OBJECT_DIRECTORY_ENTRY

The OBJECT_DIRECTORY_ENTRY structure (formally _OBJECT_DIRECTORY_ENTRY) is a directory object’s record of an object’s presence in the directory.

Variability

The OBJECT_DIRECTORY_ENTRY is highly susceptible to changing between builds. The following changes of size give some rough indication:

Layout

The sizes in the preceding table and the offsets, names and types in the next are from type information in public symbol files for the kernel.

OBJECT_DIRECTORY_ENTRY *ChainLink;

PVOID Object;

ULONG HashValue;

The ChainLink, if not NULL, points to the entry for another object whose name within the directory has the same hash index. Through the whole history of Windows (so far), the hash index is the remainder from dividing the HashValue by 37, this being the number of separate chains that start in the OBJECT_DIRECTORY structure’s array of HashBuckets. For the first decade, however, the quotient from this division was discarded. Apparently it was not until the development of 64-bit Windows that MIcrosoft realised (or got round to acting on the obvious) that searching any one chain would be faster if the different hash values for different names were retained.