Windows 是一个对象驱动的OS。通过研究RecctOS 研究下对象的结构，创建，管理，删除操作。
1.对象的结构
其实对象就是一块内存，对象的结构有对象头和对象体两部分组成。
1.1对象头的结构：
typedef struct _OBJECT_HEADER
/*
* PURPOSE: Header for every object managed by the object manager
*/
{
UNICODE_STRING Name; // 名字
LIST_ENTRY Entry; // 对象链表
LONG RefCount; // 对象的引用计数
LONG HandleCount; //
BOOLEAN Permanent; // ??
struct _DIRECTORY_OBJECT* Parent;
POBJECT_TYPE ObjectType; // 对象的类型
/*
* PURPOSE: Object type
* NOTE: This overlaps the first member of the object body
*/
CSHORT Type;
/*
* PURPOSE: Object size
* NOTE: This overlaps the second member of the object body
*/
CSHORT Size; 对象的大小，包含了对象体
} OBJECT_HEADER, *POBJECT_HEADER;
对象头是通用的，也就是说，所有类型的对象的对象头结构是一致的。那么我们对对象的访问也就可以通用起来。
1.2 对象体的结构
不同的对象的对象体是不同的。
2. 对象的创建
在0.17代码中，是通过ObCreateObject 系统调用实现的。
PVOID STDCALL ObCreateObject(PHANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
POBJECT_TYPE Type)
{
if (ObjectAttributes != NULL &&
ObjectAttributes->ObjectName != NULL)
{
ObFindObject(ObjectAttributes,
&Parent,
&RemainingPath,
NULL);
}
else
{
RtlInitUnicodeString (&RemainingPath, NULL);
}
RtlMapGenericMask(&DesiredAccess,
Type->Mapping);
/*分配对象的内存*/
Header = (POBJECT_HEADER)ExAllocatePool(NonPagedPool,
OBJECT_ALLOC_SIZE(Type));
/*初始化对象数据*/
ObInitializeObject(Header,
Handle,
DesiredAccess,
Type,
ObjectAttributes);
if (Header->ObjectType != NULL &&
Header->ObjectType->Create != NULL)
{
/*初始化该类型的对象体*/
Status = Header->ObjectType->Create(HEADER_TO_BODY(Header),
Parent,
RemainingPath.Buffer,
ObjectAttributes);
RtlFreeUnicodeString( &RemainingPath );
/*返回对象体*/
return(HEADER_TO_BODY(Header));
}
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
[ObCreateObjcet ----- > ObInitializeObject ]
VOID ObInitializeObject(POBJECT_HEADER ObjectHeader,
PHANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE Type,
POBJECT_ATTRIBUTES ObjectAttributes)
{
/*初始化对象的头*/
ObjectHeader->HandleCount = 0;
ObjectHeader->RefCount = 1;
ObjectHeader->ObjectType = Type;
if (ObjectAttributes != NULL &&
ObjectAttributes->Attributes & OBJ_PERMANENT)
{
ObjectHeader->Permanent = TRUE;
}
else
{
ObjectHeader->Permanent = FALSE;
}
RtlInitUnicodeString(&(ObjectHeader->Name),NULL);
/* 在当前进程中创建一个handle指向该对象*/
if (Handle != NULL)
{
ObCreateHandle(PsGetCurrentProcess(),
HEADER_TO_BODY(ObjectHeader),
DesiredAccess,
FALSE,
Handle);
}
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
3. 对象的使用
/*
* PURPOSE: Returns the byte offset of a field within a structure
*/
#define FIELD_OFFSET (long)( & ((type*)(0) -> field))
/*
* PURPOSE: Returns the base address structure if the caller knows the
* address of a field within the structure
* ARGUMENTS:
* Address = address of the field
* Type = Type of the whole structure
* Field = Name of the field whose address is none
*/
#define CONTAINING_RECORD(Address, type , field ) (type*)( (long)Address - FIELE_OFFSET(type, fileld) )
上面是两个非常精致的宏。。。从注释可知：
宏1 是返回一个字段相对于结构体的偏移。。
宏2 是已知一个字段的地址，根据该地址得到结构体的地址 。。
NTSTATUS ObCreateHandle(PEPROCESS Process,
PVOID ObjectBody,
ACCESS_MASK GrantedAccess,
BOOLEAN Inherit,
PHANDLE HandleReturn)
/*
* FUNCTION: Add a handle referencing an object
* ARGUMENTS:
* obj = Object body that the handle should refer to
* RETURNS: The created handle
* NOTE: THe handle is valid only in the context of the current process
*/
{
LIST_ENTRY* current;
unsigned int handle=1;
unsigned int i;
HANDLE_BLOCK* new_blk = NULL;
PHANDLE_TABLE HandleTable;
KIRQL oldlvl;
DPRINT("ObCreateHandle(Process %x, obj %x)\n",Process,ObjectBody);
if (ObjectBody != NULL)
{
BODY_TO_HEADER(ObjectBody)->HandleCount++;
}
HandleTable = &Process->HandleTable; // 得到进程的句柄表（是一个双向链表 LIST_ENTRY）
KeAcquireSpinLock(&HandleTable->ListLock, &oldlvl);
current = HandleTable->ListHead.Flink; //
/*
* Scan through the currently allocated handle blocks looking for a free
* slot
*/
while (current != (&HandleTable->ListHead))
{
HANDLE_BLOCK* blk = CONTAINING_RECORD(current,HANDLE_BLOCK,entry);
DPRINT("Current %x\n",current);
for (i=0;i<HANDLE_BLOCK_ENTRIES;i++)
{
DPRINT("Considering slot %d containing %x\n",i,blk->handles[i]);
if (blk->handles[i].ObjectBody==NULL)
{
blk->handles[i].ObjectBody = ObjectBody;
blk->handles[i].GrantedAccess = GrantedAccess;
blk->handles[i].Inherit = Inherit;
KeReleaseSpinLock(&HandleTable->ListLock, oldlvl);
*HandleReturn = (HANDLE)((handle + i) << 2);
return(STATUS_SUCCESS);
}
}
handle = handle + HANDLE_BLOCK_ENTRIES;
current = current->Flink;
}
/*
* Add a new handle block to the end of the list
*/
new_blk = (HANDLE_BLOCK *)ExAllocatePool(NonPagedPool,sizeof(HANDLE_BLOCK));
memset(new_blk,0,sizeof(HANDLE_BLOCK));
InsertTailList(&(Process->HandleTable.ListHead),
&new_blk->entry);
KeReleaseSpinLock(&HandleTable->ListLock, oldlvl);
new_blk->handles[0].ObjectBody = ObjectBody;
new_blk->handles[0].GrantedAccess = GrantedAccess;
new_blk->handles[0].Inherit = Inherit;
*HandleReturn = (HANDLE)(handle << 2);
return(STATUS_SUCCESS);
}
从上面的代码可以看出， 进程的句柄链表是 分块的， 也就是下面的结构
Block 1 --- > block 2 ---- > Block 3------> block4
| | | |
handle1 handle4 .... ......
handle2 handle5
handle3 handle6
并且一个block是一个page..