Microsoft® Windows® 2000 Security Handbook

Kernel Objects

A variety of kernel managed objects are included in Windows 2000. The system and user applications use kernel objects to manage and manipulate numerous resources, including the following:

• Event objects

• File objects

• Process objects

• Thread objects

• Synchronization objects

• IPC and network communication objects

Each kernel object is really just a block of memory allocated by the kernel and accessible only by the kernel. You use various Win32 API calls to access the object.

Kernel Object Handle Tables

It is important to understand that no user mode application can access the memory in which these objects are stored; all your interaction with kernel objects occurs through a handle. Even though the handle is a C void pointer type, it does not ...