[Autogenerated] Let's start with process explorer with cross Explore when you
look at the lower page here for our process of our choosing,
we have the list of handles.
In the process,
and We have a bunch of columns here representing information about that handle.
Now by default, what you'll see, is only type,
and name, if you want to see,
more you need to right-click here you select columns to select,
more columns to show.
So I've selected most of the columns here except for the file file
share flags which I don't care about in this case.
So for each one of these entries, you can see the handle value, handle values.
Are always multiples of four where zero is never a valid handle.
So handle number, four should be the first one that is valid.
And Of course,
you might not see all possible values here because
perhaps some handles have been closed.
And have not yet been filled by new handles created in the process.
But in fact, there is something else in play here.
And by default.
Cross Expro, only shows handles, to objects,
that have some kind of name or at least some kind of name from cross
explorer perspective if you want to see truly all the handles,
in the process.
You have to go, to the view menu, and then select show unnamed handles,
and mappings.
Once we do that you'll find that The list of handles has grown significantly.
And In fact, handle number, four does in fact exist in this process.
Same goes for handle, eight and 12, and 16,
and 20 and So on and So as it happens,
these objects don't have names but that doesn't detract
anything from their capabilities.
It just means that They cannot be looked up by name,
and Some object types just cannot have names.
And So for now I'm going to limit the view,
to named objects,
only and We'll discuss other aspects of naming later on in this module Next,
we can see the type of object.
That's the name that We've seen in the object types,
view in object explore, for example.
So we have registry keys, Sema, four directory objects,
two access and So on, we have the name of the object.
If there is any and not all these names actually represent two names,
I'll talk about names which are its slightly a bit,
more intricate later in the this module and then We have the axis
The axis represents the access mask or the capability of this
specific handle towards the object.
So if I have an object, and I have multiple handles, to the object.
It doesn't mean that all these handles, are the same.
They don't necessarily have the same power every handle,
is associated with an AX access mask,
which indicates what that can do So this access mask,
is just this number here.
And each bit represents some kind of access Fortunately,
these de coded access column allows us to see exactly what that thing means.
So for example, this particular handle here,
to some registry key has the AX access mass of key,
query value, which means the only thing.
You can do with this handle, is read values using it.
You cannot set new values.
For example,
if you try to do that you'll get an access denied error If you
use their app proper API because that handle,
is not powerful enough.
And Again, this means that not all handles,
are born the same handlers might have different access masks.
Even if they look and target the same object, the actual address of the object.
In kernel space, is right here.
Notice its a high address its 128 Tera,
bytes address in the upper address space of kernel memory,
of course, where everything related to the kernel resides.
So this is where the real object, is So if you have multiple handles,
and you perhaps wonder whether they're pointing,
to the same object or not the definitive way.
To see, that is By looking at the object.
Address If its the same address its the same object.
If it's not the same address it's definitely not the same object.
There's another column here which is called attributes which
I'll discuss later on in this module Now,
if I double-click any one of these handles,
I get the properties of the object.
And That's an important distinction, the properties here.
Are for the object, not for the handle,
which means that If I double-click using a different handle,
that happens, to point, to the same object.
I will see exactly the same information because the information here,
is about the object itself, not in any specific handle.
In this particular case, we have a registry key,
that has a single handle, which means this is the one that's the single handle,
to this registry key object here but TIFF I select
something else like perhaps this mute.
Xss also has a single handle.
How about these direct, 33 It has 148 handles throughout the system.
One of which is this one if I find out other handles,
to the same object,
I will see exactly the same properties because these properties,
are for the object, not for the handle.
The other thing you see here.
Is references you might be thinking that's the number of
references That's the reference count for the object.
Unfortunately, this is not the case starting with Windows 8.1,
and that number also incorporates some kind of usage count for that
particular handle or in general for that particular object.
In fact, that aggregates some usage.
That has been done by all the handles pointing.
To this object.
So this number,
is is technically something you can't really learn
anything from and SSH shouldn't look at that more but its
still displayed by cross explorer, and it,
is still perhaps useful.
In the pre, Windows 8.1 days.
But currently you should probably disregard this number altogether.
In fact, we've seen that briefly.
In the current debugger as well.
So going to the count,
debugger Here we see the that If we get this particular object,
we can see there.
Are 149.
It, was then 149.
Now it's only 148 handed, to This object.
Notice the pointer count.
We've seen the same kind of crazy big number which
is not the true reference count.
To see the true reference count.
You can click, that thing,
and It runs a different command called two rest which really does
show you the actual reference count of the object.
Although it might take a few seconds.
To run because it tries to remove all that usage count based on the
information it learns from all the handles pointing,
to this object,
and just kind of give you the final result as the
true reference count for the object.
So that will eventually complete successfully.
And give us the true reference count there.
Is no way.
To get that directly from user mode You have to be in kernel
space in order to find out all that information,
and this is What this true ref command does for us.
So it might take some time, especially if there are many handles, to the object.
In this case there, are 148 handles, to the object.
So this will take a while let me pause the video while the debugger is working.
So here's the result, we can see the handle,
count, is 147 at this point because the system is a moving target.
So some kind of handle, was closed at the time.
And the real pointer count, is 191 which means that 147 of that are handles,
and the rest, are pointers held on by various kernel components,
we can try,
that same thing with any kind of kernel object here
given its address So here's these summa,
four Let's grab the address here, and then give that to the object,
command, see some details.
About the SEM up four and then again, we can click pointer count here.
To calculate the two reference count of this object.
And since it has relatively few handles.
That should probably finish much earlier or at least much faster.
And we will get the two reference count of the object.
So you can see the real pointer count here the real reference count,
is actually, two So there's one handle,
and another pointer from some second component pointing,
to that same see going to object explorer,
we can Also see there, is a process handles here.
It's the same idea.
We can select the process of choosing and then see all the handles,
in the that particular process,
that is not much different than what we see in process.
Explore perhaps just nicer icons, and it,
is updating dynamically as things might be changing while the process,
is running with the green, and red cores very similar to process.
Explore another thing you can see here, is all handles this is a special view,
that provides a list of all the handles,
in the system in all the various processes out there.
So you can see here, everything.
We can sort by anything we want such as by name by address by access or
anything else you might be interested in looking at.
So it is kind of a special view, that shows everything.
That there, is to See on the particular system based on all the handles.
That there, are