I want to realize such A function, for example, I now have A file open or read and write A file at this time B A I think through my program to know who opened the file. A, see if there are open files or monitor all process A, hope everybody can grant instruction

Simply want to know a process all the open files or which process a certain file is opened

CodePudding user response:

Help ah how did not answer me mulberry heart

CodePudding user response:

This is difficult,

Help the top...

CodePudding user response:

See they use SHChangeNotifyRegister () API to do "monitor", didn't open files, read and write actions, such as

CodePudding user response:

reference Chen8013 reply: 3/f

see they use SHChangeNotifyRegister () API to do "monitor", didn't open files, read and write actions, such as

I saw someone in the following form, but I can't ask

You need to use ZwQuerySystemInformation and ZwQueryInformationFile these two undisclosed API

First use ZwQuerySystemInformation function enumeration handle to open all the files in the system, using ZwQueryInformationFile again, then according to the different values of parameters FileInformationClass to return different types, using FileInformationClass=FileInformationClass to get FILE_NAME_INFORMATION, which is obtained in the process to open the file

The LS method that's right, I added a little,

ZwQueryInformationFile corresponding hFile must be within this process handle (handles are process related, cannot be used across processes with a handle), so can't to check the ZwQuerySystemInformation returns a handle to the list of handles ZwQueryInformationFile directly, should first then ZwQueryInformationFile ZwDuplicateObject to this process,

In addition, if you want to close the handle, you can create a remote thread execution CloseHandle (ZwClose), or use ZwDuplicateObject, transmit the last parameter DUPLICATE_CLOSE_SOURCE can close the original handle,

Don't know what a brother can help to tidy it up

CodePudding user response:

http://www.nirsoft.net/utils/opened_files_view.html