[Autogenerated] Since kernel objects, are in kernel space.
When user mode clients, want to access kernel objects.
They have to obtain, a handle, to the object,
and This serves as an indirect way of accessing the object using certain API SS,
that these object type provides there's no other way.
To access kernel objects from user mode just just those handles.
We know that Every process has its own private handle table which means
that their intent handle has only meaning for the process,
that obtained, that handle.
So if I call the create file function, for example,
to open, a handle, to some file I get back.
A value say 20.
I can't give that 20.
To a different process.
And say, hey, let's talk.
To the same file that will not work because that other process
has its own handle table where 20 points,
to a different object or to nowhere, which means that all handles,
are always private to the process.
But of course, since kernel objects, are In kernel space,
they should be sharable, it should be possible.
To share this object by using some kind of mechanism.
So that multiple processes can access the same object,
to share,
that object and we look at these options later on this module in order to
see what each process holds in terms of handles there.
Are several well known tools,
to use one of them is cross explore which is probably the most well known tool.
To look at handler in a given process.
There's also an alternative which is a console based tool called
handle dot E X E which is also part of CSS channels.
You can give it the process, ID using the dash P command line argument,
and then Uh You get the handles in that particular process.
There's another tool.
That provides information about handles in processes
called resource monitor which in fact, is the built in Windows tool.
However, it only shows handles for objects.
That have names which means that Its not as useful as process explore.
That can show all handles, in the process,
and That's why I'm not going to show you resource monitor because it
doesn't provide any kind of advantage over process exploit.
In fact, it,
only has disadvantages in this particular respect from a debugger perspective.
There's the handle command,
that can show us information about a particular object based on the handle,
that we have.
So this works in user mode and in kernel mode But in
kernel mode the handle command, is more powerful and there,
are some other tools like my own an project explore which I'll
also show you that has some interesting view.
That you don't see in other kinds of tools.
So let's see how we can view handles.
And some interesting information about objects based on these tools.