Solved

How to enumerate handles owned by process

Posted on 2002-04-09
6
953 Views
Last Modified: 2013-12-03
I want to find out the way how programs like "handle.exe" from http://www.sysinternals.com enumerate handles owned by some process.
Maybe somebody knows which API i should use for it.
0
Comment
Question by:Pavlik
  • 3
  • 2
6 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 6930974
Their book, Inside Microsoft Windows 2000 discusses this:

http://www.sysinternals.com/insidew2k.shtml
0
 
LVL 86

Expert Comment

by:jkr
ID: 6931164
No, this book doesn't - believe me, there is no single line of code in it :o)

You basically have to

void    GetOpenHandleList   (   DWORD   dwPID,  obj_list*   pList)
{

    NTSTATUS                    ntStatus;

    HANDLE                      hObject;
    HANDLE                      hProcess;

    PSYSTEM_HANDLE_INFORMATION  pshi;

    ULONG                       ul  =   0x1000;
    PULONG                      pul =   new ULONG   [   ul];

    hProcess    =   OpenProcess (   PROCESS_DUP_HANDLE, FALSE,  dwPID);

    while   (   STATUS_INFO_LENGTH_MISMATCH ==  ZwQuerySystemInformation    (   SystemHandleInformation,
                                                                                pul,
                                                                                ul  *   sizeof  (   ULONG),
                                                                                0
                                                                            )
            )   delete  []  pul,    pul =   new ULONG   [   ul  *=  2];

    pshi    =   ( PSYSTEM_HANDLE_INFORMATION)   ( pul   +   1);

    for (   ULONG   i   =   0;  i   <   *pul;   i++)
        {
            if  (   pshi    [   i].ProcessId    !=  dwPID)  continue;

            hObject =   NULL;

            ZwDuplicateObject   (   hProcess,
                                    ( HANDLE)   pshi    [   i].Handle,
                                    NtCurrentProcess    (),
                                    &hObject,
                                    0,
                                    0,
                                    DUPLICATE_SAME_ATTRIBUTES
                                );

            if  (   hObject)
                    AppendObjectInformation (   hObject, pList);

        }

    delete  []  pul;
}

0
 
LVL 86

Accepted Solution

by:
jkr earned 200 total points
ID: 6931228
BTW - see also http://www.pearsonptg.com/samplechapter/1578701996.pdf for a documentation of 'ZwQuerySystemInformation()'
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Author Comment

by:Pavlik
ID: 6932259
I've tried to find some information about this but i still don't know where can i get functions like ZwQuerySystemInformation(). Is it in the Platform SDK?
0
 
LVL 86

Expert Comment

by:jkr
ID: 6932302
>>Is it in the Platform SDK?

No - you'll need the DDK from http://www.microsoft.com/hwdev/ddk/

Also note that 'ZwQuerySystemInformation()' is UNDOCUMENTED...
0
 
LVL 1

Author Comment

by:Pavlik
ID: 6932417
Thanks jkr.

I can not check all this stuff right now but looks like i have enough information to do it later.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

A theme is a collection of property settings that allow you to define the look of pages and controls, and then apply the look consistently across pages in an application. Themes can be made up of a set of elements: skins, style sheets, images, and o…
Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now