OBJECT_HEADER_AUDIT_INFO

The OBJECT_HEADER_AUDIT_INFO structure is one of several structures that may precede an OBJECT_HEADER in a memory block that contains an Object Manager object.

That an OBJECT_HEADER_AUDIT_INFO is present for a given object is indicated by a set 0x20 bit in the InfoMask in the OBJECT_HEADER. How far the one precedes the other depends on which other headers are present, which is in turn indicated by other bits in the InfoMask.

Layout

The OBJECT_PROCESS_AUDIT_INFO structure is 0x08 or 0x10 bytes in 32-bit and 64-bit Windows, respectively. Microsoft’s names and types are known from type information in public symbol files for the kernel in the applicable versions.

PVOID SecurityDescriptor;

ULONG_PTR Reserved;