Windows® Internals, Sixth Edition, Part 1

Specifies that the object’s security descriptor is using the default 2-KB quota.

N/A

OB_FLAG_SINGLE_HANDLE_ENTRY

Specifies that the handle information subheader contains only a single entry and not a database.

N/A

OB_FLAG_NEW_OBJECT

Specifies that the object has been created but not yet inserted into the object namespace.

N/A

OB_FLAG_DELETED_INLINE

Specifies that the object is being deleted through the deferred deletion worker thread.

In addition to an object header, each object has an object body whose format and contents are unique to its object type; all objects of the same type share the same object body format. By creating an object type and supplying services for it, an executive component can control the manipulation of data in all object bodies of that type. Because the object header has a static and well-known size, the object manager can easily look up the object header for an object simply by subtracting the size of the header from the pointer of the object. As explained earlier, to access the subheaders, the object manager subtracts yet another well-known value from the pointer of the object header.

Because of the standardized object header and subheader structures, the object manager is able to provide a small set of generic services that can operate on the attributes stored in any object header and can be used on objects of any type (although some generic services don’t make sense for certain objects). These generic services, some of which the Windows subsystem makes available to Windows applications, are listed in Table 3-13.

Although these generic object services are supported for all object types, each object has its own create, open, and query services. For example, the I/O system implements a create file service for its file objects, and the process manager implements a create process service for its process objects.

Although a single create object service could have been implemented, such a routine would have been quite complicated, because the set of parameters required to initialize a file object, for example, differs markedly from that required to initialize a process object. Also, the object manager would have incurred additional processing overhead each time a thread called an object service to determine the type of object the handle referred to and to call the appropriate version of the service.

Table 3-13. Generic Object Services

Service

Purpose

Close

Closes a handle to an object

Duplicate

Shares an object by duplicating a handle and giving it to another process

Make permanent/temporary

Changes the retention of an object (described later)

Query object

Gets information about an object’s standard attributes

Query security

Gets an object’s security descriptor

Set security

Changes the protection on an object

Wait for a single object

Synchronizes a thread’s execution with one object

Signal an object and wait for another

Signals an object (such as an event), and synchronizes a thread’s execution with another

Wait for multiple objects

Synchronizes a thread’s execution with multiple objects

Type Objects

Object headers contain data that is common to all objects but that can take on different values for each instance of an object. For example, each object has a unique name and can have a unique security descriptor. However, objects also contain some data that remains constant for all objects of a particular type. For example, you can select from a set of access rights specific to a type of object when you open a handle to objects of that type. The executive supplies terminate and suspend access (among others) for thread objects and read, write, append, and delete access (among others) for file objects. Another example of an object-type-specific attribute is synchronization, which is described shortly.

To conserve memory, the object manager stores these static, object-type-specific attributes once when creating a new object type. It uses an object of its own, a type object, to record this data. As Figure 3-20 illustrates, if the object-tracking debug flag (described in the Windows Global Flags section later in this chapter) is set, a type object also links together all objects of the same type (in this case, the process type), allowing the object manager to find and enumerate them, if necessary. This functionality takes advantage of the creator information subheader discussed previously.

Figure 3-20. Process objects and the process type object

EXPERIMENT: Viewing Object Headers and Type Objects