Handle reference count doesn't make much sense

[alabuzhev]

Brief description of your issue

In Handle properties window there's a "References" section with "References" and "Handles". "Handles" looks good, but "References" usually contains some large number that doesn't make much sense, like 32763 or 65520 or 11863049.

The number, however, is usually oddly close to a multiple of 32768 and the multiplier is usually oddly close to Handles:

11863049 / 32768 = 362 ≈ 365

Which suggests that reference count isn't really just a number and should be treated specially to be human-readable.

There's an article by Alex Ionescu from 2014, explaining what is going on: https://www.alex-ionescu.com/the-case-of-the-bloated-reference-count-handle-table-entry-changes-in-windows-8-1/

Windows 8.1 not only introduces a major rewrite to the handle table entry format but also makes these seemingly internal data structure changes to have a visible side effect when using the Windows Debugger or other tools to analyze reference counts on objects

• Each time a new handle is opened to an object, the reference count goes up by 0x7FFF, or 32767, on x64 Windows. On x86 Windows, the same behavior is seen by the way, but with 0x1F instead.
• Each time an existing handle to an object is used, the reference count goes down by 1.

Perhaps it would make sense to:

• Decode the value before showing it to the user: https://github.com/winsiderss/systeminformer/blob/57a30b1aa111c4e595522e0bffc271d7f92d7466/SystemInformer/hndlprp.c#L783
• Update the manual adjustments that are likely incorrect now: https://github.com/winsiderss/systeminformer/blob/57a30b1aa111c4e595522e0bffc271d7f92d7466/phlib/hndlinfo.c#L151-L153 https://github.com/winsiderss/systeminformer/blob/57a30b1aa111c4e595522e0bffc271d7f92d7466/phlib/hndlinfo.c#L170-L173

Other related sources: https://community.osr.com/t/pointer-count-increased-0x8000-when-zwopenprocess-called/52999 https://ntamonsec.blogspot.com/2020/06/journey-into-object-manager-executive-handles.html https://bsodtutorials.wordpress.com/2022/01/24/object-headers-handles-and-types/ https://www.google.com/search?q="PointerCount"+0x7FFF

Steps to reproduce (optional)

Open SI Open properties of any readable process Go to Handles tab Open properties of any readable handle Inspect the References section

Expected behavior (optional)

References should be some reasonable number, not tens or hundreds of thousands.

Actual behavior (optional)

No response

Environment (optional)

No response

[jxy-s]

I'll check the code when I'm able. But I suspect we're showing the pointer count and not the true reference, as you've pointed out.