Difference between the kernel object and user object

Question

How to recognize the difference between the kernel object and user object?

 

Answer 1

The easiest way to find out whether an object is a kernel object is to study the function that creates the object. Almost all of the functions that create kernel objects have parameter which allows you to indicate security attribute information.