for kernel objects rather than user objects.The handle is actually an index in the process's handle table..

 

Kernel Object Security Descriptor

The security descriptor is used to describe who created the object, who can access or use the object, and who has no permission to access the object.

Security descriptors are usually used when writing server applications. If you write client applications, you can ignore the security descriptors of kernel objects.

Page 32

 

Wvc_01 _ Kernel Object