Overview

Windows Object Explorer 64-bit

Copyright © 2015 WinObjEx64 Project

WinObjEx64 is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource usage etc. WinObjEx64 let you view and edit object-related security information.

WinObjEx64 does not require administrative privileges. However administrative privilege is required to view much of the namespace and to edit object-related security information.

WinObjEx64 works only on the following x64 Windows: Windows 7, Windows 8, Windows 8.1 and Windows 10, including Server variants.

WinObjEx64 does not work on Windows XP, Windows Vista is partially supported. We have no plans of their full support.

WinObjEx64 comes with full source code.

In order to use all program features Windows must be booted in the DEBUG mode.

© 2015 WinObjEx64 Project


About Objects

The Microsoft® Windows® executive is object-based. Directories, symbolic links, devices, synchronization mechanisms, jobs, and so on, are all represented as objects in kernel mode. Objects are manipulated by the Object Manager, which is a subsystem of the executive. The Object Manager uses objects to regulate access to system resources. The use of objects ensures that system functionality can be updated, as long as the original object interface is maintained.

Note that Windows kernel-mode objects have no relation to COM objects, or objects in C++ or any other object-oriented programming language.

Kernel-mode objects are either named or unnamed. The Object Manager namespace is a global one. Both user-mode and kernel-mode components use the object name to refer to the object.

Named objects are organized into a hierarchy. Only some types of objects can have child objects. These objects are container objects. For example, an object directory is a named object that is used solely to contain other named objects. Each object is named relative to a parent object. Each component of the object's name begins with a backslash character. For example, \Device is the object directory containing the named device objects and is the parent object for \Device\NamedPipe. Object directories do not correspond to actual directories on a disk, by the way.

WinObjEx64 let you view only named objects. You can use WinObjEx64 to gain a better understanding of how the Object Manager tracks names to system objects.

All named objects in Windows NT can be secured. The security facilities allow the system to selectively grant and deny access to objects. Each object has its own access-control list (ACL) that specifies the actions can be performed on the object. The system examines an object's ACL each time an application creates a handle to the object.

WinObjEx64 let you view and edit object's ACL.


History

v 1.1.0 01 March 2015

▪ added popup menu for Process page
▪ added file properties dialog for Process page
▪ added descriptions for more object types
▪ added named pipes dialog (menu -> extras)
▪ added information for IoCompletion object type, including structured object body dump2
▪ some code revision and corrections

v 1.0.0 23 February 2015

▪ initial release
▪ view area with explorer-like user interface
▪ property dialogs for object types
▪ advanced property dialogs for Device, Driver, Event, Job, Key, Mutant, Section, Semaphore, SymbolicLink, Timer, Type, WindowStation
▪ viewing and editing object-related security information1
▪ object kernel addresses and extended information2
▪ list of processes that have object open3
▪ object body structured dump for Device, Directory, Device Driver, Event, Mutant, Semaphore, Timer, Type2
▪ service registry settings for Driver, including "Jump To Key" feature
▪ find object dialog, about dialog
▪ "Go To Link Target" feature
▪ Desktops list for a selected WindowStation
▪ this help file

Some little amount of original Four-F tool features were considered by us as not useful and/or not appropriate for new OS design and were removed.

The last available WinObjEx from Four-F is v3.2 from 23 September 2005

1) warning, changing kernel object security is a dangerous

2) only with admin priv. and Windows booted in DEBUG mode

3) not all types due to Windows API restrictions


Hot Keys

The following hot keys are supported:

· F1

- Display this help
· F5

- Refresh
· Tab

- Switch between sub-windows
· Enter

- Display object property dialog
· Ctrl+F

- Display find object dialog
· Ctrl+P

- Display named pipes dialog
· Ctrl+->

- Go to symbolic link target
· Esc

- Exit

© 2015 WinObjEx64 Project


License Agreement

WinObjEx64 is freeware. Nobody can sell WinObjEx64 or charge for using WinObjEx64. No part of WinObjEx64 can be included with a commercial package. WinObjEx64 may not be redistributed in any way, or by any means, without the prior written permission of the authors.

WinObjEx64 IS DISTRIBUTED "AS IS". NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE AT YOUR OWN RISK. THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING OR MISUSING THIS SOFTWARE.

WinObjEx64 SOURCE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.


Acknowledgements

We would like to thanks the following people for their contributions (in the alphabetical order):

Andrew Ivlev aka Four-F - author of the original x86-32 WinObjEx

Giuseppe Bonfa aka Evilcry - KDSubmarine author

Mark Russinovich - author of the original proof-of-concept tool WinObj

Microsoft WinDBG developers team

Main program logo icon from http://www.softicons.com/toolbar-icons/free-3d-printer-icons-by-aha-soft

Other icons are from original Four-F WinObjEx


Authors

Copyrights

WinObjEx64 developed by WinObjEx64 Project group, in the alphabetical order:

EP_X0FF

MP_ART

This program uses Windows Debugger Local Kernel Debugging Driver © Microsoft Corporation.