Object Manager (Windows)


Object Manager is a subsystem implemented as part of the Windows Executive which manages Windows resources. Resources, which are surfaced as logical objects, each reside in a namespace for categorization. Resources can be physical devices, files or folders on volumes, Registry entries or even running processes. All objects representing resources have an Object Type property and other metadata about the resource. Object Manager is a shared resource, and all subsystems that deal with the resources have to pass through the Object Manager.

Architecture

Object Manager is the centralized resource broker in the Windows NT line of operating systems, which keeps track of the resources allocated to processes. It is resource-agnostic and can manage any type of resource, including device and file handles. All resources are represented as objects, each belonging to a logical namespace for categorization and having a type that represents the type of the resource, which exposes the capabilities and functionalities via properties. An object is kept available until all processes are done with it; Object Manager maintains the record of which objects are currently in use via reference counting, as well as the ownership information. Any system call that changes the state of resource allocation to processes goes via the Object Manager.
Objects can either be Kernel objects or Executive objects. Kernel objects represent primitive resources such as physical devices, or services such as synchronization, which are required to implement any other type of OS service. Kernel objects are not exposed to user mode code, but are restricted to kernel code. Applications and services running outside the kernel use Executive objects, which are exposed by the Windows Executive, along with its components such as the memory manager, scheduler and I/O subsystem. Executive objects encapsulate one or more kernel objects and expose not only the kernel and kernel-mediated resources, but also an expanded set of services that the kernel does. Applications themselves can wrap one or more Executive objects and surface objects that offer certain services. Executive objects are also used by the environment subsystems to implement the functionality of the respective environments.
Whenever an object is created or opened, a reference to the instance, called a handle, is created. Object Manager indexes the objects both by their names as well as the handles. But, referencing the objects by the handles is faster because the name translation can be skipped. Handles are associated with processes and can be transferred between processes as well. A process must own a handle to an object before using it. A process can own a maximum of 16,000,000 handles at one time. During creation, a process gains handles to a default set of objects. While there exists different types of handles - file handles, event handles and process handles - they only help in identifying the type of the target objects; not in distinguishing the operations that can be performed through them, thus providing consistency to how various object types are handled programmatically. Handle creation and resolution of objects from handles are solely mediated by Object Manager, so no resource usage goes unnoticed by it.
The types of Executive objects exposed by Windows NT are:
ProcessA collection of executable threads along with virtual addressing and control information.
ThreadAn entity containing code in execution, inside a process.
JobA collection of processes.
FileAn open file or an I/O device.
SectionA region of memory optionally backed by a file or the page file.
Access tokenThe access rights for an object.
EventAn object which encapsulates some information, to be used for notifying processes of something.
Semaphore/MutexObjects which serialize access to other resources.
TimerAn objects which notifies processes at fixed intervals.
KeyA registry key.
DesktopA logical display surface to contain GUI elements.
ClipboardA temporary repository for other objects.
WindowStationAn object containing a group of Desktop objects, one Clipboard and other user objects.
Symbolic linkA reference to other objects, via which the referred object can be used.

Object structure

Each object managed by the Object Manager has a header and a body; the header contains state information used by Object Manager, whereas the body contains the object-specific data and the services it exposes. An object header contains certain data, exposed as Properties, such as Object Name, Object Directory, Security Descriptors, Quota Charges, Open handle count, Open handle list, its Reference count, and the Type of the object.
A Type object contains properties unique to the type of the object as well as static methods that implement the services offered by the object. Objects managed by Object Manager must at least provide a predefined set of services: Close, Duplicate, Query object, Query security, Set security, and Wait. Type objects also have some common attributes, including the type name, whether they are to be allocated in non-paged memory, access rights, and synchronization information. All instances of the same type share the same type object, and the type object is instantiated only once. A new object type can be created by endowing an object with Properties to expose its state and methods to expose the services it offers.
Object name is used to give a descriptive identity to an object, to aid in object lookup. Object Manager maintains the list of names already assigned to objects being managed, and maps the names to the instances. Since most object accesses occur via handles, it is not always necessary to look up the name to resolve into the object reference. Lookup is only performed when an object is created, or a process accesses an object by its name explicitly. Object directories are used to categorize them according to the types. Predefined directories include \??, \BaseNamedObjects, \Callback, \Device, \Drivers, \FileSystem, \KnownDlls, \Nls, \ObjectTypes, \RPC Controls, \Security, and \Window. Objects also belong to a Namespace. Each user session is assigned a different namespace. Objects shared between all sessions are in the GLOBAL namespace, and session-specific objects are in the specific session namespaces
OBJECT_ATTRIBUTES structure:

typedef struct _OBJECT_ATTRIBUTES OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;

The Attributes member can be zero, or a combination of the following flags:
OBJ_INHERIT
OBJ_PERMANENT
OBJ_EXCLUSIVE
OBJ_CASE_INSENSITIVE
OBJ_OPENIF
OBJ_OPENLINK
OBJ_KERNEL_HANDLE

Usage

Object Manager paths are available to many Windows API file functions, although Win32 names like and for the local namespaces suffice for most uses. Using the former in Win32 user-mode functions translates directly to, but using is still different as this NT form does not turn off pathname expansion.
Tools that serve as explorers in the Object Manager namespaces are available. These include the 32-bit WinObj from Sysinternals and the 64-bit WinObjEx64.