Overview

Windows Object Explorer 64-bit

Copyright © 2015 - 2019 WinObjEx64 Project

WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource usage etc. WinObjEx64 let you view and edit object-related security information.

WinObjEx64 does not require administrative privileges. However administrative privilege is required to view much of the namespace and to edit object-related security information.

WinObjEx64 works only on the following x64 Windows: Windows 7, Windows 8, Windows 8.1 and Windows 10, including Server variants.

WinObjEx64 comes with full source code.

In order to use all program features Windows must be booted in the DEBUG mode.

© 2015 - 2019 WinObjEx64 Project


About Objects

The Microsoft® Windows® executive is object-based. Directories, symbolic links, devices, synchronization mechanisms, jobs, and so on, are all represented as objects in kernel mode. Objects are manipulated by the Object Manager, which is a subsystem of the executive. The Object Manager uses objects to regulate access to system resources. The use of objects ensures that system functionality can be updated, as long as the original object interface is maintained.

Note that Windows kernel-mode objects have no relation to COM objects, or objects in C++ or any other object-oriented programming language.

Kernel-mode objects are either named or unnamed. The Object Manager namespace is a global one. Both user-mode and kernel-mode components use the object name to refer to the object.

Named objects are organized into a hierarchy. Only some types of objects can have child objects. These objects are container objects. For example, an object directory is a named object that is used solely to contain other named objects. Each object is named relative to a parent object. Each component of the object's name begins with a backslash character. For example, \Device is the object directory containing the named device objects and is the parent object for \Device\NamedPipe. Object directories do not correspond to actual directories on a disk, by the way.

WinObjEx64 let you view only named objects. You can use WinObjEx64 to gain a better understanding of how the Object Manager tracks names to system objects.

All named objects in Windows NT can be secured. The security facilities allow the system to selectively grant and deny access to objects. Each object has its own access-control list (ACL) that specifies the actions can be performed on the object. The system examines an object's ACL each time an application creates a handle to the object.

WinObjEx64 let you view and edit object's ACL.


History

v 1.8.2 29 Nov 2019

▪ added Token object properties
▪ added PsAltSystemCallHandlers to callbacks dialog
▪ fix High DPI issues with certain dialogs
▪ fix Pipe security dialog not shown where available
▪ fix multiple Wine/Wine Staging misbehavior
▪ corrected typo in DebugObject description
▪ more 20H1 support changes
▪ various minor changes

v 1.8.1 01 Nov 2019

▪ 19H2 support
▪ Preliminary 20H1 support

v 1.8.0 01 Sep 2019

▪ improved run as local system feature (issue #14)
▪ added plugin subsystem
▪ added example plugin
▪ added Sonar plugin - NDIS protocols viewer (resembles much of old rootkit.com SONAR app)
▪ added ApiSetView plugin - ApiSetSchema viewer (suppored v2, v4, v6)

v 1.7.4 01 June 2019

▪ added software licensing cache view (extras)
▪ resolve apisets while viewing shadow table in Windows 10 20H1 >= 18890 builds
▪ fix displaying sid/domain information for private namespaces
▪ added refresh (f5) for namespaces dialog

v 1.7.3 01 Apr 2019

▪ threads list in process dialog
▪ view file properties for KiServiceTable/W32pServiceTable dialogs
▪ process/thread/token object properties dialogs
▪ bugfixes

v 1.7.2 01 Mar 2019

▪ symbolic link object dump2
▪ internal fixes after profiling
▪ support for 19H1 SeCiCallbacks scan
▪ added and updated more object type descriptions

v 1.7.1 20 Jan 2019

▪ SeCiCallbacks/g_CiCallbacks added to the callbacks viewer4
▪ Session object type view

v 1.7.0 02 Dec 2018

▪ code can now be compiled as C++
▪ added W32pServiceTable view4
▪ added process list dialog (extras)
▪ added Callback object type callbacks list (Properties->Object)2
▪ added callbacks viewer for certain callback types (registry, ps, ob, kebugcheck, se, dbg, po etc)2
▪ reimplemented "type" object type view (added missing fields from w10+)2
▪ reimplemented service tables extraction code

v 1.6.0 30 Oct 2018

▪ ported to msvc 2017 (with backward compatibility to 2015)
▪ reimplemented private namespaces lookup2
▪ object directory dump reflect Win10 changes2
▪ added alpc port dump and additional dialog2
▪ treelist control updated
▪ private namespaces dialog updated
▪ usershareddata dialog updated
▪ internal rearrange
▪ merge pull request #7, fix Job object process list display
▪ multiple Wine Staging fixes
▪ rtls updated

v 1.5.5 30 Aug 2018

▪ Process Trust Label caption now only displayed for Directories
▪ rtls updated

v 1.5.4 16 Aug 2018

▪ added display of Process Trust Label for Directory object type

v 1.5.3 01 Apr 2018

▪ fixed OpenWindowStation bug
▪ multiple internal changes
▪ note: Windows 10 RS4/RS5 supported

v 1.5.0 01 Sep 2017

▪ added Partition, DxghCurrentDxgProcessObject objects description
▪ added mailslots viewer dialog
▪ added file properties for drivers (menu -> extras -> Drivers)
▪ added FltConnectionPort object dump
▪ switched to hde instead of ldasm
▪ fixed Wine behavior along with some bugs
▪ rtls updated, switched to VS2015 U3
▪ note: Windows 10 RS2 (15063), RS1 (14393) supported as well as TH1(10240)/TH2(10586)
▪ note: Windows 10 RS3 supported (as of 16288+ build)

v 1.4.0 13 Feb 2016

▪ KiServiceTable dump for all supported Windows versions
▪ list drivers with ability to dump (menu -> extras), dump need windbg driver
▪ some code revision and corrections

v 1.3.0 03 Nov 2015

▪ official support of Windows 10 (10240 release)
▪ added private namespace viewer (menu -> extras), note Windows 10 th2 not supported

v 1.2.0 26 July 2015

▪ added KUSER_SHARED_DATA dump (menu -> extras)
▪ code revision and corrections
▪ ported to msvc 2015 (cfg on)

v 1.1.0 01 March 2015

▪ added popup menu for Process page
▪ added file properties dialog for Process page
▪ added descriptions for more object types
▪ added named pipes dialog (menu -> extras)
▪ added information for IoCompletion object type, including structured object body dump2
▪ some code revision and corrections

v 1.0.0 23 February 2015

▪ initial release
▪ view area with explorer-like user interface
▪ property dialogs for object types
▪ advanced property dialogs for Device, Driver, Event, Job, Key, Mutant, Section, Semaphore, SymbolicLink, Timer, Type, WindowStation
▪ viewing and editing object-related security information1
▪ object kernel addresses and extended information2
▪ list of processes that have object open3
▪ object body structured dump for Device, Directory, Device Driver, Event, Mutant, Semaphore, Timer, Type2
▪ service registry settings for Driver, including "Jump To Key" feature
▪ find object dialog, about dialog
▪ "Go To Link Target" feature
▪ Desktops list for a selected WindowStation
▪ this help file

Some little amount of original Four-F tool features were considered by us as not useful and/or not appropriate for new OS design and were removed.

The last available WinObjEx from Four-F is v3.2 from 23 September 2005

1) warning, changing kernel object security is a dangerous

2) available only with admin privileges and Windows booted in DEBUG mode

3) not all types due to Windows API restrictions

4) this feature is only available for Windows 10 starting from 1607 (RS1 14393)


Hot Keys

The following hot keys are supported:

· F1

- Display this help
· F5

- Refresh
· Tab

- Switch between sub-windows
· Enter

- Display object property dialog
· Ctrl+F

- Display find object dialog
· Ctrl+P

- Display named pipes dialog
· Ctrl+M

- Display mailslots viewer dialog
· Ctrl+N

- Display private namespace viewer dialog
· Ctrl+->

- Go to symbolic link target
· Esc

- Exit

© 2015 - 2019 WinObjEx64 Project


License Agreement

WinObjEx64 is freeware. Nobody can sell WinObjEx64 or charge for using WinObjEx64. No part of WinObjEx64 can be included with a commercial package. WinObjEx64 may not be redistributed in any way, or by any means, without the prior written permission of the authors.

WinObjEx64 IS DISTRIBUTED "AS IS". NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE AT YOUR OWN RISK. THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING OR MISUSING THIS SOFTWARE.

WinObjEx64 SOURCE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.


Acknowledgements

We would like to thanks the following people for their contributions (in the alphabetical order):

Andrew Ivlev aka Four-F - author of the original x86-32 WinObjEx

Giuseppe Bonfa aka Evilcry - KDSubmarine author

Mark Russinovich - author of the original proof-of-concept tool WinObj

Microsoft WinDBG developers team

Main program logo icon from http://www.softicons.com/toolbar-icons/free-3d-printer-icons-by-aha-soft

Other icons are from original Four-F WinObjEx


Authors

Copyrights

WinObjEx64 developed by WinObjEx64 Project group, in the alphabetical order:

EP_X0FF

MP_ART

This program uses Windows Debugger Local Kernel Debugging Driver © Microsoft Corporation.