OBJECT_TYPE_INFORMATION - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTOBAPI_H

/**
 * The OBJECT_TYPE_INFORMATION structure contains various statistics and properties about an object type.
 * \remarks The fixed structure occupies 0x68 bytes on x64 and 0x60 bytes on x86, followed by the type name.
 * TypeName.Length excludes the terminating WCHAR; TypeName.MaximumLength includes it.
 * Each structure and its trailing name are rounded up to pointer alignment in ObjectTypesInformation output.
 * On x64, ObQueryTypeInfo does not write the four Total*Usage fields
 * or the four HighWater*Usage fields. Zero-initialize native output buffers, but do not
 * interpret those compatibility fields as measured pool/name/handle-table usage. The
 * WoW64 thunk copies them from an intermediate buffer, so even pre-zeroing the x86
 * caller buffer does not establish meaningful values for these fields.
 */
typedef struct _OBJECT_TYPE_INFORMATION
{
    UNICODE_STRING TypeName;
    ULONG TotalNumberOfObjects;
    ULONG TotalNumberOfHandles;
    ULONG TotalPagedPoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG TotalNonPagedPoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG TotalNamePoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG TotalHandleTableUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG HighWaterNumberOfObjects;
    ULONG HighWaterNumberOfHandles;
    ULONG HighWaterPagedPoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG HighWaterNonPagedPoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG HighWaterNamePoolUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG HighWaterHandleTableUsage; // Compatibility field; may be left unwritten by ObQueryTypeInfo.
    ULONG InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG ValidAccessMask;
    BOOLEAN SecurityRequired;
    BOOLEAN MaintainHandleCount;
    UCHAR TypeIndex; // since WINBLUE
    CHAR ReservedByte; // Alignment padding, explicitly zeroed by ObQueryTypeInfo.
    ULONG PoolType;
    ULONG DefaultPagedPoolCharge;
    ULONG DefaultNonPagedPoolCharge;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;

#endif

View code on GitHub

NtDoc

This structure describes various information about a type of kernel objects. This structure is partially documented in Windows Driver Kit.

Applicable to

Members

TypeName

The string containing the name unique of the type, such as Process or IoCompletion.

TotalNumberOfObjects

The current number of objects of this type.

TotalNumberOfHandles

The current number of handles to objects of this type.

TotalPagedPoolUsage

The total number of paged pool bytes used by objects of this type.

TotalNonPagedPoolUsage

The total number of non-paged pool bytes used by objects of this type.

TotalNamePoolUsage

The total number of name pool bytes used by objects of this type.

TotalHandleTableUsage

The total number of handle table bytes used by objects of this type.

HighWaterNumberOfObjects

The maximum recorded number of objects of this type since boot.

HighWaterNumberOfHandles

The maximum recorded number of handles to objects of this type since boot.

HighWaterPagedPoolUsage

The maximum recorded number of paged pool bytes used by objects of this type.

HighWaterNonPagedPoolUsage

The maximum recorded number of non-paged pool bytes used by objects of this type.

HighWaterNamePoolUsage

The maximum recorded number of name pool bytes used by objects of this type.

HighWaterHandleTableUsage

The maximum recorded number of handle table bytes used by objects of this type.

InvalidAttributes

A bit mask of object/handle attribute flags that are not applicable to objects this type. For the list of values, see OBJECT_ATTRIBUTES.

GenericMapping

A mapping between specific and generic access rights for this type.

ValidAccessMask

A bit mask describing specific and standard access rights that are valid for objects of this type.

SecurityRequired

Whether unnamed objects of this type maintain security descriptors.

MaintainHandleCount

Whether the system should keep track of handles for this type.

TypeIndex

The index of this type in the global list of kernel types. Note that the system only populates this value on Windows 8.1 and above. To infer the value on older OS versions, take the index under which the type appears in the result of ObjectTypesInformation enumeration (made via NtQueryObject) and add 2 to it.

ReservedByte

This field in reserved for future use.

PoolType

The type of memory pool used by this type.

DefaultPagedPoolCharge

The default number of paged pool bytes charged for objects of this type.

DefaultNonPagedPoolCharge

The default number of non-paged pool bytes charged for objects of this type.

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

Documented by

See also

Edit description on GitHub