Getting the file handles of given process

Question

Hi, I need a way for getting all of the file handles of a given process.

for example, given a the winword.exe process handle, i would like to get the list of the file handles of that process (doc files etc).

i'm using the Win32 api via C#/pInvoke.

Thanks!

Answer 1

An easy solution would be to use handle.exe and read its output. Another solution is to use P/Invoke with NtQuerySystemInformation function. This forum post on SysInternals has more details as well as this article on CodeProject. Doing it in managed code could be very difficult as you will need to write a driver to read the kernel address space.

I would suggest you to expose the needed functionality in a Win32 function that you could call from managed code.

Answer 2

In complement to Darin answer, see also this codeguru page and this sysinternal forum post