Learning Malware Analysis

4.2.2 Understanding Pool Tag Scanning

If you recall, I previously referred to system resources such as processes, files, threads, and so on, as objects (or executive objects). The executive objects are managed by a component of a kernel called the object manager. Every executive object has a structure associated with it (such as _EPROCESS for process object). The executive object structure is preceded by a _OBJECT_HEADER structure, which contains information about an object's type and some reference counters. The _OBJECT_HEADER is then preceded by zero or more optional headers. In other words, you can think of an object as the combination of executive object structure, the object header, and the optional headers, as shown in the following ...