2

I try to extra the nt!_object_type of notepad.exe process. But seems like it's empty. Is it some process has no object type?

enter image description here

Correction for my screenshot above for using the EPROCESS address to extract TypeIndex instead of using the header of the process object.

This time I got the right, first I determine that the TypeIndex of process object belonging to the notepad is 0x98.

By plugging the value 0x98 into the ObTypeIndexTable, I am seeing empty structure.

Any idea why? Below is the updated screenshot.

enter image description here

2

EPROCESS does not represent OBJECT_HEADER

!process 0 0 notepad.exe provides you an EPROCESS

I think object_header is not documented

on x86 (win7 sp2) it was 0x18 bytes before the OBJECT

the Typeindex field also has been repurposed if i am not mistaken in newer OS

the following display is from a win7sp2 32bit vm

kd> dt nt!_OBJECT_HEADER TypeIndex @$proc-0x18
   +0x00c TypeIndex : 0x7 ''
kd>

using the type index and retrieving the ObjectType Name

kd> ?? ((nt!_OBJECT_TYPE **) @@masm(nt!ObTypeIndexTable))[7]->Name
struct _UNICODE_STRING
 "Process"
   +0x000 Length           : 0xe
   +0x002 MaximumLength    : 0x10
   +0x004 Buffer           : 0x89e04008  "Process"
kd>

some further type indexes example

kd> .for (r $t0=3 ;@$t0<18;r $t0=@$t0+1) { du @@c++(((nt!_OBJECT_TYPE **) @@masm(nt!ObTypeIndexTable))[@$t0]->Name.Buffer)}
89e01980  "Directory"
89e01940  "SymbolicLink"
89e01430  "Token"
89e01088  "Job"
89e04008  "Process"
89e04fd8  "Thread"
89e04f98  "UserApcReserve"
89e04f48  "IoCompletionReserve"
89e04960  "DebugObject"
89e08840  "Event"
89e040a0  "EventPair"
89e04070  "Mutant"
89e04c10  "Callback"
89e04e60  "Semaphore"
89e04770  "Timer"
89e04728  "Profile"
89e08ee8  "KeyedEvent"
89e09b18  "WindowStation"
89e092a8  "Desktop"
89e09b40  "TpWorkerFactory"
89e046e0  "Adapter"
kd>
4
  • I extracted the type index from the notepad correctly this time and it's 0x98, I passed it as index for ObTypeIndexTable and also applied the cast nt!_object_type**. I got the result struct _OBJECT_TYPE * 0x0000000000000000` May 22 at 14:22
  • Hi, I updated my post too. Hope you able to help me with that. May 22 at 14:28
  • first of all post text not images sorry you are still using the same address of EPROCESS xxxxxx7080 (see i cant copy paste the address from image ) that address is not the start of HEADER it is address of _BODY in the header youneed to ascertain header properly and pass that address to nt!_OBJECT_HEADER passing arbitrary address would be akin to GARBAGE IN GARBAGE OUT there is no 98 index the max indexpossible is provided in the structure _OBJECT_HEADER->TotalNumberofObjects
    – blabb
    May 22 at 16:08
  • Finally, i saw my mistake. Thanks. May 22 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.