reven2.preview.windows.handle._HandleIndexes

Class built by reversing the function `ExpLookupHandleTableEntry` of the kernel

A handle could be represented like that on Windows 10 x64:

    union {
        struct {
            uint32_t TagBits:2;
            uint32_t LowIdx:8;
            uint32_t MidIdx:9;
            uint32_t HighIdx:9;
        };
        uint32_t Value;
    };

For Windows 10 x86 only the size of the fields are changing.

As all the table arrays are stored on one page only, using 8 bits for the low idx is too much on an x64 system:

• PAGE_SIZE = 0x1000
• HANDLE_ENTRY_SIZE = 0x10
• MAX_LOW_IDX = (1 << 9) - 1 = 0x1FF

We have 0x1FF * 0x10 = 0x1FF0 which is greater than PAGE_SIZE, using only 7 bits to store the low idx is just enough to fit all the possible index of the low table.

The same could be applied to the mid and high index as their tables contains pointers that are half the size of the HANDLE_ENTRY and so need one more bit to fit the maximum possible index.

I don't know why there is this extra bit, maybe for the sign?