+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] C# getting windows file handles/processes (/showthread.php?tid=6107305)
C# getting windows file handles/processes - aesopfables - Sep 4, 2020
Hi All,
Just wondering if anyone could help getting the process and the file handles currently opened by Windows.
I've found alot of stuff on the filesystemwatch, but i dont want to monitor a single object, is there anything native that could help achieve the same output and list all the process with file handles open?
Thanks you in advance
:)
RE: C# getting windows file handles/processes - MavenGradle - Sep 5, 2020
Sure there is. The Restart Manager might come in handy for your purposes.
More specifically, the RmGetList function:
https://docs.microsoft.com/en-us/windows/win32/api/restartmanager/nf-restartmanager-rmgetlist
Or the more refined approach; You can use NtQueryInformationFile and look for the FILE_PROCESS_IDS_USING_FILE_INFORMATION struct:
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryinformationfile?redirectedfrom=MSDN
https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ne-wdm-_file_information_class?redirectedfrom=MSDN
RE: C# getting windows file handles/processes - aesopfables - Sep 8, 2020
Thanks Mate! Exactly the sort of sample i was after.
I was looking at getting filehandles help by a process, so this pointed me in the right direction.
Thank you
RE: C# getting windows file handles/processes - MavenGradle - Sep 9, 2020
(Sep 8, 2020 05:12 PM)aesopfables Wrote: Thanks Mate! Exactly the sort of sample i was after.
I was looking at getting filehandles help by a process, so this pointed me in the right direction.
Thank you
Good to hear. Feel free to post any and all interesting questions you may have in this section if you require further assistance.
It certainly won't harm the quality of the subsection seeing more of these, as most of them are related to skidware anyway.
RE: C# getting windows file handles/processes - aesopfables - Sep 16, 2020
Thanks Maven! i found a solution using the NtQueryInformationFile method.
I was able to list all the file handles opened/closed by procecss. Will post Source but it C++ and not C#
but can easily be written.
thanks again, i got alot more of "these" sort question over skid q, read read and you shall understand.
Thanks Maven found i can get the info from both Restart Manager and NtQueryInformationFile.
Found a good C++ example i'll rewrite but thanks again for pointing me in the right direction :)