A Light on Windows 10's “OBJECT_HEADER->TypeIndex”

In Windows OS, the system resources (e.g. processes, files, devices) that need to be named, shared, protected, or exposed to user mode, are managed by the OS as objects. User applications can’t access these objects/resources directly but through the Object Manager (Ob), the subsystem that manages the access to the system objects/resources. Windows 10 (build 16299), for example, has 64 different object types.

But what’s the Windows object?…

Windows object is a memory data structure that represents a system resource and it has two parts:

  1. The body: the part that represents the actual system resource (e.g. EPROCESS for processes, FILE_OBJECT for files, DEVICE_OBJECT for devices).
Image for post
Image for post
Figure 1. OBJECT_HEADER Data Structure

TypeIndex in Windows 7/8/8.1

In Windows 7/8/8.1, TypeIndex is an index into the array of pointers nt!ObTypeIndexTable (Figure 2). Each pointer in this array (1st and 2nd entries are exceptions) points to an OBJECT_TYPE data structure that contains properties unique to that object type (Figure 3). One of these properties is the Name and its value is the type of the object. Check this post from CodeMachine for more details about objects in Windows 7/8/8.1.

Image for post
Image for post
Figure 2. nt!ObTypeIndexTable
Image for post
Image for post
Figure 3. OBJECT_TYPE Data Structure
Image for post
Image for post
Figure 4. Example for TypeIndex in Windows 8.1

TypeIndex in Windows 10

Last week I had a chance to review Windows 10 object header (better late than never 😊). During the revision I noted a change from what we know about TypeIndex in Windows7/8/8.1.

Image for post
Image for post
Figure 5. Example of TypeIndex (Windows 10)
Image for post
Image for post
Figure 6. ObGetObjectType function
Image for post
Image for post
Figure 7. Assembly code of nt!ObGetObjectType
  1. The code XORs the TypeIndex value with the second least significant byte of the address of OBJECT_HEADER calculated in the previous step.
  2. The code then XORs the result from step 2 with the byte at the address nt!ObHeaderCookie.
  3. Finally, the result of the XOR operations is used as an index into nt!ObTypeIndexTable and returns the pointer to the OBJECT_TYPE at this index.
Image for post
Image for post
Figure 8. example for Index value caluculation from TypeIndex
Image for post
Image for post
Figure 9. OBJECT_TYPE struct that ObTypeIndexTable’s 7th pointer points to

Written by

We —humans— who connect the real and cyber spaces. https://twitter.com/AshAbdalhalim

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store