Overview

Windows Object Explorer 64-bit

Copyright © 2015 - 2024 WinObjEx64 Project

WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource usage etc. WinObjEx64 let you view and edit object-related security information.

WinObjEx64 does not require administrative privileges. However administrative privilege is required to view much of the namespace and to edit object-related security information.

WinObjEx64 works only on the following x64 Windows: Windows 7, Windows 8, Windows 8.1 and Windows 10/11, including Server variants. Running on Wine/Wine Staging is supported however most of Windows specific extended information will be unavailable due to obvious Wine limitations.

WinObjEx64 comes with full source code licensed under BSD-2 Clause.

In order to use all program features Windows must be booted in the DEBUG mode.

© WinObjEx64 Project


About Objects

The Microsoft® Windows® executive is object-based. Directories, symbolic links, devices, synchronization mechanisms, jobs, and so on, are all represented as objects in kernel mode. Objects are manipulated by the Object Manager, which is a subsystem of the executive. The Object Manager uses objects to regulate access to system resources. The use of objects ensures that system functionality can be updated, as long as the original object interface is maintained.

Note that Windows kernel-mode objects have no relation to COM objects, or objects in C++ or any other object-oriented programming language.

Kernel-mode objects are either named or unnamed. The Object Manager namespace is a global one. Both user-mode and kernel-mode components use the object name to refer to the object.

Named objects are organized into a hierarchy. Only some types of objects can have child objects. These objects are container objects. For example, an object directory is a named object that is used solely to contain other named objects. Each object is named relative to a parent object. Each component of the object's name begins with a backslash character. For example, \Device is the object directory containing the named device objects and is the parent object for \Device\NamedPipe. Object directories do not correspond to actual directories on a disk, by the way.

WinObjEx64 let you view named objects, some of unnamed objects (such as Processes, Threads and Tokens) and (if driver assisted) private namespace objects. You can use WinObjEx64 to gain a better understanding of how the Object Manager tracks names to system objects.

All named objects in Windows NT can be secured. The security facilities allow the system to selectively grant and deny access to objects. Each object has its own access-control list (ACL) that specifies the actions can be performed on the object. The system examines an object's ACL each time an application creates a handle to the object.

WinObjEx64 let you view and edit object's ACL.


History

v 2.0.4 24 Feb 2024

▪ win11 23h2 compatibility
▪ win11+ 24h2 compatibility improvements
▪ fix tooltip flickering for drivers list
▪ fix log ui highlight glitch
▪ fix authenticode hash missing pad bytes (in some cases)
▪ driver list tooltip now include information if the given driver is registered as filter (admin priv. required)

v 2.0.3 31 July 2023

▪ recent win11 compatibility improvements
▪ win11 24h2 preliminary support

v 2.0.2 25 May 2023

▪ recent win10/win11 compatibility improvements
▪ display more details about shimmed drivers

v 2.0.1 25 December 2022

▪ recent win10/win11 compatibility improvements
▪ token properties dialog changes
▪ added and updated some object type descriptions (from Windows Internals 7ed book)

v 2.0.0 23 June 2022

▪ added entirely new handling of object names to support embedded nulls
▪ added Pico providers, Nmi, SiloMonitor and Errata manager callbacks
▪ added CmControlVector viewer
▪ added Copy Name/Copy Name (Binary) commands to the main window popup menus
▪ added program statistics (see Help->Statistics)
▪ added legend window description for process list
▪ added ability to fix image sections for dumped drivers
▪ added RegistryTransaction object view and access rights
▪ moved "Globals" from about box to the View->System Information and rearranged it output
▪ drivers dump operation can now be cancelled
▪ fix display of PUNICODE_STRING dump
▪ fix ALPC Port type objects sometimes unable to open while they can be opened
▪ plugin sdk updated to accommodate new named objects handling
▪ imagescope plugin updated to accomodate plugin sdk changes
▪ elevation required features in "extras" will now request elevation instead of just been disabled
▪ help file updated with drivers and symbols usage
▪ internal rearrange and minor UI changes

v 1.9.3 15 May 2022

▪ updated SeCiCallbacks search for newest Windows versions
▪ added Windows Server 2022 support
▪ fix win32k ApiSet resolving for Win10 21H2
▪ fix ObCallbacks enumeration issues
▪ support for various kernel driver helpers
▪ ported to msvc 2022 (with backward compatibility to 2019)
▪ bugfixes
▪ rtls updated

v 1.9.2 10 December 2021

▪ more Win10/11 21h2 compatibility changes
▪ added FLT_FILTER, FLT_OBJECT structured dump
▪ added authenticode hash calculation for loaded drivers (extras->Drivers, use popup menu on driver entry)
▪ added coalescing callbacks to callbacks list
▪ various minor UI changes
▪ rtls updated
▪ internal rearrange

v 1.9.1 29 August 2021

▪ 21h2 compatibility improvements
▪ rtls updated

v 1.9.0 20 June 2021

▪ added Section object structured dump
▪ added ALPC port connections list (similar to !alpc /lpc windbg command)
▪ added MmUnloadedDrivers list
▪ added ExCreateCallback list to the callbacks list (PR #26)
▪ updated ApiSet plugin now support in place search filter
▪ internal rearrange

v 1.8.8 27 Jan 2021

▪ internal rearrange
▪ view security for ALPC type ports (most of them)
▪ security descriptor view dialog (object SID, DACL & SACL)
▪ fix scm services list query
▪ fix "jump to file may fail under certain conditions" bug
▪ various minor UI changes
▪ 21h1 compatibility improvements

v 1.8.7 01 Aug 2020

▪ 20h1/20h2/21h1 compatibility improvements
▪ added recognizing of shimmed drivers for drivers list (win10+)
▪ show process trust label for sections if it present
▪ plugins system extended and upgraded to support context plugins
▪ added imagescope plugin for section object types backed by imagefile
▪ added plugins viewer
▪ various minor changes
▪ treelist: fix tooltips flickering on Windows 7

v 1.8.6 07 June 2020

▪ reimplemented directory object dump to output more data
▪ added callbacks registered with ExRegisterExtension
▪ fix for pipes (pull request #17 by @lshagiev)
▪ internal rearrange
▪ fix high cpu usage for splitter drag (report/fix by RamMerlabs)
▪ fix security dialog regression (reported by RamMerlabs)

v 1.8.5 05 May 2020

▪ fix object cookie
▪ add error log (Help->Show Log)
▪ 20h1/20h2 compatibility improvements

v 1.8.4 29 Feb 2020

▪ support for additional helper driver
▪ fix Windows 7 regressions

v 1.8.3 17 Jan 2020

▪ internal rearrange
▪ ported to msvc 2019 (with backward compatibility to 2017)
▪ fix current directory value for elevated/system re-launch (reported by RamMerlabs)

v 1.8.2 29 Nov 2019

▪ added Token object properties
▪ added PsAltSystemCallHandlers to callbacks dialog
▪ fix High DPI issues with certain dialogs
▪ fix Pipe security dialog not shown where available
▪ fix multiple Wine/Wine Staging misbehavior
▪ corrected typo in DebugObject description
▪ more 20H1 support changes
▪ various minor changes

v 1.8.1 01 Nov 2019

▪ 19H2 support
▪ preliminary 20H1 support

v 1.8.0 01 Sep 2019

▪ improved run as local system feature (issue #14)
▪ added plugin subsystem
▪ added example plugin
▪ added Sonar plugin - NDIS protocols viewer (resembles much of old rootkit.com SONAR app)
▪ added ApiSetView plugin - ApiSetSchema viewer (supported v2, v4, v6)

v 1.7.4 01 June 2019

▪ added software licensing cache view (extras)
▪ resolve apisets while viewing shadow table in Windows 10 20H1 >= 18890 builds
▪ fix displaying sid/domain information for private namespaces
▪ added refresh (f5) for namespaces dialog

v 1.7.3 01 Apr 2019

▪ threads list in process dialog
▪ view file properties for KiServiceTable/W32pServiceTable dialogs
▪ process/thread/token object properties dialogs
▪ bugfixes

v 1.7.2 01 Mar 2019

▪ symbolic link object dump2
▪ internal fixes after profiling
▪ support for 19H1 SeCiCallbacks scan
▪ added and updated more object type descriptions

v 1.7.1 20 Jan 2019

▪ SeCiCallbacks/g_CiCallbacks added to the callbacks viewer4
▪ Session object type view

v 1.7.0 02 Dec 2018

▪ code can now be compiled as C++
▪ added W32pServiceTable view4
▪ added process list dialog (extras)
▪ added Callback object type callbacks list (Properties->Object)2
▪ added callbacks viewer for certain callback types (registry, ps, ob, kebugcheck, se, dbg, po etc)2
▪ reimplemented "type" object type view (added missing fields from w10+)2
▪ reimplemented service tables extraction code

v 1.6.0 30 Oct 2018

▪ ported to msvc 2017 (with backward compatibility to 2015)
▪ reimplemented private namespaces lookup2
▪ object directory dump reflect Win10 changes2
▪ added alpc port dump and additional dialog2
▪ treelist control updated
▪ private namespaces dialog updated
▪ usershareddata dialog updated
▪ internal rearrange
▪ merge pull request #7, fix Job object process list display
▪ multiple Wine Staging fixes
▪ rtls updated

v 1.5.5 30 Aug 2018

▪ Process Trust Label caption now only displayed for Directories
▪ rtls updated

v 1.5.4 16 Aug 2018

▪ added display of Process Trust Label for Directory object type

v 1.5.3 01 Apr 2018

▪ fixed OpenWindowStation bug
▪ multiple internal changes
▪ note: Windows 10 RS4/RS5 supported

v 1.5.0 01 Sep 2017

▪ added Partition, DxghCurrentDxgProcessObject objects description
▪ added mailslots viewer dialog
▪ added file properties for drivers (menu -> extras -> Drivers)
▪ added FltConnectionPort object dump
▪ switched to hde instead of ldasm
▪ fixed Wine behavior along with some bugs
▪ rtls updated, switched to VS2015 U3
▪ note: Windows 10 RS2 (15063), RS1 (14393) supported as well as TH1(10240)/TH2(10586)
▪ note: Windows 10 RS3 supported (as of 16288+ build)

v 1.4.0 13 Feb 2016

▪ KiServiceTable dump for all supported Windows versions
▪ list drivers with ability to dump (menu -> extras), dump need windbg driver
▪ some code revision and corrections

v 1.3.0 03 Nov 2015

▪ official support of Windows 10 (10240 release)
▪ added private namespace viewer (menu -> extras), note Windows 10 th2 not supported

v 1.2.0 26 July 2015

▪ added KUSER_SHARED_DATA dump (menu -> extras)
▪ code revision and corrections
▪ ported to msvc 2015 (cfg on)

v 1.1.0 01 March 2015

▪ added popup menu for Process page
▪ added file properties dialog for Process page
▪ added descriptions for more object types
▪ added named pipes dialog (menu -> extras)
▪ added information for IoCompletion object type, including structured object body dump2
▪ some code revision and corrections

v 1.0.0 23 February 2015

▪ initial release
▪ view area with explorer-like user interface
▪ property dialogs for object types
▪ advanced property dialogs for Device, Driver, Event, Job, Key, Mutant, Section, Semaphore, SymbolicLink, Timer, Type, WindowStation
▪ viewing and editing object-related security information1
▪ object kernel addresses and extended information2
▪ list of processes that have object open3
▪ object body structured dump for Device, Directory, Device Driver, Event, Mutant, Semaphore, Timer, Type2
▪ service registry settings for Driver, including "Jump To Key" feature
▪ find object dialog, about dialog
▪ "Go To Link Target" feature
▪ Desktops list for a selected WindowStation
▪ this help file

Some little amount of original Four-F tool features were considered by us as not useful and/or not appropriate for new OS design and were removed.

The last available WinObjEx from Four-F is v3.2 from 23 September 2005

1) warning, changing kernel object security is a dangerous

2) available only with admin privileges and Windows booted in DEBUG mode

3) not all types due to Windows API restrictions

4) this feature is only available for Windows 10 starting from 1607 (RS1 14393)


Hot Keys

The following hot keys are supported:

· F1

- Display this help
· F5

- Refresh
· Tab

- Switch between sub-windows
· Enter

- Display object property dialog
· Ctrl+D

- Enable or disable grid lines for main window listview
· Ctrl+F

- Display find object dialog
· Ctrl+I

- Display system information dialog
· Ctrl+P

- Display named pipes dialog
· Ctrl+M

- Display mailslots viewer dialog
· Ctrl+N

- Display private namespace viewer dialog
· Ctrl+->

- Go to symbolic link target
· Esc

- Exit

© WinObjEx64 Project


Configuration

WinObjEx64 support limited set of configuration options it can use.

These values are read during startup from Windows Registry path HKEY_CURRENT_USER\Software\WinObjEx64.

Currently the following options are supported:

Name | Meaning | Default (assumed by program)
SymDbgHelpDll | Full path to the DbgHelp.dll, see Symbols Usage for a complete description | %CurrentWinObjEx64Path%\symdll\dbghelp.dll
SymPath | Symbols path, see Symbols Usage for a complete description | srv*%temp%\Symbols*https://msdl.microsoft.com/download/symbols
NormalizationSymbol | Unicode symbol used to decorate object names for output in GUI in case if names contains embedded nulls | '?' (valid symbols are: !"#$%'()*+-.:;<>=?@][^_`{}~ )

© WinObjEx64 Projec


Driver Usage

There are two types of drivers that can be used by WinObjEx64.

· Driver to access kernel memory for data read operations. Default WinObjEx64 version has built-in Kernel Local Debugging Driver (KLDBGDRV) from Microsoft's WinDbg. In order to use it Windows must be booted in the debug mode (bcdedit -debug on). Private builds of WinObjEx64 uses several private drivers that are not limited to debug mode and can work with modern HVCI enabled;
· Driver to access object handles. WinObjEx64 (any variant) support SysInternals Process Explorer driver of version 1.5.2 to open process/threads. To enable this just load SysInternals Process Explorer with administrator privileges simultaneously with WinObjEx64.

Any helper driver usage require WinObjEx64 to be run with administrative privileges.


Symbols Usage

WinObjEx64 supports Microsoft Symbols to query Windows internal variables and data. By default or if no symbols are available (either there are no symbols due to loading/parsing failure) WinObjEx64 will use various Windows version dependent binary patterns to query data.

Refer to https://docs.microsoft.com/en-us/windows/win32/debug/dbghelp-versions for information about difference between default Windows shipped dlls and these that can be obtained from Debugging Tools For Windows package.

To enable symbols usage there are two ways:

· Put a proper version of DBGHLELP.DLL, SYMSRV.DLL into WinObjEx64 executable subdirectory named SYMDLL.

For example, if WinObjEx64 installed into C:\UTILS directory then

1. Create subdirectory SYMDLL inside C:\UTILS
2. Move a copy of DBGHELP.DLL, SYMSRV.DLL to C:\UTILS\SYMDLL
3. Restart WinObjEx64 if needed

In this case downloaded symbols will be stored in the "Symbols" subdirectory of current user %temp%.

· Configure WinObjEx64 through Windows Registry.

Open Regedit and create a subkey HKEY_CURRENT_USER\Software\WinObjEx64

In this subkey create a REG_SZ type values with the following names:

SymDbgHelpDll, a full path to the dbghelp.dll from Debugging Tools For Windows, for example C:\WINDBG\dbghelp.dll

SymPath, a symbols path you want to use, for example srv*C:\DownloadedSymbols*https://msdl.microsoft.com/download/symbols

Once restarted WinObjEx64 will use these values to load symbols.


Acknowledgements

We would like to thanks the following people for their contributions (in the alphabetical order):

Andrew Ivlev aka Four-F - author of the original x86-32 WinObjEx

Giuseppe Bonfa aka Evilcry - KDSubmarine author

Mark Russinovich - author of the original proof-of-concept tool WinObj

Microsoft WinDBG developers team

Everyone who contributed to WinObjEx64 project on github via pull requests or bug reports, thank you for your contribution and support!

Main program logo icon from http://www.softicons.com/toolbar-icons/free-3d-printer-icons-by-aha-soft

Other icons are from original Four-F WinObjEx


Authors

Copyrights

WinObjEx64 is freeware. Nobody can sell WinObjEx64 or charge for using WinObjEx64.

Copyright (c) 2015 - 2024, WinObjEx64 Project

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This program uses genuine Windows Debugger Local Kernel Debugging Driver © Microsoft Corporation.