• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 775
  • Last Modified:

How do i know what process owns the serial port without using file handle

Hi,

I'd like to know if there is a way to detect a process that owns the serial port, i.e., communicating using serial comm, without going through the way to find the file handle.

thanks
0
mycuti08
Asked:
mycuti08
  • 2
1 Solution
 
jkrCommented:
You'll need to go through the system's open handle table and look for the name of the COM port, e.g. as in teh following snippet (code taken from Gary Nebbett's "Native API Reference"). You will need the DDK (downloadable from http://www.microsoft.com/whdc/resources/downloads.mspx) to build that code.
#include <windows.h>
 
namespace NT
{
extern "C"
    {
#pragma warning (   disable:    4005)
        #include <basetsd.h>
        #include <ntdef.h>
        #include <ntstatus.h>
        #include <wdm.h>
#pragma warning (   default:    4005)
    }
 
 
 
extern "C"
NTSTATUS
__stdcall
ZwOpenDirectoryObject   (   PHANDLE,
                            ACCESS_MASK,
                            NT::POBJECT_ATTRIBUTES
                        );
extern "C"
NTSTATUS
__stdcall
ZwQueryDirectoryObject  (   HANDLE,
                            PVOID,
                            ULONG,
                            BOOLEAN,
                            BOOLEAN,
                            PULONG,
                            PULONG
                        );
 
typedef struct _DIRECTORY_BASIC_INFORMATION
{
  UNICODE_STRING    ObjectName;
  UNICODE_STRING    ObjectTypeName;
 
} DIRECTORY_BASIC_INFORMATION, *PDIRECTORY_BASIC_INFORMATION;
 
typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemHandleInformation = 16,
 
} SYSTEM_INFORMATION_CLASS;
 
typedef struct  _SYSTEM_HANDLE_INFORMATION
{
    ULONG       ProcessId;
    UCHAR       ObjectTypeNumber;
    UCHAR       Flags;
    USHORT      Handle;
    PVOID       Object;
    ACCESS_MASK GrantedAccess;
 
}   SYSTEM_HANDLE_INFORMATION,  *PSYSTEM_HANDLE_INFORMATION;
 
typedef enum _OBJECT_INFORMATION_CLASS
{
    ObjectBasicInformation,
    ObjectNameInformation,
    ObjectTypeInformation,
    ObjectAllTypesInformation,
    ObjectHandleInformation
}   OBJECT_INFORMATION_CLASS;
 
typedef struct  _OBJECT_BASIC_INFORMATION
{
    ULONG           Attributes;
    ACCESS_MASK     GrantedAccess;
    ULONG           HandleCount;
    ULONG           PointerCount;
    ULONG           PagedPoolUsage;
    ULONG           NonPagedPoolUsage;
    ULONG           Reserved    [   3];
    ULONG           NameInformationLength;
    ULONG           TypeInformationLength;
    ULONG           SecurityDescriptorLength;
    LARGE_INTEGER   CreateTime;
 
}   OBJECT_BASIC_INFORMATION,   *POBJECT_BASIC_INFORMATION;
 
 
typedef struct  _OBJECT_TYPE_INFORMATION
{
    UNICODE_STRING  Name;
    ULONG           ObjectCount;
    ULONG           HandleCount;
    ULONG           Reserved1   [   4];
    ULONG           PeakObjectCount;
    ULONG           PeakHandleCount;
    ULONG           Reserved2   [   4];
    ULONG           InvalidAttributes;
    GENERIC_MAPPING GenericMapping;
    ULONG           ValidAccess;
    UCHAR           Unknown;
    BOOLEAN         MaintainHandleDatabase;
    NT::POOL_TYPE   PoolType;
    ULONG           PagedPoolUsage;
    ULONG           NonPagedPoolUsage;
 
}   OBJECT_TYPE_INFORMATION,    *POBJECT_TYPE_INFORMATION;
 
 
extern "C"
NTSTATUS
__stdcall
ZwQuerySystemInformation    (   SYSTEM_INFORMATION_CLASS,
                                PVOID,
                                ULONG,
                                PULONG
                            );
 
extern "C"
NTSTATUS
__stdcall
ZwQueryObject               (   HANDLE,
                                OBJECT_INFORMATION_CLASS,
                                PVOID,
                                ULONG,
                                PULONG
                            );
 
 
extern "C"
NTSTATUS
__stdcall
ZwDuplicateObject           (   HANDLE,
                                HANDLE,
                                HANDLE,
                                PHANDLE,
                                ACCESS_MASK,
                                ULONG,
                                ULONG
                            );
 
}; // namespace
 
using NT::NTSTATUS;
using NT::UNICODE_STRING;
using NT::PUNICODE_STRING;
using NT::OBJECT_ATTRIBUTES;
 
#include <stdlib.h>
#include <stdio.h>
 
 
#define DUPLICATE_SAME_ATTRIBUTES   0x00000004
 
#define NtCurrentProcess() ( (HANDLE) -1 )
 
#pragma comment(lib,"ntdll.lib")
#pragma comment(lib,"advapi32.lib")
 
BOOL EnablePrivilege(PCSTR name)
{
    TOKEN_PRIVILEGES priv = {1, {0, 0, SE_PRIVILEGE_ENABLED}};
    LookupPrivilegeValue(0, name, &priv.Privileges[0].Luid);
 
    HANDLE hToken;
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
 
    AdjustTokenPrivileges(hToken, FALSE, &priv, sizeof priv, 0, 0);
    BOOL rv = GetLastError() == ERROR_SUCCESS;
 
    CloseHandle(hToken);
    return rv;
}
 
int main(int argc, char *argv[])
{
    if (argc == 1) return 0;
 
    ULONG pid = strtoul(argv[1], 0, 0);
 
    EnablePrivilege(SE_DEBUG_NAME);
 
    HANDLE hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid);
 
    ULONG n = 0x1000;
    PULONG p = new ULONG[n];
 
    while (NT::ZwQuerySystemInformation(NT::SystemHandleInformation, p, n * sizeof *p, 0)
           == STATUS_INFO_LENGTH_MISMATCH)
 
        delete [] p, p = new ULONG[n *= 2];
 
    NT::PSYSTEM_HANDLE_INFORMATION h = NT::PSYSTEM_HANDLE_INFORMATION(p + 1);
 
    for (ULONG i = 0; i < *p; i++) {
 
        if (h[i].ProcessId == pid) {
            HANDLE hObject;
 
            if (NT::ZwDuplicateObject(hProcess, HANDLE(h[i].Handle), NtCurrentProcess(), &hObject,
                                      0, 0, DUPLICATE_SAME_ATTRIBUTES)
                != STATUS_SUCCESS) continue;
 
            NT::OBJECT_BASIC_INFORMATION obi;
 
            NT::ZwQueryObject(hObject, NT::ObjectBasicInformation, &obi, sizeof obi, &n);
 
            printf("%p %04hx %6lx %2x %3lx %3ld %4ld ",
                   h[i].Object, h[i].Handle, h[i].GrantedAccess,
                   int(h[i].Flags), obi.Attributes,
                   obi.HandleCount - 1, obi.PointerCount - 2);
 
            n = obi.TypeInformationLength + 2;
 
            NT::POBJECT_TYPE_INFORMATION oti = NT::POBJECT_TYPE_INFORMATION(new CHAR[n]);
 
            NT::ZwQueryObject(hObject, NT::ObjectTypeInformation, oti, n, &n);
 
            printf("%-14.*ws ", oti[0].Name.Length / 2, oti[0].Name.Buffer);
 
            n = obi.NameInformationLength == 0
                ? MAX_PATH * sizeof (WCHAR) : obi.NameInformationLength;
 
            NT::POBJECT_NAME_INFORMATION oni = NT::POBJECT_NAME_INFORMATION(new CHAR[n]);
 
            NTSTATUS rv = NT::ZwQueryObject(hObject, NT::ObjectNameInformation, oni, n, &n);
            if (NT_SUCCESS(rv))
                printf("%.*ws", oni[0].Name.Length / 2, oni[0].Name.Buffer);
 
            printf("\n");
 
            CloseHandle(hObject);
        }
    }
    delete [] p;
 
    CloseHandle(hProcess);
 
    return 0;
}

Open in new window

0
 
mycuti08Author Commented:
Thanks jkr, but I prefer not to query file handle, as specified in my question.
0
 
jkrCommented:
You might prefer not to do so, but it's the only way ;o)
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now