/// <summary> /// Constructor that takes the object handle, which name has to be determined. /// </summary> /// <param name="handle">Object handle, which name has to be determined.</param> public FileNameFromHandleWorker(IntPtr handle) { this.Handle = handle; this.FileName = string.Empty; this.RetValue = false; this.nativeThreadId = null; }
/// <summary> /// This method closes the given handle in the given process. To archive that, the handle is duplicated using the /// native method DuplicateHandle - and during the duplication the handle is closed in the remote process. /// </summary> /// <param name="processId">ID of the process hat has the specified handle opened.</param> /// <param name="handle">Handle to be closed.</param> private void CloseHandleInRemoteProcess(int processId, IntPtr handle) { SafeNativeHandle remoteProcess = NativeMethods.OpenProcess(ProcessAccessRights.ProcessDuplicateHandle, true, processId); if (remoteProcess.IsInvalid) { Logger.Log(LogLevel.Verbose, "Process with PID=" + processId + " could not be opened."); return; } IntPtr remoteProcessHandle = remoteProcess.DangerousGetHandle(); IntPtr currentProcessHandle = NativeMethods.GetCurrentProcess(); SafeNativeHandle duplicatedHandle = null; if (NativeMethods.DuplicateHandle(remoteProcessHandle, handle, currentProcessHandle, out duplicatedHandle, 0, false, DuplicateHandleOptions.CloseSource)) { Logger.Log(LogLevel.Verbose, "File closed in process with PID " + processId); NativeMethods.CloseHandle(duplicatedHandle.DangerousGetHandle()); } else { Logger.Log(LogLevel.Verbose, "File could not be closed in process with PID " + processId); } NativeMethods.CloseHandle(remoteProcessHandle); }
internal static extern bool DuplicateHandle( [In] IntPtr hSourceProcessHandle, [In] IntPtr hSourceHandle, [In] IntPtr hTargetProcessHandle, [Out] out SafeNativeHandle lpTargetHandle, [In] int dwDesiredAccess, [In, MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, [In] DuplicateHandleOptions dwOptions);
/// <summary> /// Returns the type of a handle (as a string). /// </summary> /// <param name="handle">Handle of the object.</param> /// <param name="processId">Process that owns this handle.</param> /// <returns>Type of the handle, i. e. "File".</returns> private static string GetHandleTypeToken(IntPtr handle, int processId) { IntPtr currentProcess = NativeMethods.GetCurrentProcess(); bool remote = processId != NativeMethods.GetProcessId(currentProcess); SafeNativeHandle processHandle = null; SafeNativeHandle objectHandle = null; try { if (remote) { processHandle = NativeMethods.OpenProcess(ProcessAccessRights.ProcessDuplicateHandle, true, processId); if (NativeMethods.DuplicateHandle(processHandle.DangerousGetHandle(), handle, currentProcess, out objectHandle, 0, false, DuplicateHandleOptions.SameAccess)) { handle = objectHandle.DangerousGetHandle(); } } return(GetHandleTypeToken(handle)); } finally { if (remote) { if (processHandle != null) { processHandle.Close(); } if (objectHandle != null) { objectHandle.Close(); } } } }
/// <summary> /// Constructor that takes the object handle, which name has to be determined. /// </summary> /// <param name="handle">Object handle, which name has to be determined.</param> public FileNameFromHandleWorker(IntPtr handle) { this.Handle = handle; this.FileName = string.Empty; this.RetValue = false; this.nativeThreadId = null; }