2

I see those in a debugger (OllyDbg, handles subwindow), but I never meet an explanation on what those are.

Here is the full content of it, and to be honest I want to know the meaning of all of this. There are suspiciously a lot of NamedBuffer, and I wonder if it's the same for other computers.

Yesterday I learned that I can switch between native (\REGISTRY\MACHINE) and translated (HKEY_LOCAL_MACHINE) names by pressing Tab. It works for registry paths and file paths.

Handles
Handle     Type             Refs    Access     T    Info          Name
00000028   ALPC Port           4.   001F0001
0000004C   Desktop          1737.   000F01FF                      \Default
00000008   Directory          91.   00000003                      \KnownDlls
0000000C   Directory          53.   00000003                      \KnownDlls32
00000018   Directory          53.   00000003                      \KnownDlls32
00000070   Directory        2028.   0000000F                      \Sessions\1\BaseNamedObjects
0000003C   Event               2.   001F0003
00000044   Event               3.   001F0003
00000058   Event               2.   001F0003
0000005C   Event               2.   001F0003
00000060   Event               2.   001F0003
00000064   Event               2.   001F0003
00000068   Event               2.   001F0003
0000006C   Event               2.   001F0003
0000007C   File (dev)          2.   00100003                      \FileSystem\Filters\FltMgrMsg
00000010   File (dir)          2.   00100020                      \Device\HarddiskVolume1\Windows
0000001C   File (dir)          2.   00100020                      \Device\HarddiskVolume1\shared\debugger
00000004   Key                 2.   00000009                      \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
00000014   Key                 2.   00000009                      \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
00000020   Key                 2.   00020019                      \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
00000024   Key                 2.   00000001                      \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER
00000038   Key                 2.   000F003F                      \REGISTRY\MACHINE
00000034   Mutant              2.   001F0001
00000080   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\mchLLEW2$1360
00000084   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5f9e0
00000088   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\AutoUnhookMap$00001360$73ec0000
0000008C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $71ac0000
00000094   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a7dffe
00000098   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $73e812c6
0000009C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $73e82384
000000A0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $76fef792
000000A4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75db3be3
000000A8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $76e69d0b
000000AC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b77ba4
000000B0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7ea03
000000B4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7b986
000000B8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b758b3
000000BC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75dccd11
000000C0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75db9ae4
000000C4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75e1dd76
000000C8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75e1de19
000000CC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75dc3baa
000000D0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b75ea5
000000D4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7cc01
000000D8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ba4969
000000DC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75b7ba5f
000000E0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f202bf
000000E4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f2027b
000000E8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed835c
000000EC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed7603
000000F0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ecee09
000000F4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed6110
000000F8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec8332
000000FC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3baa
00000100   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed12a5
00000104   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3c61
00000108   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec8bff
0000010C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed612e
00000110   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec9679
00000114   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed781f
00000118   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec97d2
0000011C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f26cfc
00000120   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed76e0
00000124   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f26d5d
00000128   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed7668
0000012C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eec112
00000130   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eed0f5
00000134   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeff4a
00000138   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeec68
0000013C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed291f
00000140   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75eeeb96
00000144   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f288eb
00000148   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed2d64
0000014C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed3698
00000150   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75edc4b6
00000154   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f27dd7
00000158   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f09f1d
0000015C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ecefc9
00000160   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed6c30
00000164   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ec90d3
00000168   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75ed2da4
0000016C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $75f11497
00000170   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60550
00000174   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a603d0
00000178   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a6079c
0000017C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5ff74
00000180   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a606f4
00000184   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60874
00000188   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a607e4
0000018C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60004
00000190   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60084
00000194   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61cb4
00000198   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61d8c
0000019C   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fcb0
000001A0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60694
000001A4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60df4
000001A8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a61be4
000001AC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5ffa4
000001B0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fdc8
000001B4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a600b4
000001B8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fd64
000001BC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fec0
000001C0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a6088c
000001C4   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a60ed8
000001C8   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a5fb28
000001CC   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a608a4
000001D0   Section             3.   000F0007                      \Sessions\1\BaseNamedObjects\NamedBuffer, mAH, Process $00001360, API $77a603b8
0000002C   Semaphore           2.   00100003        Count 0. of
00000030   Semaphore           2.   00100003        Count 0. of
00000048   WindowStation      82.   000F037F                      \Sessions\1\Windows\WindowStations\WinSta0
00000050   WindowStation      82.   000F037F                      \Sessions\1\Windows\WindowStations\WinSta0
Improve this question
3
  • NamedBuffer, mAH, Process $00001360, API $77a7dffe this is section object (file mapping if want) and it created by 0x1360 process. if you look for this process you found that this is devenv.exe (so msvc). the 77a7dffe is address and by this address some hook (jump dword ptr[xx]) is set.
    – RbMm
    Sep 29, 2017 at 11:35
  • @RbMm So you have just as many open sections as me? My Process $00001360 points at hello world itself. It looks like a lot of processes have those, and for most of them (if not all, can't check it) Process $<process id> has the process id of process itself.
    – puppon -su
    Sep 29, 2017 at 11:54
  • yes, i have many this kind of sections. however it created by devenv.exe in my case
    – RbMm
    Sep 29, 2017 at 11:57

2 Answers 2

Reset to default
1

Those are section names, either created by CreateFileMapping() or by ZwCreateSection. It won't be the same on other computers.

OllyDbg even says the handle is a section.

A simple executable won't have many handles.

You can check and compile this code from MSDN to see the names in the OllyDbg handle window.

Creating Named Shared Memory

If you create ten different file mappings you will see 10 section handles with ten names as shown below, BaseNamedObjects\MyFileMappingObject1 2, 3, etc., etc.

Handles, item 4

Handle=00000028
Type=Section
Refs= 3.
Access=000F0007 WRITE_OWNER|WRITE_DAC|READ_CONTROL|DELETE|QUERY_STATE|MODIFY_STATE|4
Name=\BaseNamedObjects\MyFileMappingObject

Improve this answer
3
  • Is it normal to have so many of shared memory? I just started a simple "hello world", and it shows that there are 70 of them.
    – puppon -su
    Sep 29, 2017 at 10:11
  • Also how do you think, everything after "BaseNamedObjects\" is also part of a name? So, full name is "NamedBuffer, mAH, Process $00001360, API $77a5f9e0" ?
    – puppon -su
    Sep 29, 2017 at 10:13
  • 1
    yes, full name is NamedBuffer, mAH, Process $00001360, API $77a5f9e0
    – RbMm
    Sep 29, 2017 at 11:39
1

About this line:

00000034   Mutant              2.   001F0001

A mutant is the kernel name for a mutex.

The name mutant has a colorful history. Early in Windows NT's development, Dave Cutler created a kernel mutex object that implemented low-level mutual exclusion. Later he discovered that OS/2 required a version of the mutual exclusion semaphore with additional semantics, which Dave considered "brain-damaged" and which was incompatible with the original object. (Specifically, a thread could abandon the object and leave it inaccessible.) So he created an OS/2 version of the mutex and gave it the name mutant. Later Dave modified the mutant object to remove the OS/2 semantics, allowing the Win32 subsystem to use the object. The Win32 API calls the modified object mutex, but the native services retain the name mutant.

https://forum.sysinternals.com/whats-a-mutant-handle_topic17376.html

https://blogs.msdn.microsoft.com/larryosterman/2004/09/24/cleaning-up-shared-resources-when-a-process-is-abnormally-terminated/

Helen Custers, "Inside Windows NT"

Improve this answer
5
  • what is the question ? mutant is a type of handle it can be created with or without a name and edit your question and add info or create a new question do not answer that is unrelatef to original question msdn.microsoft.com/en-us/library/windows/desktop/…
    – blabb
    Sep 29, 2017 at 10:56
  • autounhookmap appears to be part of madshi framework you should check if you have anything madshi related in your machine
    – blabb
    Sep 29, 2017 at 10:59
  • I'd like to know what all of this means. Things like "ALPC Port", "File (dev)", "File (dir)", "\KnownDlls32". Also I probably have a malware.
    – puppon -su
    Sep 29, 2017 at 11:20
  • find some windows internals related resource and read them your question is vague as it is phrased alpc is advanced local procedure calls a means for interprocess communication file dev is a device fille file dir is a directory object
    – blabb
    Sep 29, 2017 at 11:25
  • knowndlls blogs.msdn.microsoft.com/larryosterman/2004/07/19/…
    – blabb
    Sep 29, 2017 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.