谁拥有 Windows 中的文件句柄？
如何发现哪个进程拥有文件的打开句柄？ 具体来说，您如何以编程方式执行此操作？
How do you discover which process has an open handle on a file? Specifically, how do you do this programmaticly?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
可能有一个API，我不知道。 如果有的话，可能是内核中的一个API。
另一种可能性（很抱歉含糊其辞，但我现在回答这个问题，以防其他人发布更好的答案）是没有（记录的）API，并且执行此操作的程序通过使用未记录的知识来实现这一点句柄的内容和/或句柄（当被视为指针时）指向的内存的内容：例如，我发现 进程的内核对象句柄表，我认为（人们说他们有逆向工程未记录的内存结构）是我记得在 Softice 手册中读到的内容几年前。
查找更多信息的一个地方可能是文件系统筛选器驱动程序。
另一种（也许更好）方法可能是使用
depends或dumpbin /imports来尝试查看相关 Sysinternals 程序正在使用哪些 API。There may be an API for it, I don't know. If there is, it may an API in the kernel.
Another possibility (sorry to be vague, but I'm answering this now in case no-one else posts a better answer) is that there is no (documented) API, and that the programs which do it do so by using undocumented knowledge of the contents of the handle, and/or of the memory which the handle (when treated as a pointer) is pointing to: for example, I found A Process' Kernel Object Handle Table, and I think that that (people saying that they had reverse-engineered undocumented memory structures) is what I remember reading in the Softice manual years ago.
One place to look for more information might be File System Filter Drivers.
Another (perhaps better) way might be to use
dependsordumpbin /importsto try to see what APIs the relevent Sysinternals program is using.Sysinternals 的进程浏览器会告诉您这一点。
Process explorer from Sysinternals will tell you this.