NtQueryObject

Prototype

NTSTATUS NtQueryObject(
  HANDLE                   Handle,
  OBJECT_INFORMATION_CLASS ObjectInformationClass,
  PVOID                    ObjectInformation,
  ULONG                    ObjectInformationLength,
  PULONG                   ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 10 00 00 00      mov eax, 0x10
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

SSN `0x10` is stable from 1507 through 24H2 — another good hardcode candidate. The four information classes serve very different roles: `ObjectBasicInformation` returns OBJECT_BASIC_INFORMATION with the **HandleCount** and **PointerCount** (used to detect debugger objects), `ObjectNameInformation` returns the device path (e.g. `\Device\HarddiskVolume3\foo`) — the canonical way to convert a file/section/key handle into a path, `ObjectTypeInformation` returns OBJECT_TYPE_INFORMATION for the type of a single handle, and `ObjectTypesInformation` (class 3) returns OBJECT_TYPES_INFORMATION — a packed array describing every object type the kernel knows about. The packed array layout has historically required `ALIGN_UP_BY(p + sizeof(OBJECT_TYPE_INFORMATION_V2) + name.MaximumLength, sizeof(PVOID))` walks; phnt nails the offsets per build.

Common malware usage

Two flagship abuses. **Anti-debugging via ObjectTypesInformation**: walk the type table looking for entry `DebugObject` and inspect its `TotalNumberOfObjects` / `TotalNumberOfHandles` — non-zero values mean someone in the system has an active debug object (a debugger is attached somewhere). This is OS-wide so it also catches sibling-process debuggers. Cheap, exception-free, and harder to lie about than PEB.BeingDebugged. **Handle enumeration for credential access**: post-2022 OPSEC-aware LSASS dumpers (NanoDump, NanoDump-style forks, Dumpert variants) iterate `SystemHandleInformation` from NtQuerySystemInformation, then call NtQueryObject(ObjectTypeInformation) on each handle to skip everything that isn't a Process handle, then NtQueryObject(ObjectBasicInformation) + GrantedAccess to find one already-open LSASS handle with sufficient access — and duplicate that instead of opening LSASS themselves.

Detection opportunities

NtQueryObject(ObjectNameInformation) on file handles is common in legitimate code (Process Explorer, antivirus). The strong signal is **class 3 (ObjectTypesInformation) called from a non-system, non-debugger process** — there is almost no legitimate reason for unprivileged code to enumerate the global type table. EDRs watch for that class number in the hooked stub. Bypassing via direct syscall removes the user-mode trace but leaves ETW Microsoft-Windows-Kernel-Audit-API-Calls visible; vendors also correlate `NtQuerySystemInformation(SystemHandleInformation)` immediately followed by a burst of `NtQueryObject` calls — the canonical handle-table walk fingerprint.

Direct syscall examples

; Direct syscall stub for NtQueryObject (SSN 0x10, all builds)
NtQueryObject PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 10h          ; SSN
    syscall
    ret
NtQueryObject ENDP

// Walk the global object-type table looking for the "DebugObject" entry
// and report its TotalNumberOfObjects. Non-zero = a debugger exists somewhere.
#include <windows.h>
#include <winternl.h>

#define ObjectTypesInformation 3

typedef struct _OBJECT_TYPE_INFORMATION_V2 {
    UNICODE_STRING TypeName;
    ULONG TotalNumberOfObjects;
    ULONG TotalNumberOfHandles;
    ULONG TotalPagedPoolUsage;
    ULONG TotalNonPagedPoolUsage;
    ULONG TotalNamePoolUsage;
    ULONG TotalHandleTableUsage;
    ULONG HighWaterNumberOfObjects;
    // ... truncated for brevity
} OBJECT_TYPE_INFORMATION_V2;

typedef struct _OBJECT_TYPES_INFORMATION {
    ULONG NumberOfTypes;
} OBJECT_TYPES_INFORMATION;

typedef NTSTATUS (NTAPI *pNtQueryObject)(
    HANDLE, ULONG, PVOID, ULONG, PULONG);

BOOL HasDebugObjects(void) {
    pNtQueryObject NtQueryObject = (pNtQueryObject)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtQueryObject");
    ULONG need = 0;
    NtQueryObject(NULL, ObjectTypesInformation, NULL, 0, &need);
    PBYTE buf = (PBYTE)LocalAlloc(LPTR, need + 0x1000);
    if (!NT_SUCCESS(NtQueryObject(NULL, ObjectTypesInformation,
                                  buf, need + 0x1000, &need))) return FALSE;
    // Caller responsibility: walk the packed array with proper alignment.
    // Search for TypeName == L"DebugObject" and read TotalNumberOfObjects.
    LocalFree(buf);
    return TRUE;
}

// Cargo: windows-sys = "0.59", ntapi = "0.4"
use ntapi::ntobapi::{NtQueryObject, ObjectNameInformation};
use windows_sys::Win32::Foundation::HANDLE;

pub unsafe fn handle_to_nt_path(h: HANDLE) -> Option<String> {
    let mut need: u32 = 0;
    let _ = NtQueryObject(h as _, ObjectNameInformation,
                          std::ptr::null_mut(), 0, &mut need);
    let mut buf = vec![0u8; need as usize + 0x100];
    let st = NtQueryObject(h as _, ObjectNameInformation,
                           buf.as_mut_ptr() as _, buf.len() as u32, &mut need);
    if st < 0 { return None; }
    // OBJECT_NAME_INFORMATION: UNICODE_STRING followed by buffer
    let name = &*(buf.as_ptr() as *const ntapi::ntobapi::OBJECT_NAME_INFORMATION);
    let slice = std::slice::from_raw_parts(
        name.Name.Buffer, (name.Name.Length / 2) as usize);
    Some(String::from_utf16_lossy(slice))
}

MITRE ATT&CK mappings

• T1622Debugger Evasionmitre ↗
• T1003.001OS Credential Dumping: LSASS Memorymitre ↗
• T1106Native APImitre ↗