OBJECT_HEADER_HANDLE_REVOCATION_INFO

The OBJECT_HEADER_HANDLE_REVOCATION_INFO structure, rebadged just as HANDLE_REVOCATION_INFO in the 1607 release of Windows 10, is one of several structures that may precede an OBJECT_HEADER in a memory block that contains an Object Manager object.

That an OBJECT_HEADER_HANDLE_REVOCATION_INFO is present for a given object is indicated by a set 0x40 bit in the InfoMask in the OBJECT_HEADER. How far the one precedes the other depends on which other headers are present, which is in turn indicated by other bits in the InfoMask.

Layout

Whether the structure is named OBJECT_PROCESS_HANDLE_REVOCATION_INFO or just HANDLE_REVOCATION_INFO, it is 0x10 or 0x20 bytes in 32-bit and 64-bit Windows, respectively. Microsoft’s names and types are known from type information in public symbol files for the kernel in the applicable versions.

LIST_ENTRY ListEntry;

OB_HANDLE_REVOCATION_BLOCK *RevocationBlock;

BOOLEAN AllowHandleRevocation;

UCHAR Padding1 [4];

UCHAR Padding1 [3];

UCHAR Padding2 [4];