[Autogenerated] We know that in order to get a handle, to a kernel object.
We need to use some APIs and So we have these create set of
APIs such as create event create TEX,
create some up four create process and others which have
these purpose of creating a new object.
Or if the object is provided with a name,
assuming the API is able to use a name, then You might get an existing a handle,
to an existing object.
On the other hand there, is an open set of APIs like open process,
open tex,
open event and these kinds of APIs always try to open an additional handle.
To an existing object.
If the object, is identified by something which doesn't exist.
Then the open operation will fail.
And Once we have that handle at hand.
We can Go ahead.
And Work with the object for as long as needed.
And Once we're done with the object, we're going to call the close handle,
API What?
That API does is delete the entry from our handle table using that handle index,
which means that the object is no longer accessible using
this handle does that mean the object, is dead,
not necessarily we know that kernel objects,
our reference count,
and So there might be another handle somewhere else pointing,
to the same object.
But from our perspective, as the color of cloth handle,
we can't use that handle anymore.
And If we try, we get an invalid handle,
error return from get last error on the kernel side of things
kernel code which includes the kernel itself.
And kernel device drivers can obtain handles as well.
But there's one special power that They have called kernel handles,
kernel handles, are handles,
that can only be used in kernel mode and also their are process agnostic which
means that we can use that handle in any process context.
This is one of the powers that kernel code has alternatively,
kernel code can also work directly with an object
without going through a handle.
This is typically faster because you're talking to the
object instead of using an indirect handle.
That will be converted.
To an object anyway.
But it's also sometimes necessary depending on the API you're using.
So usually in kernel mode the decision whether to use a handle or
to use a pointer depends on the API you want to use because some
APIs are available using handles, some APIs are available using objects,
and Some sometimes you have a choice.
But in some cases, you just don't get enough information.
Maybe the function, that you, want to use is not really exported.
So you might have to use a handle.
Even though you might want to use an object pointer but you can't.
In any case in order to get that object pointer.
You can do that for example,
by calling bi reference object by handle which is a way,
to get to a pointer, to an object based on an existing handle.
And Once you're done working with that object,
you have to de reference the object otherwise it
will be kept alive indefinitely.
And the function, to use in the This case on the kernel side of things.
Is all be de reference object.
So essentially the references an count of an object
consists of the number of handles, open,
to the object,
and the number of references that have been incremented artificially towards
the object because kernel calls are using that object.
Look at one example of using handles which is kind of interesting.
And would allow me to uh to show some interesting aspects of handles.
This will be related.
To a very well known tooling, Windows called media player.