Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Internals
  New Posts New Posts RSS Feed - Enumerate opened files
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Enumerate opened files
 Post Reply Post Reply Page  <1234>
Author
Message
  Topic Search Topic Search  Topic Options Topic Options
EP_X0FF View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 March 2006
Location: Russian Federation
Status: Offline
Points: 4753 		Post Options Post Options   Thanks (0) Thanks(0)   Quote EP_X0FF Quote  Post ReplyReply Direct Link To This Post Posted: 30 September 2007 at 3:52am
Hm. Thats a very very old thread. So nostalgic here. I know all values for object types, BanMe, how this can solve problem with NtQueryObject hung? :)
Back to Top
marty77 View Drop Down
Newbie
Newbie
Avatar

Joined: 17 April 2009
Status: Offline
Points: 4 		Post Options Post Options   Thanks (0) Thanks(0)   Quote marty77 Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2009 at 1:21pm
Originally posted by EP_X0FF EP_X0FF wrote:

This is debug prototype of WalkObjects function.
See walkobjects.cpp for more details.
Code is tested and should work, but named pipes problem doesn't solved yet.
 
I try to compile this project under VS2005 and has got an error (in both debug and release configurations):

walkobjects.obj : error LNK2019: unresolved external symbol _memset referenced in function "unsigned long __stdcall FilenameFromHandle(struct _HTT *)" (?FilenameFromHandle@@YGKPAU_HTT@@@Z)

In FilenameFromHandle there is no references to memset. I don't understand, what I do wrong.
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17492 		Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2009 at 2:17pm
Hi Alex,

Add msvcrt.lib to the Linker's additional dependencies.
Daily affirmation:
net helpmsg 4006
Back to Top
marty77 View Drop Down
Newbie
Newbie
Avatar

Joined: 17 April 2009
Status: Offline
Points: 4 		Post Options Post Options   Thanks (0) Thanks(0)   Quote marty77 Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2009 at 2:40pm
I have got an error on program startup:
 
---------------------------
Microsoft Visual C++ Runtime Library
---------------------------
Runtime Error!
Program: f:\work\misc\win32\walkobjects\debug\WalkObjects.exe
R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.

---------------------------
ОК  
---------------------------
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17492 		Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 17 April 2009 at 5:16pm
Sounds like an unhandled exception... Time to debug...
Daily affirmation:
net helpmsg 4006
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17492 		Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2009 at 5:30pm
Sorry - try using libcmt.lib instead of msvcrt.lib. Embarrassed
Daily affirmation:
net helpmsg 4006
Back to Top
marty77 View Drop Down
Newbie
Newbie
Avatar

Joined: 17 April 2009
Status: Offline
Points: 4 		Post Options Post Options   Thanks (0) Thanks(0)   Quote marty77 Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2009 at 6:05pm
Originally posted by molotov molotov wrote:

Sorry - try using libcmt.lib instead of msvcrt.lib. Embarrassed
Thanks, it works fine - after starting WalkObjects.exe there is no messages displayed, my computer goes to reboot immediately Smile
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Status: Offline
Points: 17492 		Post Options Post Options   Thanks (0) Thanks(0)   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2009 at 6:13pm
Quote Thanks, it works fine - after starting WalkObjects.exe there is no messages displayed, my computer goes to reboot immediately
You get a bugcheck (check for crash dump)? What OS and service pack are you using?
Daily affirmation:
net helpmsg 4006
Back to Top
marty77 View Drop Down
Newbie
Newbie
Avatar

Joined: 17 April 2009
Status: Offline
Points: 4 		Post Options Post Options   Thanks (0) Thanks(0)   Quote marty77 Quote  Post ReplyReply Direct Link To This Post Posted: 18 April 2009 at 6:30pm
Windows XP SP3, configured: reboot on stop error, no dump.
Thanks for help, but I found another way to solve subj problem here - http://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c2827/
It looks more simple, and it works good on my system.
Back to Top
jaysonpryde View Drop Down
Newbie
Newbie
Avatar

Joined: 23 August 2008
Location: Philippines
Status: Offline
Points: 17 		Post Options Post Options   Thanks (0) Thanks(0)   Quote jaysonpryde Quote  Post ReplyReply Direct Link To This Post Posted: 11 January 2011 at 1:40am

I used Napalm's code regarding getting handles. It's working fine though i noticed that some of the handles were not enumerated. The testing that i made was:

    1. Locked a file by using HIEW.exe (see snapshot attached)
    2. Used Process Explorer to check if the locked file is a handle of HIEW(see snapshot attached)
    3. Used the code and did not change anything aside from omitting the OutputConnectionDetails
        since i'm enumerating all handles and not doing anything special when handle is device/TCP or device/UDP related
    4. Output the result to a text file (see snapshot attached)

  Result showed that the locked file was not indicated as handle of HIEW.exe. GetLastError indicates that error is 5 (ACCESS_DENIED) and when I debugged the program, this was encountered during the call to DuplicateHandle. I tried modifying the code by doing this:

if(DuplicateHandle(hProcess, (HANDLE)pHandleInfo->Handles[dwIdx].Handle,GetCurrentProcess(), &hObject, 0, FALSE, DUPLICATE_SAME_ACCESS) != FALSE)

However, this modification caused a hang. 

How should this issue be addressed?

Thanks a lot!!!Smile
Back to Top
 Post Reply Post Reply Page  <1234>
  Share Topic   

Forum Jump Forum Permissions View Drop Down