• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 967
  • Last Modified:

How to enumerate handles owned by process

I want to find out the way how programs like "handle.exe" from http://www.sysinternals.com enumerate handles owned by some process.
Maybe somebody knows which API i should use for it.
0
Pavlik
Asked:
Pavlik
  • 3
  • 2
1 Solution
 
jhanceCommented:
Their book, Inside Microsoft Windows 2000 discusses this:

http://www.sysinternals.com/insidew2k.shtml
0
 
jkrCommented:
No, this book doesn't - believe me, there is no single line of code in it :o)

You basically have to

void    GetOpenHandleList   (   DWORD   dwPID,  obj_list*   pList)
{

    NTSTATUS                    ntStatus;

    HANDLE                      hObject;
    HANDLE                      hProcess;

    PSYSTEM_HANDLE_INFORMATION  pshi;

    ULONG                       ul  =   0x1000;
    PULONG                      pul =   new ULONG   [   ul];

    hProcess    =   OpenProcess (   PROCESS_DUP_HANDLE, FALSE,  dwPID);

    while   (   STATUS_INFO_LENGTH_MISMATCH ==  ZwQuerySystemInformation    (   SystemHandleInformation,
                                                                                pul,
                                                                                ul  *   sizeof  (   ULONG),
                                                                                0
                                                                            )
            )   delete  []  pul,    pul =   new ULONG   [   ul  *=  2];

    pshi    =   ( PSYSTEM_HANDLE_INFORMATION)   ( pul   +   1);

    for (   ULONG   i   =   0;  i   <   *pul;   i++)
        {
            if  (   pshi    [   i].ProcessId    !=  dwPID)  continue;

            hObject =   NULL;

            ZwDuplicateObject   (   hProcess,
                                    ( HANDLE)   pshi    [   i].Handle,
                                    NtCurrentProcess    (),
                                    &hObject,
                                    0,
                                    0,
                                    DUPLICATE_SAME_ATTRIBUTES
                                );

            if  (   hObject)
                    AppendObjectInformation (   hObject, pList);

        }

    delete  []  pul;
}

0
 
jkrCommented:
BTW - see also http://www.pearsonptg.com/samplechapter/1578701996.pdf for a documentation of 'ZwQuerySystemInformation()'
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
PavlikAuthor Commented:
I've tried to find some information about this but i still don't know where can i get functions like ZwQuerySystemInformation(). Is it in the Platform SDK?
0
 
jkrCommented:
>>Is it in the Platform SDK?

No - you'll need the DDK from http://www.microsoft.com/hwdev/ddk/ 

Also note that 'ZwQuerySystemInformation()' is UNDOCUMENTED...
0
 
PavlikAuthor Commented:
Thanks jkr.

I can not check all this stuff right now but looks like i have enough information to do it later.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now