使用文件识别进程
我一直在试图弄清楚如何以编程方式识别锁定特定文件的进程。 我已经搜索了 Win32 API 和 WMI，但到目前为止我找不到任何东西。 我知道这是可能的 - Sysinternals 能够列出系统上每个进程访问/锁定的每个资源。
有人能给我提示吗？
I have been trying to figure out how to programmatically identify the process that has a lock on a particular file. I've searched through the Win32 API and WMI, but so far I can't find anything. I know it's possible - Sysinternals is able to list every resource accessed/locked by every process on the system.
Can anyone drop me a hint?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
您可以使用Sysinternals 中的handle.exe。
类似于：
感谢 https://stackoverflow.com/a/599268/367916 。
You can use handle.exe from Sysinternals.
Something like:
Thanks to https://stackoverflow.com/a/599268/367916 .
中的 Process Explorer
You could use Process Explorer from Microsoft
如果您可以限制自己使用足够新的 Windows 版本，重新启动管理器可以告诉您 哪个进程打开了特定文件。
If you can limit yourself to new enough versions of Windows, the Restart Manager can tell you which process has a particular file open.
由于 Process Explorer 的工作方式，我怀疑您需要寻找的是一种查找附加到给定进程的文件句柄的方法，并且您必须为系统中的每个进程提取该列表并查找你的文件在里面。
Because of the way Process Explorer works, I suspect that what you need to look for is a way of finding the file handles attached to a given process, and that you'll have to pull that list for each process in the system and look for your file within it.
我不知道在 Windows 中，但有人可能会发现知道在 Linux 中有用，您可以使用 lsof 命令，或者只是搜索文件夹 /proc/PROCESS_ID/fd 并查看哪个进程已打开文件。
I don't know in Windows, but somebody might find useful to know that, in Linux, you can use the lsof command, or just search through the folders /proc/PROCESS_ID/fd and see what process has opened the file.
WhoLockMe 是一个不错的右键 Windows 资源管理器扩展。
WhoLockMe is a nice right click windows explorer extension.
这篇文章可能对您有帮助。
看来您被迫使用 ntdll.dll 中未记录的函数来搜索系统上每个进程的文件列表。
This article might be helpful to you.
It appears you are forced to search through the list of files for each process on the system using undocumented functions in ntdll.dll.