In Win32 we create many objects – Windows, File, Threads, process,Semaphore, Event, Pen, Brush, etc. Some of the above are kernal objects while others are not. This tip is an intuitive way to tell whether an object is a kernal object or not.

Look at the arguments of the function that creates that object. If the function takes SECURITY_ATTRIBUTES as an argument, then that object is a kernal object.

For example, following are kernal objects:

 HANDLE CreateThread( LPSECURITY_ATTRIBUTES lpThreadAttributes,  ...)HANDLE CreateSemaphore(LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, ..)

The following are not kernal objects:

 HWND CreateWindow(LPCTSTR lpClassName, ..)HPEN CreatePen(int fnPenStyle, ...)