1

I've been looking at some kernel debugging and came to see this:

0: kd> dt nt!_OBJECT_TYPE ffffd0851aad6c90
   +0x000 TypeList         : _LIST_ENTRY [ 0xffffd085`1aad6c90 - 0xffffd085`1aad6c90 ]
   +0x010 Name             : _UNICODE_STRING "Process"
   +0x020 DefaultObject    : (null) 
   +0x028 Index            : 0x7 ''
   +0x02c TotalNumberOfObjects : 0xa2
   +0x030 TotalNumberOfHandles : 0x553
   +0x034 HighWaterNumberOfObjects : 0xfc
   +0x038 HighWaterNumberOfHandles : 0xbf5
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER
   +0x0b8 TypeLock         : _EX_PUSH_LOCK
   +0x0c0 Key              : 0x636f7250
   +0x0c8 CallbackList     : _LIST_ENTRY [ 0xffffa38f`ff5e94f0 - 0xffffa38f`ff3ae580 ]

Most I can understand, or figure out what they suppose to mean. I have no idea what HighWater means, and how it differs from the TotalNumberOfObjects/Handles. Just from weird curiosity, any one has any idea what does it mean?

  • (assumption) HighWaterX means the highest value X ever archived. Like the flood-markings which can be seen on buildings close to the water. – Nordwald Nov 8 '17 at 9:22
0

Not really RE, but this likely means "the highest number of objects/handles ever seen" (in this session). From Wikipedia:

A high water mark is a point that represents the maximum rise of a body of water over land. Such a mark is often the result of a flood, but high water marks may reflect an all-time high, an annual high (highest level to which water rose that year) or the high point for some other division of time.

| improve this answer | |
  • This seems it, thanks. – t0m9er May 8 '19 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.