OBJECT_HANDLE_FLAG_INFORMATION

The OBJECT_HANDLE_FLAG_INFORMATION structure is what a successful call to ZwQueryObject or NtQueryObject produces in its output buffer when given the information class ObjectHandleFlagInformation (3). The information so obtained is not directly about the object that is referenced by the Handle argument, but about the handle’s reference to the object.

The structure can also be provided as input to the ZwSetInformationObject or NtSetInformationObject functions, again with ObjectHandleFlagInformation as the information class.

Documentation Status

The OBJECT_HANDLE_FLAG_INFORMATION structure is not documented.

Microsoft does publish the practical equivalent of a C-language definition as type information in public symbol files, though not for the kernel, where the structure is prepared, nor even for low-level user-mode DLLs that interpret the structure, but for various higher-level user-mode DLLs such as URLMON.DLL and only then starting with version 6.2.

Two earlier disclosures of type information are known, though not in symbol files but in statically linked libraries: GDISRVL.LIB from the Device Driver Kit (DDK) for Windows NT 3.51; and SHELL32.LIB from the DDK for Windows NT 4.0.

Layout

The OBJECT_HANDLE_FLAG_INFORMATION is two bytes in both 32-bit and 64-bit Windows.

Offset Definition Versions
0x00
BOOLEAN Inherit;
3.50 and higher
0x01
BOOLEAN ProtectFromClose;
3.50 and higher