<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.3.3" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>
<channel>
	<title>Comments on: Signaled Objects</title>
	<link>https://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/</link>
	<description>Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics</description>
	<pubDate>Wed, 06 May 2026 11:40:16 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.3.3</generator>
		<item>
		<title>By: Dmitry Vostokov</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/#comment-741697</link>
		<dc:creator>Dmitry Vostokov</dc:creator>
		<pubDate>Mon, 14 Mar 2016 17:21:27 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/#comment-741697</guid>
		<description>The structures are different in Windows 8.x (for example, TypeIndex instead of a pointer):

&lt;code&gt;0: kd&gt;  dt _OBJECT_HEADER 
nt!_OBJECT_HEADER
   +0x000 PointerCount     : Int8B
   +0x008 HandleCount      : Int8B
   +0x008 NextToFree       : Ptr64 Void
   +0x010 Lock             : _EX_PUSH_LOCK
   +0x018 TypeIndex        : UChar
   +0x019 TraceFlags       : UChar
   +0x019 DbgRefTrace      : Pos 0, 1 Bit
   +0x019 DbgTracePermanent : Pos 1, 1 Bit
   +0x01a InfoMask         : UChar
   +0x01b Flags            : UChar
   +0x01c Spare            : Uint4B
   +0x020 ObjectCreateInfo : Ptr64 _OBJECT_CREATE_INFORMATION
   +0x020 QuotaBlockCharged : Ptr64 Void
   +0x028 SecurityDescriptor : Ptr64 Void
   +0x030 Body             : _QUAD&lt;/code&gt;

&lt;code&gt;0: kd&gt; dt _DISPATCHER_HEADER 
ntdll!_DISPATCHER_HEADER
   +0x000 Type             : UChar
   +0x001 TimerControlFlags : UChar
   +0x001 Absolute         : Pos 0, 1 Bit
   +0x001 Wake             : Pos 1, 1 Bit
   +0x001 EncodedTolerableDelay : Pos 2, 6 Bits
   +0x001 Abandoned        : UChar
   +0x001 Signalling       : UChar
   +0x002 ThreadControlFlags : UChar
   +0x002 CycleProfiling   : Pos 0, 1 Bit
   +0x002 CounterProfiling : Pos 1, 1 Bit
   +0x002 GroupScheduling  : Pos 2, 1 Bit
   +0x002 AffinitySet      : Pos 3, 1 Bit
   +0x002 Reserved         : Pos 4, 4 Bits
   +0x002 Hand             : UChar
   +0x002 Size             : UChar
   +0x003 TimerMiscFlags   : UChar
   +0x003 Index            : Pos 0, 6 Bits
   +0x003 Inserted         : Pos 6, 1 Bit
   +0x003 Expired          : Pos 7, 1 Bit
   +0x003 DebugActive      : UChar
   +0x003 ActiveDR7        : Pos 0, 1 Bit
   +0x003 Instrumented     : Pos 1, 1 Bit
   +0x003 Reserved2        : Pos 2, 4 Bits
   +0x003 UmsScheduled     : Pos 6, 1 Bit
   +0x003 UmsPrimary       : Pos 7, 1 Bit
   +0x003 DpcActive        : UChar
   +0x000 Lock             : Int4B
   +0x000 LockNV           : Int4B
   +0x004 SignalState      : Int4B
   +0x008 WaitListHead     : _LIST_ENTRY&lt;/code&gt;

&lt;code&gt;0: kd&gt; dt _OBJECT_TYPE 
ntdll!_OBJECT_TYPE
   +0x000 TypeList         : _LIST_ENTRY
   +0x010 Name             : _UNICODE_STRING
   +0x020 DefaultObject    : Ptr64 Void
   +0x028 Index            : UChar
   +0x02c TotalNumberOfObjects : Uint4B
   +0x030 TotalNumberOfHandles : Uint4B
   +0x034 HighWaterNumberOfObjects : Uint4B
   +0x038 HighWaterNumberOfHandles : Uint4B
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER
   +0x0b8 TypeLock         : _EX_PUSH_LOCK
   +0x0c0 Key              : Uint4B
   +0x0c8 CallbackList     : _LIST_ENTRY&lt;/code&gt;

&lt;code&gt;0: kd&gt; dp ObTypeIndexTable
fffff802`b3d22dc0  00000000`00000000 00000000`bad0b0b0
fffff802`b3d22dd0  fffffa80`01816100 fffffa80`017f5080
fffff802`b3d22de0  fffffa80`0182a610 fffffa80`0181cf20
fffff802`b3d22df0  fffffa80`01828af0 fffffa80`01825670
fffff802`b3d22e00  fffffa80`0183cf20 fffffa80`01844930
fffff802`b3d22e10  fffffa80`01843080 fffffa80`0184b2c0
fffff802`b3d22e20  fffffa80`01812d80 fffffa80`017f9080
fffff802`b3d22e30  fffffa80`0182f080 fffffa80`017f9f20&lt;/code&gt;

&lt;code&gt;0: kd&gt; dt _OBJECT_TYPE fffffa80`01825670
ntdll!_OBJECT_TYPE
   +0x000 TypeList         : _LIST_ENTRY [ 0xfffffa80`01825670 - 0xfffffa80`01825670 ]
   +0x010 Name             : _UNICODE_STRING "Process"
   +0x020 DefaultObject    : (null) 
   +0x028 Index            : 0x7 ''
   +0x02c TotalNumberOfObjects : 0x2c
   +0x030 TotalNumberOfHandles : 0x136
   +0x034 HighWaterNumberOfObjects : 0x31
   +0x038 HighWaterNumberOfHandles : 0x149
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER
   +0x0b8 TypeLock         : _EX_PUSH_LOCK
   +0x0c0 Key              : 0x636f7250
   +0x0c8 CallbackList     : _LIST_ENTRY [ 0xfffff8a0`00098a30 - 0xfffff8a0`00098a30 ]&lt;/code&gt;</description>
		<content:encoded><![CDATA[<p>The structures are different in Windows 8.x (for example, TypeIndex instead of a pointer):</p>
<p><code>0: kd>  dt _OBJECT_HEADER<br />
nt!_OBJECT_HEADER<br />
   +0x000 PointerCount     : Int8B<br />
   +0x008 HandleCount      : Int8B<br />
   +0x008 NextToFree       : Ptr64 Void<br />
   +0x010 Lock             : _EX_PUSH_LOCK<br />
   +0x018 TypeIndex        : UChar<br />
   +0x019 TraceFlags       : UChar<br />
   +0x019 DbgRefTrace      : Pos 0, 1 Bit<br />
   +0x019 DbgTracePermanent : Pos 1, 1 Bit<br />
   +0x01a InfoMask         : UChar<br />
   +0x01b Flags            : UChar<br />
   +0x01c Spare            : Uint4B<br />
   +0x020 ObjectCreateInfo : Ptr64 _OBJECT_CREATE_INFORMATION<br />
   +0x020 QuotaBlockCharged : Ptr64 Void<br />
   +0x028 SecurityDescriptor : Ptr64 Void<br />
   +0x030 Body             : _QUAD</code></p>
<p><code>0: kd> dt _DISPATCHER_HEADER<br />
ntdll!_DISPATCHER_HEADER<br />
   +0x000 Type             : UChar<br />
   +0x001 TimerControlFlags : UChar<br />
   +0x001 Absolute         : Pos 0, 1 Bit<br />
   +0x001 Wake             : Pos 1, 1 Bit<br />
   +0x001 EncodedTolerableDelay : Pos 2, 6 Bits<br />
   +0x001 Abandoned        : UChar<br />
   +0x001 Signalling       : UChar<br />
   +0x002 ThreadControlFlags : UChar<br />
   +0x002 CycleProfiling   : Pos 0, 1 Bit<br />
   +0x002 CounterProfiling : Pos 1, 1 Bit<br />
   +0x002 GroupScheduling  : Pos 2, 1 Bit<br />
   +0x002 AffinitySet      : Pos 3, 1 Bit<br />
   +0x002 Reserved         : Pos 4, 4 Bits<br />
   +0x002 Hand             : UChar<br />
   +0x002 Size             : UChar<br />
   +0x003 TimerMiscFlags   : UChar<br />
   +0x003 Index            : Pos 0, 6 Bits<br />
   +0x003 Inserted         : Pos 6, 1 Bit<br />
   +0x003 Expired          : Pos 7, 1 Bit<br />
   +0x003 DebugActive      : UChar<br />
   +0x003 ActiveDR7        : Pos 0, 1 Bit<br />
   +0x003 Instrumented     : Pos 1, 1 Bit<br />
   +0x003 Reserved2        : Pos 2, 4 Bits<br />
   +0x003 UmsScheduled     : Pos 6, 1 Bit<br />
   +0x003 UmsPrimary       : Pos 7, 1 Bit<br />
   +0x003 DpcActive        : UChar<br />
   +0x000 Lock             : Int4B<br />
   +0x000 LockNV           : Int4B<br />
   +0x004 SignalState      : Int4B<br />
   +0x008 WaitListHead     : _LIST_ENTRY</code></p>
<p><code>0: kd> dt _OBJECT_TYPE<br />
ntdll!_OBJECT_TYPE<br />
   +0x000 TypeList         : _LIST_ENTRY<br />
   +0x010 Name             : _UNICODE_STRING<br />
   +0x020 DefaultObject    : Ptr64 Void<br />
   +0x028 Index            : UChar<br />
   +0x02c TotalNumberOfObjects : Uint4B<br />
   +0x030 TotalNumberOfHandles : Uint4B<br />
   +0x034 HighWaterNumberOfObjects : Uint4B<br />
   +0x038 HighWaterNumberOfHandles : Uint4B<br />
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER<br />
   +0x0b8 TypeLock         : _EX_PUSH_LOCK<br />
   +0x0c0 Key              : Uint4B<br />
   +0x0c8 CallbackList     : _LIST_ENTRY</code></p>
<p><code>0: kd> dp ObTypeIndexTable<br />
fffff802`b3d22dc0  00000000`00000000 00000000`bad0b0b0<br />
fffff802`b3d22dd0  fffffa80`01816100 fffffa80`017f5080<br />
fffff802`b3d22de0  fffffa80`0182a610 fffffa80`0181cf20<br />
fffff802`b3d22df0  fffffa80`01828af0 fffffa80`01825670<br />
fffff802`b3d22e00  fffffa80`0183cf20 fffffa80`01844930<br />
fffff802`b3d22e10  fffffa80`01843080 fffffa80`0184b2c0<br />
fffff802`b3d22e20  fffffa80`01812d80 fffffa80`017f9080<br />
fffff802`b3d22e30  fffffa80`0182f080 fffffa80`017f9f20</code></p>
<p><code>0: kd> dt _OBJECT_TYPE fffffa80`01825670<br />
ntdll!_OBJECT_TYPE<br />
   +0x000 TypeList         : _LIST_ENTRY [ 0xfffffa80`01825670 - 0xfffffa80`01825670 ]<br />
   +0x010 Name             : _UNICODE_STRING "Process"<br />
   +0x020 DefaultObject    : (null)<br />
   +0x028 Index            : 0x7 ''<br />
   +0x02c TotalNumberOfObjects : 0x2c<br />
   +0x030 TotalNumberOfHandles : 0x136<br />
   +0x034 HighWaterNumberOfObjects : 0x31<br />
   +0x038 HighWaterNumberOfHandles : 0x149<br />
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER<br />
   +0x0b8 TypeLock         : _EX_PUSH_LOCK<br />
   +0x0c0 Key              : 0x636f7250<br />
   +0x0c8 CallbackList     : _LIST_ENTRY [ 0xfffff8a0`00098a30 - 0xfffff8a0`00098a30 ]</code></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Software Generalist &#187; Blog Archive &#187; Reading Notebook: 17-August-09</title>
		<link>https://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/#comment-89325</link>
		<dc:creator>Software Generalist &#187; Blog Archive &#187; Reading Notebook: 17-August-09</dc:creator>
		<pubDate>Mon, 17 Aug 2009 15:51:18 +0000</pubDate>
		<guid>https://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/#comment-89325</guid>
		<description>[...] structure (p. 138) - I created a simplified UML diagram when I was investigating object signaling: http://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/. Here&#8217;s another example of how to get an object header from the dispatcher address a thread [...]</description>
		<content:encoded><![CDATA[<p>[&#8230;] structure (p. 138) - I created a simplified UML diagram when I was investigating object signaling: <a href="http://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/." rel="nofollow">http://www.dumpanalysis.org/blog/index.php/2008/03/06/signaled-objects/.</a> Here&#8217;s another example of how to get an object header from the dispatcher address a thread [&#8230;]</p>
]]></content:encoded>
	</item>
</channel>
</rss>
