[Autogenerated] Get started.
We can open process explorer, select the process of choice.
And then look at the bottom here with handles.
So we'll take a Look at this view in more detail
later on this module But for now, let's just grab some objects.
And See if we can find some information about it by looking at
the kernel debugger So here's for example,
a Sem, four here.
I'm just going to double click it, and as part of the properties,
we can see the address of the object in kernel space.
So I can go ahead.
And copy, that and go, to my kernel debugging.
Session here.
And use the command object the object command,
is the generic command, that knows us,
knows how to Give information about any kind of kernel object,
given its address Or in fact, it also works with the name of the object.
If that object, is named and you can see that Indeed,
this object has this particular address the type object,
is Sema, four and this address, is the address of the type object.
You can also see the header here.
So that's the header of the object.
It always starts 30 hex, bytes before the actual objects.
That 48 bytes before the actual object.
Notice the address 70 here, and compared to a zero.
So we have a difference here or 30 xss bytes So
let's start with the type object.
Now the type object can be viewed by using the normal DT command there,
is no special command for that and the data structure behind the scenes.
Is called object type an Although object type is not officially documented it.
Is provided as part of the symbols.
So if I go ahead,
and do that we can see that we get information about that single
type object representing what does it mean?
To be a Sema, four we can see here.
The name of the object.
Is being the Sema four here, we can see the index,
that should be something similar.
To What we find in object types here.
If you look at seo we can see the value here,
is 22 which is indeed 16 hex we can see that there,
is a total number of objects here.
And total number of handles.
And high water mark means the peak number of objects here.
And the peak number of handles.
In fact, that should correspond nicely.
To what we see here in this view.
Now, of course, project explore here,
updates every second and We have to run this command again.
To see the update, but the numbers should be fairly close.
So for example, the first one is E 18 for total number of objects.
Let me just translate that to decimal.
So that's 3608 That's exactly the number that we see here.
So in fact,
this information that object explore shows comes from the type object itself.
So that's something we can Look at just by examining type objects.
And for every sema, four We look at the type object,
is Of course, the same, it's the same one.
It's a singleton, entity singleton object representing what does it mean?
To be to be a Now the header for this particular
Sema four for this specific object.
Can be looked at again by grabbing this address and again there,
is no special command for that there,
is a data structure called object header which again,
is not officially documented but is provided coded as
part of the symbol So I can paste, in the header here,
and you can see some details about the object itself such as the handle count,
which is one, and we've seen that already here.
In the output we get from the object command.
And You might be wondering where is The name,
the name doesn't seem to be show, up showing up here.
So here's the name provided by the project command.
Unfortunately, this is slightly more complex, to get.
So I'm not going to show you that right now,
but it is pointed, to by the header In fact,
using these something called informa.
So inst if it has the be number one with the value of two set,
it means the name exists.
And Its actually appearing in a different location in memory.
Like I said, I'm not going to show you that here, at least not now.
Maybe we'll do that Later on in this module and talk
about object names in more detail.
Another thing you can see here, is the security descriptor.
So here's the security descriptor,
and Although we don't talk about security descriptors in detail.
In the these core I want to show you briefly how you can see that going back,
to process explorer.
Here, there's the security tab, the security tab also shows us aspects of the,
the descriptor.
In fact, if you click the advanced button,
you can see the security descriptor, the actual data within the access control,
is within it.
In the actual order as it is built inside the security descriptor.
Each one of these entities shows us the the type of the particular entry.
That would be allowed or deny the access and whether
its inherited from something else.
The access here.
Says special.
It doesn't mean actually anything special.
It just means that It's not a simple thing like read or write,
and Of course, we have the principle that represents who this entry.
Is all about.
If I click the edit button,
you can actually see the actual permissions here which have a combination of
bits here which eventually represented is just some bit mask.
So if we can see perhaps these same order using the current debugger that would
enforce our understanding as to how the security descriptor,
is actually stored.
So the way to do that is to grab this address and use
a command for that called sd So,
sd these is a specific command for security descriptors.
Now, if I try that it, is likely, to fail,
and it fails because the last four bits actually,
are used as flat xss and So we just need to zero out
the last digit from a xss digits, perspective,
and in general, all objects,
are always 16 bytes aligned when they're stored in kernel space.
So if I just change the F here or whatever last digit there,
is to zero, we can see the security descriptor here indicating who the owner.
Is So we have the information here about the owner which is
this particular see this is probably me here.
So the owner is something we see right here when you click advance,
you can see the owner.
That's me right here.
And then we, see the three entries, in the Docker in the discretionary,
access control list.
You can see those right here.
So the first one the first ac is about S 15 18 which is
the seed for the local system account.
And That's the mask of these permissions,
that are called by the UI as special but these are just a bunch of flags.
That indicates what you can.
Do with the object.
If you are that kind of user Same goes for the second entry.
In this case, that's the seed representing me on this particular machine.
You can see that's me, and the last one.
Is Yet another an entity here called Logan session, ID zero.
Something doesn't really matter what that means at this point.
But it's the one represented by this particular seed.
And Again, you can see the ax, access mask,
and the fact, that all these entries, are allow entries.
So this is how we can get to the security descriptor
which is also part of the object, header Now,
we can repeat, that experiment with other types of objects,
just just as easily.
So if I go ahead and look at this directory object,
and Again, this is not a directory in the file system.
This is a directory in the object manager,
namespace which we'll take a Look at later,
let me copy the address again.
And use object again here, and what we'll find now,
that we get some information about directory but also we can
see the details of the actual objects within that director
because it's a container object.
Let me just break it.
We don't really care about that at this point.
You can see there, are 100 49 handles, uh to this object,
and If I double-click we can see that Indeed,
we have 100 and 49 handles.
You might be wondering why is that reference kind of thing.
So, I'll get to that uh in in the Next demo.