Kernel Objects “Are” Different From GDI / User objects


Applications cannot access system resources directly. In Windows, these resources are represented by an object, an object is a data structure. System resources might be file, folder, image, thread , process, Menu, window, Bitmap, eventlog, desktop etc.

So how does applications communication / access these resources? : Applications obtain an object handle through which applications can perform action on specific resource. Understanding object and object manager requires time and efforts. Objects maintain security related to resource such as ACL. When an application ( Active directory / exchange / custom application ) want to access a resource , it has to obtain a handle to the object of that resource, and the corresponding security will be validated before giving access.

In windows , objects are categorized into

a)     User mode

b)    Kernel mode

c)     GDI mode

In a high level view all these objects do belong to windows , but they are handled differently. Bitmap object / Font object is handled differently than thread object / mutex object , because Bitmap object / font object belong to GDI where as thread and mutex belong to kernel.

Who creates these objects : There are specific dll’s which creates these objects, kernel32.dll creates objects such as Jobs/ threads/ Mutex/ Pipe etc., gdi32.dll creates bitmap / Font and user32.dll creates Icon / Menu etc. Kernel objects plays significant role. Most of us might think “why does Icon /Menu not a “kernel object” , but thread / mutex are kernel objects ?. The reason is the that kernel performs scheduling on Threads, and protects these threads from user mode applications modifying them. Developers / Debuggers should understand what lies at the System Address Space and what is present at the User address space. Before knowing further , I would encourage you to read through

a)     Windows internals 5th edition

b)    Windows programming ( Jeffrey ritcher )

So the conclusion is , every object is NOT kernel object.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s