All geek questions in one place

Who owns the file descriptor in Windows?

How do you know which process has an open file descriptor? In particular, how do you do this?

+4
source share
2 answers

There may be an API for this, I don't know. If so, it could be an API in the kernel.

Another possibility (sorry I'm vague, but I am answering this now if no one else answers the best answer) is that there is no (documented) API and that the programs that do this use undocumented knowledge of the contents of the descriptor and / or the memory that the descriptor (when viewed as a pointer) points to: for example, I found the "Kernel for processing kernel objects", and I think that this (people saying that they had reverse structures of undocumented memory structures) is that I remember reading in hand duction Softice a few years ago.

One place to look for more information may be the file system filter drivers .

Another (perhaps better) way could be to use depends or dumpbin /imports to try and see which APIs the relevant Sysinternals program uses.

+1
source

The process researcher at Sysinternals will tell you this.

-1
source

Source: https://habr.com/ru/post/1286372/

More articles:


All Articles