Kernel Objects

Kernel object handles are process specific. That is, a process must either create the object or open an existing object to obtain a kernel object handle. The per-process limit on kernel handles is 2^24. However, handles are stored in the paged pool, so the actual number of handles you can create is based on available memory. The number of handles that you can create on 32-bit Windows is significantly lower than 2^24.

Any process can create a new handle to an existing kernel object (even one created by another process), provided that the process knows the name of the object and has security access to the object. Kernel object handles include access rights that indicate the actions that can be granted or denied to a process. An application specifies access rights when it creates an object or obtains an existing object handle. Each type of kernel object supports its own set of access rights. For example, event handles can have set or wait access (or both), file handles can have read or write access (or both), and so on. For more information, see Securable Objects.

In the following illustration, an application creates an event object. The CreateEvent function creates the event object and returns an object handle.

application creating an event object

After the event object has been created, the application can use the event handle to set or wait on the event. The handle remains valid until the application closes the handle or terminates.

Most kernel objects support multiple handles to a single object. For example, the application in the preceding illustration could obtain additional event object handles by using the OpenEvent function, as shown in the following illustration.

application creating an event object with multiple handles

This method enables an application to have handles with different access rights. For example, Handle 1 might have set and wait access to the event, and Handle 2 might have only wait access.

If another process knows the event name and has security access to the object, it can create its own event object handle by using OpenEvent. The creating application could also duplicate one of its handles into the same process or into another process by using the DuplicateHandle function.

An object remains in memory as long as at least one object handle exists. In the following illustration, the applications use the CloseHandle function to close their event object handles. When there are no event handles, the system removes the object from memory, as shown in the following illustration.

application closing event object handles to remove object from memory

The system manages file objects somewhat differently from other kernel objects. File objects contain the file pointer — the pointer to the next byte to be read or written in a file. Whenever an application creates a new file handle, the system creates a new file object. Therefore, more than one file object can refer to a single file on disk, as shown in the next illustration.

multiple file objects referring to a file on disk

Only through duplication or inheritance can more than one file handle refer to the same file object, as shown in the following illustration.

two file handles refer to same file object

The following table lists each of the kernel objects, along with each object's creator and destroyer functions. The creator functions either create the object and an object handle or create a new existing object handle. The destroyer functions close the object handle. When an application closes the last handle to a kernel object, the system removes the object from memory.

Kernel object Creator function Destroyer function
Access token CreateRestrictedToken, DuplicateToken, DuplicateTokenEx, OpenProcessToken, OpenThreadToken CloseHandle
Change notification FindFirstChangeNotification FindCloseChangeNotification
Communications device CreateFile CloseHandle
Console input CreateFile, with CONIN$ CloseHandle
Console screen buffer CreateFile, with CONOUT$ CloseHandle
Desktop GetThreadDesktop Applications cannot delete this object.
Event CreateEvent, CreateEventEx, OpenEvent CloseHandle
Event log OpenEventLog, RegisterEventSource, OpenBackupEventLog CloseEventLog
File CreateFile CloseHandle, DeleteFile
File mapping CreateFileMapping, OpenFileMapping CloseHandle
Find file FindFirstFile FindClose
Heap HeapCreate HeapDestroy
I/O completion port CreateIoCompletionPort CloseHandle
Job CreateJobObject CloseHandle
Mailslot CreateMailslot CloseHandle
Memory resource notification CreateMemoryResourceNotification CloseHandle
Module LoadLibrary, GetModuleHandle FreeLibrary
Mutex CreateMutex, CreateMutexEx, OpenMutex CloseHandle
Pipe CreateNamedPipe, CreatePipe CloseHandle, DisconnectNamedPipe
Process CreateProcess, OpenProcess, GetCurrentProcess CloseHandle, TerminateProcess
Semaphore CreateSemaphore, CreateSemaphoreEx, OpenSemaphore CloseHandle
Socket socket, accept closesocket
Thread CreateThread, CreateRemoteThread, GetCurrentThread CloseHandle, TerminateThread
Timer CreateWaitableTimer, CreateWaitableTimerEx, OpenWaitableTimer CloseHandle
Update resource BeginUpdateResource EndUpdateResource
Window station GetProcessWindowStation Applications cannot delete this object.


Kernel Object Namespaces