Reversing : The Hacker's Guide to Reverse Engineering

Figure 3.2

Objects and process handle tables.

User-ModeKernel-Mode

Process 292

Access Mask:Read Write

Object Pointer

Process HHandle 0x4:

andle Table (PID 292)Access Mask:

Read Only

Object Pointer

Han

dle 0x8:

Access Mask:All Rights

Object Pointer

Han

dle 0xC:

Access Mask:All Rights

Object Pointer

Han

dle 0x10:

Object A: S pe

cifc Data

Structure

Object B: S pecifc Data

Structure

Object C: Specifc Data

Structure

Object D: Specifc Data

Structure

Access Mask:RW, Delete

Obje

ct Pointer

Process HandlHandle 0x4:

e Table (PID

188)

Acce

ss Mask:

Rea

d Only

Object Pointer

Handle 0x8:

Acce

ss Mask

:

All Rights

Object Pointer

Handle 0xC:

...

...

...

Process 188

Object E: S pecifc Data

Structure

...

...

...

Object Manager HeaderObject Manager HeaderObject Manager HeaderObject Manager HeaderObject Manager Header