omega_red
September 1st, 2004, 16:56
I'll forward here a post from microsoft.public.win32.programmer.kernel newsgroup (Message-ID: <cgkcte$1kcp$1@mamut.aster.pl>
...and my reply:
Anyone got some info about this?
Quote:
| [Originally Posted by qfel]NtQuerySystemInformation can return all opened handles, but in all infos I can find in net, returned array provides 16-bit handle values and handles are pointer-precision values (I tested my XP for handle limit and I was able to open much more then 2^16 files). Are docs found on the net invalid or native system calls are not very compatible..? |
...and my reply:
Quote:
| I've just written quick and dirty code to check what this 'handles' actually are. All of them are 0 (on w2k sp4). It returns valid type and kernel object address, so maybe this is the way. Interestingly, there is some sample code in the book "Windows NT/2000 native API reference" for enumerating any process' open handles. Firstly it calls NtQuerySystemInformation with class SystemHandleInformation, and then uses ZwDuplicateObject for each handle to get private copy of it. However, foreign handle supplied to ZwDuplicateObject is the same abovementioned handle - so how it's supposed to work if all of them are null? |
Code:
#include <windows.h>
#include <stdio.h>
typedef DWORD (NTAPI *pNtQuerySystemInformation)(DWORD info_class, void *out, DWORD size, DWORD *out_size);
struct SYSTEM_HANDLE_INFORMATION
{
ULONG ProcessId;
UCHAR ObjectTypeNumber;
UCHAR Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
};
SYSTEM_HANDLE_INFORMATION buf[100000];
void main()
{
DWORD size;
pNtQuerySystemInformation NtQuerySystemInformation =
(pNtQuerySystemInformation) GetProcAddress(GetModuleHandle("ntdll.dll"
NtQuerySystemInformation(16, buf, sizeof(buf), &size);
DWORD n = size/sizeof(SYSTEM_HANDLE_INFORMATION);
for (DWORD i=0; i<n; i++)
{
printf("%08x: PID: %08x, type: %02x, handle: %04x, ptr: %08x\n", i,
buf[I].ProcessId, buf[I].ObjectTypeNumber, buf[I].Handle, buf[I].Object);
}
DebugBreak();
}
Anyone got some info about this?
