What is this `ConsoleHandle` HANDLE in my PEB?

308 views Asked by At

I'm digging around in my process's PEB and I came across the so-called ConsoleHandle HANDLE in the nested RTL_USER_PROCESS_PARAMETERS struct. So far, I've compared this HANDLE to the standard input, output, and error HANDLEs and the console HWND. It matches none of them and I'm at a loss for what this HANDLE is or represents.

I've also stumbled upon the fact that all these handles (minus the HWND) point to \Devices\ConDrv, so I'm also befuddled as to why CompareObjectHandles() only returns true for the pair of stdout and stderr. This makes intuitive sense from my normal understanding but now that I've found out about \Devices\ConDrv being the true backing kernel object for all these HANDLEs, I'm left wondering why this function doesn't return true in more cases.

  1. What is this unknown ConsoleHandle HANDLE? Is it the default console screen buffer? In particular, what functions can be called with this HANDLE as a parameter?
  2. If stdin, stdout, stderr, and this unknown ConsoleHandle HANDLE are all backed by \Devices\ConDrv, how come CompareObjectHandles() doesn't return true for any pairing of them? Any insight from kernel-land would be appreciated.
0

There are 0 answers