SYSTEM_OBJECTTYPE_INFORMATION

The SYSTEM_OBJECTTYPE_INFORMATION structure (formally _SYSTEM_OBJECTTYPE_INFORMATION) is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces at the start of its output buffer when given the information class SystemObjectInformation (0x11). The output can, and typically does, continue with multiple structures but at irregular positions since each can be followed by any number of SYSTEM_OBJECT_INFORMATION structures, each followed in turn by a variable-size Unicode string.

Documentation Status

The SYSTEM_OBJECTTYPE_INFORMATION structure is not documented.

Microsoft does publish the practical equivalent of a C-language definition as type information in symbol files—not for the kernel, where the structure is prepared, nor even for low-level user-mode DLLs that interpret the structure, but for a handful of higher-level DLLs that might ordinarily be thought very distant from any involvement with the structure. Perhaps only by oversight, but starting as long ago as Windows 8, Microsoft’s downloadable packages of public symbols have included a smattering of private symbol files and these continue to be available through the public symbol server. Precisely which DLLs have the type information varies between versions. COMBASE.DLL is among the more reliable nowadays. Disclosure in symbol files for URLMON.DLL stopped for the 1803 release of Windows 10 but is specially notable because of this DLL’s origins in Internet Explorer and thence for the strong suggestion that Microsoft’s programmers of Internet Explorer had access to more details of low-level Windows programming than Microsoft publishes for wider use (including by the programmers of competing web browsers).

Type information for the structure has also seeped out at the other end of the Windows timeline, though not in symbol files but in statically linked libraries: GDISRVL.LIB from the Device Driver Kit (DDK) for Windows NT 3.51; and SHELL32.LIB from the DDK for Windows NT 4.0.

Layout

The SYSTEM_OBJECTTYPE_INFORMATION is 0x38 or 0x40 bytes in 32-bit and 64-bit Windows, respectively, except that it is only 0x34 bytes in version 3.10.

ULONG NextEntryOffset;

ULONG NumberOfObjects;

ULONG NumberOfHandles;

ULONG TypeIndex;

ULONG InvalidAttributes;

GENERIC_MAPPING GenericMapping;

ULONG ValidAccessMask;

ULONG PoolType;

BOOLEAN SecurityRequired;

BOOLEAN WaitableObject;

UNICODE_STRING TypeName;

Though WaitableObject is known to be defined at least as far back as version 4.0, it is not known to be set except in version 3.10.