how calculate size of memory that allocated from create specific windows object e.g. how memory allocated when createsemaphore API is called? there are any document that describe for all objects?
The allocation for most executive objects (like semaphores) is done inside the
ObCreateObject() function. As you can see in
ObCreateObject()'s prototype, one of the parameters is
So the easiest way to answer your question is to set a breakpoint on
ObCreateObject() and examine the value of
ObjectSizeToAllocate when it's called to create your object of interest.