View Single Post
  #1  
Old 12-29-2005, 15:25
mokokan
 
Posts: n/a
how do you get a list of open file handles?

I know of some programs that do this, such as SysInternals' Handle.exe or ProcessExplorer.

But I am trying to do it in my own code, and I don't know what I should be looking for.

One thing I found was to maybe use the ROT (Running Objects Table), but I don't see enough information.

Another possiblity is to get a list of handles for each process, but the closest I find is HandleCount:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdiagnosticsprocessmemberstopic.asp
and that is just the number of handles, no way to access the Handles themselves and find what process has them open.

I would like to look at the process handle table directly, but apparently you have to inject a device driver to do this, which is more complicated than I'd like it to be.

It would be a big help if someone could help me with disassembling this:
http://www.sysinternals.com/Utilities/Handle.html

or this:
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/oh-o.asp

So I could have some idea of what they are doing, namely what system calls they're making. But I have never done any disassembly before and I am confused about how to handle this.
Reply With Quote