process

More documents

Recommendations

Info

2 Roadmap for This Lecture Core System Mechanisms Object Manager & Handles System Worker Threads Advanced Local Procedure Calls Wow64 The Windows APIs Principles Windows vs. Unix File copy example
3 Object Manager (I) Executive component for managing system-defined “objects” Manage: creating, deleting, protecting and tracking Objects are data structures with optional names “Objects” managed here include Executive objects and Kernel objects, but not Windows User/GDI objects (Win32k.sys) Object manager implements user-mode handles and the <strong>process</strong> handle table Object manager is not used for all Windows data structures Generally, only those types that need to be shared, named, or exported to user mode Some data structures are called “objects” but are not managed by the object manager (e.g. “DPC objects”)
Page 1: Core System Mechanisms and Windows
Page 5 and 6: 5 Executive Objects vs. Kernel Obje
Page 7 and 8: 7 Executive Objects (contd.) Object
Page 9 and 10: 9 Object Header Field Handle count
Page 11 and 12: 11 Object Methods Method Open Close
Page 13 and 14: 13 Handles and Security Process han
Page 15 and 16: 15 Handle and Reference Count handl
Page 17 and 18: 17 Interesting Object Directories i
Page 19 and 20: 19 System Worker Threads Created at
Page 21 and 22: 21 Port Objects ALPC exports port o
Page 23 and 24: 23 Wow64 Allows execution of Win32
Page 25 and 26: 25 Wow64 File Locations Location of
Page 27 and 28: 27 Example: Cmd.exe on 64-bit Syste
Page 29 and 30: 29 Windows API - Overview APIs to W
Page 31 and 32: 31 Windows API Principles System re
Page 33 and 34: 33 Windows API Naming Conventions P
Page 35 and 36: 35 Differences from UNIX HANDLEs ar
Page 37 and 38: 37 Example Application Sequential f
Page 39 and 40: 39 Basic cp file copy program. UNIX
Page 41 and 42: 41 Basic cp file copy program. C li
Page 43 and 44: 43 Basic cp file copy program. Wind
Page 45 and 46: 45 Further Reading Mark E. Russinov
Page 47 and 48: Lab: 2013-9-23 Handles & ALPC
Page 49: ALPC Port Objects Use Winobj.exe to

process

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?