Overview

WinObjEx - Windows Object Explorer

WinObjEx is an advanced utility that lets you explore the Windows Object Manager namespace. For certain object types, you can double-click on it or use the "Properties..." toolbar button to get more information, such as description, attributes, resource usage etc. WinObjEx let you view and edit object-related security information if you have required access rights.

WinObjEx does not require administrative privileges and can be run from any account. However administrative privilege is required to view much of the namespace and to edit object-related security information.

WinObjEx works on Windows 2000, Windows XP, and Server 2003 (NT 4.0 support will be added in some future releases).

WinObjEx does not work on Windows 95/98/Me

Copyright © 2003-2005 Andrew Ivlev (aka Four-F), four-f@mail.ru


About Objects

The Microsoft® Windows® executive is object-based. Directories, symbolic links, devices, synchronization mechanisms, jobs, and so on, are all represented as objects in kernel mode. Objects are manipulated by the Object Manager, which is a subsystem of the executive. The Object Manager uses objects to regulate access to system resources. The use of objects ensures that system functionality can be updated, as long as the original object interface is maintained.

Note that Windows kernel-mode objects have no relation to COM objects, or objects in C++ or any other object-oriented programming language.

Kernel-mode objects are either named or unnamed. The Object Manager namespace is a global one. Both user-mode and kernel-mode components use the object name to refer to the object.

Named objects are organized into a hierarchy. Only some types of objects can have child objects. These objects are container objects. For example, an object directory is a named object that is used solely to contain other named objects. Each object is named relative to a parent object. Each component of the object's name begins with a backslash character. For example, \Device is the object directory containing the named device objects and is the parent object for \Device\NamedPipe. Object directories do not correspond to actual directories on a disk, by the way.

WinObjEx let you view only named objects. You can use WinObjEx to gain a better understanding of how the Object Manager tracks names to system objects.

All named objects in Windows NT can be secured. The security facilities allow the system to selectively grant and deny access to objects. Each object has its own access-control list (ACL) that specifies the actions can be performed on the object. The system examines an object's ACL each time an application creates a handle to the object.

WinObjEx let you view and edit object's ACL.


History

v3.2 23 September 2005

  • some improvements were made and some bugs were fixed

v3.1 15 Januar 2005

  • XP SP2 support added

v3.0 15 December 2004

  • helper kernel module added
  • advanced property dialog for Driver
  • service registry settings for Driver
  • advanced property dialog for Device
  • object body structured dump for Device, Directory, Driver, Event, Mutant, Semaphore, Timer
  • Desktops extra list
  • advanced property dialog for Desktop
  • list of threads waiting for Event, Mutex, Semaphore, Timer
  • Mutex owner info
  • list-view and tree-list tool-tips
  • modern menu (thanks to Chib and Alexm)
  • some bugs were fixed

v2.2 11 July 2004

  • find object dialog
  • "Go To Link Target" feature
  • ability to close object handle

v2.1 05 May 2004

  • property dialog for Port
  • additional info for WindowStation
  • object kernel address
  • list of processes that have object open
  • ability to run as LocalSystem account
    (specify the -s option as a command-line argument)

v2.0 09 April 2004

  • source code ported from assembler to C
  • menu, toolbar & about dialog
  • help
  • advanced property dialog for Device, Directory, Event,
    EventPair, IoCompletion, Job, Key, Mutant, Section,
    Semaphore, SymbolicLink, Timer, Type, WindowStation
  • additional info for Device, DLL, Driver
  • Keep Sorting & Keep Selection feature
  • Pipes & Mailslots extra list
  • Pipe property dialog
  • viewing and editing object-related security information

v1.0 09 September 2003

  • view area with explorer-like user interface
  • property dialog for Directory, Event, Key, Mutant,
    Section, Semaphore, SymbolicLink, Timer

Copyright © 2003-2005 Andrew Ivlev (aka Four-F), four-f@mail.ru


Hot Keys

The following hot keys are supported:
F1 | - Display this help
F5 | - Refresh
Tab | - Switch between sub-windows
Enter | - Display object property dialog
Ctrl+K | - Display desktops dialog
Ctrl+P | - Display named pipes dialog
Ctrl+M | - Display mailslots dialog
Ctrl+F | - Display find object dialog
Ctrl+-> | - Go to symbolic link target
Esc | - Exit


License Agreement

WinObjEx is freeware. Nobody can sell WinObjEx or charge for using WinObjEx. No part of WinObjEx can be included with a commercial package. WinObjEx may not be redistributed in any way, or by any means, without the prior written permission of the author.

WinObjEx IS DISTRIBUTED "AS IS". NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE AT YOUR OWN RISK. THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS, DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING OR MISUSING THIS SOFTWARE.


Bug Report

If you encounter a bug while using WinObjEx please feel free to send a bug report to four-f@mail.ru with the information about your operating system version. Any improvements and suggestions are also welcomed.