ObpIsKernelHandle
UINT8 __stdcall ObpIsKernelHandle(PVOID Handle, INT8 AccessMode){
return !AccessMode
&& ((unsigned __int64)Handle & 0xFFFFFFFF80000000ui64) == 0xFFFFFFFF80000000ui64
&& (unsigned __int64)Handle <= 0xFFFFFFFFFFFFFFFDui64;
}Referenced by:
NtClose
ObCloseHandle
ObIsKernelHandle
ObQueryObjectAuditingByHandle
ObSetHandleAttributes
ObWaitForMultipleObjects
ObpCloseHandle
SeAdtRegistryValueChangedAuditAlarm
SeAuditHandleDuplication
SeOperationAuditAlarm
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent