?
Solved

Getting a list of a process' open files.

Posted on 2004-09-20
6
Medium Priority
?
291 Views
Last Modified: 2008-01-09
I've gotten very far with some of the questions other people asked. But I'm having problems. I'm trying to get a list of open files for one process. Once I've opened the process handle, how do I get all of the currently open file handles? And how do I figure out what their file location & name is?
0
Comment
Question by:TheJeffro
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
6 Comments
 
LVL 3

Author Comment

by:TheJeffro
ID: 12118250
Ok, I figured out how to get a list of handles using:
ntdll.dll
NtQuerySystemInformation(16,PtrArray,ArraySize,ArrayRequiredSize) = 0 if successful
16 specifies that you want handles. I run the function twice, once to get the required size. And then again to get the list of handles. The PtrArray is an array of the HandleInformation type. I'm not sure how this type is structured. I know it's a total of 16 bytes. and there's probably 7 different values in it. I'm doing this in VB so I'm looking at someone's Delphi and C++ code trying to figure out the answer.
0
 
LVL 3

Author Comment

by:TheJeffro
ID: 12125666
Ok, now I'm really confused. I don't think the structure is 16 bytes anymore. It seems to generate an error every once in a while. I don't even know if there is a structure or a type. I am unable to recognize the Process ID. I just need to know: Process ID, Handle Type, and Handle. Please help me.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 20

Accepted Solution

by:
Madshi earned 2000 total points
ID: 12126193
The structure looks like this: First in the buffer you'll get 4 bytes which identify the number of handles. After those 4 bytes you'll get all the handles which are open in the whole OS. Each handle entry in the array has 16 bytes:

type
  TNtHandleItem  = packed record
    pid     : cardinal;  // 4 bytes
    objType : word;  // 2 bytes
    handle  : word;  // 2 bytes
    objAddr : pointer;  // 4 bytes
    access  : cardinal;  // 4 bytes
  end;

Let's say the OS has 5 handles open (which is unrealistic low, but anyway), the buffer size should be (4 + 5*16 =) 84.
0
 
LVL 3

Author Comment

by:TheJeffro
ID: 12126448
Thank you soooo much Madshi. You're the man! I guess that 4 bytes at the beginning would explain why my structure size never seemed to work.
0
 
LVL 3

Author Comment

by:TheJeffro
ID: 12128720
Private Declare Function apiNtQuerySystemInformation Lib "ntdll.dll" Alias "NtQuerySystemInformation" (ByVal SystemInformationClass As Long, ByRef SystemInformation As Long, ByVal SystemInformationLength As Long, ByRef ReturnLength As Long) As Long

Public Type HandleInfo
    HI_ProcessID As Long
    HI_ObjType As Integer
    HI_Handle As Integer
    HI_KeyObject As Long
    HI_Access As Long
End Type

Public Function GetHandleTable() As HandleInfo()
    Dim tLen As Long
    Dim tSize As Long
    Dim tBytes() As Byte
    Dim tRetHnd() As HandleInfo
    tSize = 20
    Do While tLen < tSize
        tLen = tSize
        ReDim tBytes(1 To tSize) As Byte
        apiNtQuerySystemInformation 16, ByVal VarPtr(tBytes(1)), tLen, tSize
    Loop
    apiCopyMemory tLen, tBytes(1), 4
    tSize = tSize - 4
    ReDim tRetHnd(1 To tLen) As HandleInfo
    apiCopyMemory tRetHnd(1), tBytes(5), tSize - 4
    GetHandleTable = tRetHnd
End Function
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
This article describes how to use a set of graphical playing cards to create a Draw Poker game in Excel or VB6.
Get people started with the process of using Access VBA to control Excel using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Excel. Using automation, an Access application can laun…
Get people started with the utilization of class modules. Class modules can be a powerful tool in Microsoft Access. They allow you to create self-contained objects that encapsulate functionality. They can easily hide the complexity of a process from…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question