获取进程的打开文件句柄 [英] Getting process's open file handle

问题描述

我正在尝试列出由特定进程打开的所有文件(包括虚拟目录上的远程文件).
我注意到没有WMI服务可以做到这一点，但是据我了解，这是操作系统必须监视的事情.

有什么想法吗?

谢谢，
Amir

Hi,

I''m trying to list all files opened by a specific process (including remote files, on virtual directories).
I''ve noticed that there no WMI services to do that, but from my understanding this is something that has to be monitored by the os.

Any ideas?

Thanks,
Amir

推荐答案

查看本文是否有帮助:列出已使用的文件 [

Hi,

See if this article helps: Listing Used Files[^]

感谢您的快速回复.
我确实看过那篇文章，但是那里的代码已经过时了.它使用了msdn警告使用的NtQuerySystemInformation()(为了以后的兼容性).它建议改为使用GetSystemInfo()，但我真的找不到如何使用GetSystemInfo().
此外，本文讨论了所有打开文件的句柄，这是一个过大的技巧.

谢谢，
阿米尔(Amir)

Thanks for the quick reply.
I did look into that article, however, the code there is a little obsolete. It uses NtQuerySystemInformation() which msdn warns of using (for latter compatibility). It suggests using GetSystemInfo() instead, but I really can''t find HOW to use GetSystemInfo().
In addition, this article discusses ALL the open file handles, which is an overkill.

Thanks,
Amir

这篇关于获取进程的打开文件句柄的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！