Solved

How to enumerate handles owned by process

Posted on 2002-04-09
6
957 Views
Last Modified: 2013-12-03
I want to find out the way how programs like "handle.exe" from http://www.sysinternals.com enumerate handles owned by some process.
Maybe somebody knows which API i should use for it.
0
Comment
Question by:Pavlik
  • 3
  • 2
6 Comments
 
LVL 32

Expert Comment

by:jhance
ID: 6930974
Their book, Inside Microsoft Windows 2000 discusses this:

http://www.sysinternals.com/insidew2k.shtml
0
 
LVL 86

Expert Comment

by:jkr
ID: 6931164
No, this book doesn't - believe me, there is no single line of code in it :o)

You basically have to

void    GetOpenHandleList   (   DWORD   dwPID,  obj_list*   pList)
{

    NTSTATUS                    ntStatus;

    HANDLE                      hObject;
    HANDLE                      hProcess;

    PSYSTEM_HANDLE_INFORMATION  pshi;

    ULONG                       ul  =   0x1000;
    PULONG                      pul =   new ULONG   [   ul];

    hProcess    =   OpenProcess (   PROCESS_DUP_HANDLE, FALSE,  dwPID);

    while   (   STATUS_INFO_LENGTH_MISMATCH ==  ZwQuerySystemInformation    (   SystemHandleInformation,
                                                                                pul,
                                                                                ul  *   sizeof  (   ULONG),
                                                                                0
                                                                            )
            )   delete  []  pul,    pul =   new ULONG   [   ul  *=  2];

    pshi    =   ( PSYSTEM_HANDLE_INFORMATION)   ( pul   +   1);

    for (   ULONG   i   =   0;  i   <   *pul;   i++)
        {
            if  (   pshi    [   i].ProcessId    !=  dwPID)  continue;

            hObject =   NULL;

            ZwDuplicateObject   (   hProcess,
                                    ( HANDLE)   pshi    [   i].Handle,
                                    NtCurrentProcess    (),
                                    &hObject,
                                    0,
                                    0,
                                    DUPLICATE_SAME_ATTRIBUTES
                                );

            if  (   hObject)
                    AppendObjectInformation (   hObject, pList);

        }

    delete  []  pul;
}

0
 
LVL 86

Accepted Solution

by:
jkr earned 200 total points
ID: 6931228
BTW - see also http://www.pearsonptg.com/samplechapter/1578701996.pdf for a documentation of 'ZwQuerySystemInformation()'
0
Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

 
LVL 1

Author Comment

by:Pavlik
ID: 6932259
I've tried to find some information about this but i still don't know where can i get functions like ZwQuerySystemInformation(). Is it in the Platform SDK?
0
 
LVL 86

Expert Comment

by:jkr
ID: 6932302
>>Is it in the Platform SDK?

No - you'll need the DDK from http://www.microsoft.com/hwdev/ddk/ 

Also note that 'ZwQuerySystemInformation()' is UNDOCUMENTED...
0
 
LVL 1

Author Comment

by:Pavlik
ID: 6932417
Thanks jkr.

I can not check all this stuff right now but looks like i have enough information to do it later.
0

Featured Post

Live: Real-Time Solutions, Start Here

Receive instant 1:1 support from technology experts, using our real-time conversation and whiteboard interface. Your first 5 minutes are always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have ever found yourself doing a repetitive action with the mouse and keyboard, and if you have even a little programming experience, there is a good chance that you can use a text editor to whip together a sort of macro to automate the proce…
What my article will show is if you ever had to do processing to a listbox without being able to just select all the items in it. My software Visual Studio 2008 crystal report v11 My issue was I wanted to add crystal report to a form and show…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now