Object Manager: Difference between revisions

Revision as of 16:55, 12 June 2021

Revision as of 05:02, 13 June 2021

Line 13:

{| class="wikitable" align="center"

|-

!Type !!Description !![[System call]] to get handle

|-

!Directory

| A container holds other kernel objects. Multiple levels of nested directories organize all kernel objects into a single tree.

|NtCreateDirectoryObject<br />NtOpenDirectoryObject

|-

![[Process (computing)|Process]]

| A collection of executable [[thread (computing)|threads]] along with [[virtual address]]ing and control information.

|NtCreateProcess<br />NtOpenProcess

|-

![[Thread (computing)|Thread]]

| An entity containing code in execution, inside a process.

|NtCreateThread<br />NtOpenThread

|-

!Job

| A collection of processes.

|NtCreateJobObject<br />NtOpenJobObject

|-

!File

| An open [[file (computing)|file]] or an [[I/O]] device.

|NtCreateFile<br />NtOpenFile

|-

!Section

| A region of memory optionally backed by a file or the [[Paging|page file]].

|NtCreateSection<br />NtOpenSection

|-

!Access token

Line 46 ⟶ 54:

!Key

| A [[Windows Registry|registry]] key.

|

|-

!Desktop

| A logical display surface to contain [[GUI]] elements.

|None

|-

![[Clipboard (software)|Clipboard]]

| A temporary repository for other objects.

|None

|-

!WindowStation

| An object containing a group of Desktop objects, one Clipboard and other user objects.

|None

|-

!Symbolic link

| A reference to another object, via which the referred object can be used.

|NtCreateSymbolicLinkObject<br />NtOpenSymbolicLinkObject

|}