[Autogenerated] Here, is my Windows 11 machine.
I'm going to run one of my tools called object explorer,
object explorer has some interesting views.
One of them, is called object types.
That shows all the object types supported on this version of
Windows You can see the type name on the left here,
some of these object types we're familiar with from
previous courses such as job, and process,
and thread, some object types you may be familiar with with your experience,
perhaps like in event or tex and We'll talk about some of these object types.
Later in this course there,
are some object types which are only available in kernel mode such as device,
and driver objects.
You can search for these object types right here.
And some object types, are completely undocumented.
And used internally by the kernel It's always interesting.
To see which new object, kernel types.
Are created in a new version of Windows So you can look at
what's going on here just by examining this view.
In addition, we can see here, the index,
the index, is the internal index used to represent that particular object type,
and then we can see the number of objects,
and handles for these kind of objects.
So for example, here we can see there, are 3200 3,234 right now,
and 902 handles, 900, to these objects.
You might be wondering how come we have of smaller
number of handles than objects.
What that means is that some of these objects,
are purely referenced by the kernel using pointers,
and not using handles.
So obviously, it means there are kernel clients here,
to some of these objects with no user mode clients which of course,
is perfectly legitimate.
And the opposite could also be true.
So for example, here we have job objects,
41 job objects in the system right now.
51 handers, to these job objects.
So there's really nothing we can say here in a definitive way,
but it could be that Every job has at least one handle,
but it could be that We have a single job where you have perhaps 10 10 pointing,
to it, and some other job.
Only being pointed,
to by pointers by kernel code So there's really
nothing definitive we can say here.
We can definitely sort.
So I can sort here by objects.
For example, we can see the most number of objects, is four file objects.
We have 48,000 something objects of type file object,
but only 4700 something handles, which again means that there,
are many clients, to these kernel objects,
that are coming from kernel space using pointers rather than handles.
More than using handles.
In this particular case, we can also, search sort here by the handles,
and you, can see that In this case,
we have the most number of handles for event objects.
We discuss event objects.
Later in this module and in the course in general,
and we can see here, that There's roughly equivalent number of handles,
and objects, and Again,
there's nothing definitive we can Say here there could be many handles,
to the same object.
We could have multiple references to the same object from counter space.
There's really no way.
To tell for show just by looking at this view but it is
interesting to see the number of objects,
and handles being consumed of a Particular type here at the bottom.
You can see the statistics indicating how many objects.
And and the peak number of that we have in the system.
So that's the current number.
And that's the peak number.
That existed since the system started its life.
We can see the same kind of counting here.
Based on handles.
So we have this number of handles right now.
In the system, that was the maximum number of handles.
In the system since the most recent restart,
and you, can see There's also tracking here for the peak number of objects.
And the peak number of handles since the system started.
And there, are some other columns here of interest,
that I'll discuss in more detail later on in this course.
So you might find this interesting to See what is going on.
And If you have any kind of leak,
you might see handles of a certain type or objects of a certain type
growing without limit or at least seem to be growing.
More than they should.
So, that perhaps hints as to the uh potential of a leak.