How does handle enumeration for EVT logs differ between Windows XP and Windows 8+?

Question

Onedaysec · Accepted Answer

On Windows XP, you cannot use NtQuerySystemInformation with SystemHandleInformation; instead you must use SystemExtendedHandleInformation (supported from XP onward). The object type number for file handles is 0x1c on XP and Windows 7, but 0x1e on Windows 8+. Additionally, you must filter out handles that may cause hangs by calling WaitForSingleObject before duplicating. For the newer OS approach, see [Windows XML Event Log (EVTX) Single Log Entry Deletion (Part 5)](/news/windows-xml-event-log-evtx-single-log-entry-deletion-part-5-deleting-a-single-log-entry-from-the-current-system-by-obtaining-log-file-handle-via-duplicatehandle).