[Autogenerated] What is the cost of a handle.
How many handles can we actually create in a single process we
know that Every process has its own handle table,
and it's pointed, to by the object table member within the E process.
Data structure.
Every entry of a handle has the following format.
First We need to store, the address of where the object is in kernel space,
and for that we need 48 bits as this is the maximum address space,
that we can use on the Windows system,
these days based on the hard limitations of processors.
However, since the address is always, 60 bytes aligned,
then we just need 44 bits.
To have the address there.
And then We have a few flags, one of them,
is audit on close the audit on close flag.
Is there in order to provide some way.
To audit, an operation of closing the handle.
So it's possible.
To set up by using group policy, and other such management mechanisms.
Then We have the inheritance flag, the inheritance flag's usage,
is for something called hinder inheritance,
which is One of the ways to share objects between processes which we will take.
A Look at later in this course, and Finally,
we have to protect from close bit TIFF its set.
It means the handle cannot be closed by calling the close handle.
API the purpose of this beat.
Is in cases where I need to pass, a handle,
to a code that It might not be familiar with and that code might not
know that It shouldn't really close the handle.
Its getting access to It just should be using the handle.
And that is it.
However, if there is a bug in that code or something.
That goes wrong.
And Someone there decides to close the handle.
I might you lose the handle.
That I had and So, I can set the protect from close bit and then view,
that handle, to the unknown, code and then it,
is not going to close my handle.
Of course, that code could just remove that protection from close flag,
and then close the handle.
So it's not about trying to prevent malicious code running
in my process from closing the handle.
It's about preventing unintentional closure of that handle.
Then We have the access mask.
We've seen that every handle has its own power.
And the AX, access mask, is the one indicating that power So the access mask,
is part of that header information because different handles,
even if they point to the same object might not have the same power.
This is based on that access mask.
I mentioned there, is inverted usage count.
Well, there is an usage count, that is built in a kind of inverted way.
So it starts with a large number, and then is decremented every time the handle,
is used this is probably used internally by Microsoft for testing purposes,
but it also affects the reference count.
As we've seen.
And that makes the reference count something.
That We can't really rely on when looking at tools such as process explorer,
and then because of alignment purposes, the rest of the data structure here.
Is unused.
So we have 16 bytes that are used for each and every handle,
that exists, in the system.
So obviously having handles, is not free.
So the handle itself consumes 16 16 in system space,
in the other space of the kernel but it's not too expensive either.
We are still yet.
To answer the question.
How many handles, can you actually create in the single process?
We'll see the that in the Next demonstration.