列举某进程打开的文件列表

来源：互联网发布：11选5遗漏数据查询360 编辑：程序博客网时间：2024/05/16 15:13

  unsigned long needed;    DWORD size;    SYSTEM_HANDLE shandle;    HMODULE module = LoadLibraryW(L"Ntdll.dll");    NtQuerySystemInformation = (QuerySystemInformation)GetProcAddress(module, "NtQuerySystemInformation");    NtQueryObject = (QueryObject)GetProcAddress(module, "NtQueryObject");     BYTE *buf = new BYTE[1024*1024*10];    size=1024*1024*10;    NTSTATUS ret = NtQuerySystemInformation(16,buf,size,&needed);        HANDLE process=OpenProcess(PROCESS_ALL_ACCESS,FALSE,PID);    HANDLE temp;       for (DWORD i=4;i<needed;i+=sizeof(SYSTEM_HANDLE))    {        CopyMemory(&shandle,buf+i,sizeof(SYSTEM_HANDLE));        if (shandle.dwProcessId==PID)        {            if (DuplicateHandle(process, (HANDLE)shandle.wValue, GetCurrentProcess(), &temp, 0, FALSE, DUPLICATE_SAME_ACCESS))            {char Name[1024];ZeroMemory(Name, sizeof(Name));OBJECT_NAME_INFORMATION name,*pname;ULONG len;NtQueryObject(temp,1,&name,sizeof name,&len);pname=reinterpret_cast<POBJECT_NAME_INFORMATION>(new char[len]);NtQueryObject(temp,1,pname,len,&len);CComBSTR str = pname->Name.Buffer;....................................

#include <atlbase.h>#include <comutil.h>#include <Ntsecapi.h>#pragma comment(lib,"comsupp.lib")#define PID 25780typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {    ULONG Attributes;    ACCESS_MASK GrantedAccess;    ULONG HandleCount;    ULONG PointerCount;    ULONG Reserved[10];    // reserved for internal use} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {    UNICODE_STRING TypeName;    ULONG Reserved [22];    // reserved for internal use} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;typedef struct _OBJECT_NAME_INFORMATION{    UNICODE_STRING Name;} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;typedef struct _SYSTEM_HANDLE{    DWORD    dwProcessId;    BYTE     bObjectType;    BYTE     bFlags;    WORD     wValue;    PVOID    pAddress;    DWORD    GrantedAccess;}SYSTEM_HANDLE;typedef NTSTATUS (__stdcall *QuerySystemInformation)(int,void*,unsigned long,unsigned long*);typedef NTSTATUS (__stdcall *QueryObject)(HANDLE,int,void*,unsigned long,unsigned long*);QueryObject NtQueryObject;QuerySystemInformation NtQuerySystemInformation;

因项目需要，需要列举进程打开的文件列表。网上找了一大圈，实在是没有现成的代码，终于搜罗了一段可以用的代码。