Mutex Operations
NtCreateMutant
Creates a mutex object.Receives a handle to the mutex
Desired access rights
Object attributes including name
Whether the calling thread should own the mutex
- Mutex name
- Operation success status
- Object names are virtualized to prevent conflicts between analysis sessions
- If mutex already exists with original name (system mutex), passes through unchanged
- Otherwise, name is redirected to virtualized namespace
NtOpenMutant
Opens an existing mutex object.Receives a handle to the mutex
Desired access rights
Object attributes identifying the mutex
- Mutex name
- Operation success status
- Checks if mutex exists with original name first
- If not found, redirects to virtualized name
Semaphore Operations
NtCreateSemaphore
Creates a semaphore object.Receives a handle to the semaphore
Desired access rights
Object attributes including name
Initial count for the semaphore
Maximum count for the semaphore
- Semaphore name
- Operation success status
- Object names are virtualized
- System semaphores (already existing) pass through unchanged
NtOpenSemaphore
Opens an existing semaphore object.Receives a handle to the semaphore
Desired access rights
Object attributes identifying the semaphore
- Semaphore name
- Operation success status
Event Operations
NtCreateEvent
Creates an event object.Receives a handle to the event
Desired access rights
Object attributes including name
Type of event (NotificationEvent or SynchronizationEvent)
Initial state of the event (signaled or not)
- Event name
- Operation success status
- Object names are virtualized
- System events (already existing) pass through unchanged
NtOpenEvent
Opens an existing event object.Receives a handle to the event
Desired access rights
Object attributes identifying the event
- Event name
- Operation success status
Mailslot Operations
NtCreateMailslotFile
Creates a mailslot.Receives a handle to the mailslot
Desired access rights
Object attributes including mailslot name
Receives I/O status information
Options for creating the mailslot
Maximum size of messages
Maximum size of a single message
Read timeout for the mailslot
- Mailslot name
- Operation success status
- Object names are virtualized
Wait Operations
NtWaitForSingleObject
Waits for an object to enter the signaled state.Handle to the object to wait on
Whether the wait is alertable
Optional timeout value
Object Queries
NtQueryObject
Retrieves information about an object.Handle to the object
Type of information to retrieve
Buffer to receive the information
Size of the buffer
Receives the size of data returned
- For ObjectNameInformation on file handles, virtual filesystem paths are converted back to original paths
- Ensures analyzed binaries see expected file paths
Object Virtualization
All named kernel objects (mutexes, semaphores, events, mailslots) are virtualized by Dr.Semu:- Name Redirection: Object names are prefixed with a session-specific identifier
- System Object Preservation: Objects that already exist with the original name (system objects) are not redirected
- Session Isolation: Different analysis sessions can create objects with the same names without conflicts