Solved

How to enumerate handles owned by process

Posted on 2002-04-09
6
955 Views
Last Modified: 2013-12-03
I want to find out the way how programs like "handle.exe" from http://www.sysinternals.com enumerate handles owned by some process.
Maybe somebody knows which API i should use for it.
0
Comment
Question by:Pavlik
  • 3
  • 2
6 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 6930974
Their book, Inside Microsoft Windows 2000 discusses this:

http://www.sysinternals.com/insidew2k.shtml
0
 
LVL 86

Expert Comment

by:jkr
ID: 6931164
No, this book doesn't - believe me, there is no single line of code in it :o)

You basically have to

void    GetOpenHandleList   (   DWORD   dwPID,  obj_list*   pList)
{

    NTSTATUS                    ntStatus;

    HANDLE                      hObject;
    HANDLE                      hProcess;

    PSYSTEM_HANDLE_INFORMATION  pshi;

    ULONG                       ul  =   0x1000;
    PULONG                      pul =   new ULONG   [   ul];

    hProcess    =   OpenProcess (   PROCESS_DUP_HANDLE, FALSE,  dwPID);

    while   (   STATUS_INFO_LENGTH_MISMATCH ==  ZwQuerySystemInformation    (   SystemHandleInformation,
                                                                                pul,
                                                                                ul  *   sizeof  (   ULONG),
                                                                                0
                                                                            )
            )   delete  []  pul,    pul =   new ULONG   [   ul  *=  2];

    pshi    =   ( PSYSTEM_HANDLE_INFORMATION)   ( pul   +   1);

    for (   ULONG   i   =   0;  i   <   *pul;   i++)
        {
            if  (   pshi    [   i].ProcessId    !=  dwPID)  continue;

            hObject =   NULL;

            ZwDuplicateObject   (   hProcess,
                                    ( HANDLE)   pshi    [   i].Handle,
                                    NtCurrentProcess    (),
                                    &hObject,
                                    0,
                                    0,
                                    DUPLICATE_SAME_ATTRIBUTES
                                );

            if  (   hObject)
                    AppendObjectInformation (   hObject, pList);

        }

    delete  []  pul;
}

0
 
LVL 86

Accepted Solution

by:
jkr earned 200 total points
ID: 6931228
BTW - see also http://www.pearsonptg.com/samplechapter/1578701996.pdf for a documentation of 'ZwQuerySystemInformation()'
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 1

Author Comment

by:Pavlik
ID: 6932259
I've tried to find some information about this but i still don't know where can i get functions like ZwQuerySystemInformation(). Is it in the Platform SDK?
0
 
LVL 86

Expert Comment

by:jkr
ID: 6932302
>>Is it in the Platform SDK?

No - you'll need the DDK from http://www.microsoft.com/hwdev/ddk/ 

Also note that 'ZwQuerySystemInformation()' is UNDOCUMENTED...
0
 
LVL 1

Author Comment

by:Pavlik
ID: 6932417
Thanks jkr.

I can not check all this stuff right now but looks like i have enough information to do it later.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial is about how to put some of your C++ program's functionality into a standard DLL, and how to make working with the EXE and the DLL simple and seamless.   We'll be using Microsoft Visual Studio 2008 and we will cut out the noise; that i…
In this article, I will show how to use the Ribbon IDs Tool Window to assign the built-in Office icons to a ribbon button.  This tool will help us to find the OfficeImageId that corresponds to our desired built-in Office icon. The tool is part of…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now