Also !ustr will give you nicer output for a UNICODE_STRING, assuming the structure isn’t corrupted (which is a bigger problem!)

–
Best regards,
Alex Ionescu

Also, your calculation is slightly incorrect:

- First, the mid-level table has enough to store a “full page’s worth of pointers”, quoting from the book. PAGE_SIZE / 4 (for x86) is 1024 entries, not 512.
- Secondly, in order to maintain compatibility with Windows 2000, the amount of high-level tables is artificially constricted to the minimum required to describe Windows 2000’s limit (256^3 ~ 16 million) based on the amount of handles described by mid and low level tables on the system. In this case, for x86, that number would be 32.

You can use the following definitions for a more “abstract” understanding:

#define LOW_LEVEL_ENTRIES (PAGE_SIZE / sizeof(HANDLE_TABLE_ENTRY))
#define MID_LEVEL_ENTRIES (PAGE_SIZE / sizeof(PHANDLE_TABLE_ENTRY))
#define HIGH_LEVEL_ENTRIES (16777216 / (LOW_LEVEL_ENTRIES * MID_LEVEL_ENTRIES))

Regarding point #2, the book is unclear about this fact, and I will make sure that it is updated for the next edition — nowhere is it explained why the limit is still 16 million even though theoretically, x86 could have much larger handle values.

–
Best regards,
Alex Ionescu