C#

CPallini wrote:

Are you aware that your sentence doesn't make sense?

[DllImport("ntdll.dll", SetLastError = true)]
        public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);


        [StructLayout(LayoutKind.Sequential)]
        public struct SYSTEM_HANDLE_INFORMATION
        {
            public int ProcessId; //id of the process whom handle this is
            public byte ObjectTypeNumber; //type of the object
            public byte Flags; // 1 = PROTECT_FROM_CLOSE, 2 = INHERIT
            public short Handle;
            public int Object; //address of the handle
            public int GrantedAccess; //access for the handle
        }

        public const uint STATUS_INFO_LENGTH_MISMATCH = 0xc0000004;

        public static SYSTEM_HANDLE_INFORMATION[] EnumHandles()
        {
            int retLength = 0;
            int handleCount = 0;
            SYSTEM_HANDLE_INFORMATION[] returnHandles;
            int allocLength = 0x1000;
            IntPtr data = Marshal.AllocHGlobal(allocLength);

            // This is needed because ZwQuerySystemInformation with SystemHandleInformation doesn't
            // actually give a real return length when called with an insufficient buffer. This code
            // tries repeatedly to call the function, doubling the buffer size each time it fails.
            while (ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data,
                allocLength, out retLength) == STATUS_INFO_LENGTH_MISMATCH)
            {
                data = Marshal.ReAllocHGlobal(data, new IntPtr(allocLength *= 2));
            }

            // The structure of the buffer is the handle count plus an array of SYSTEM_HANDLE_INFORMATION
            // structures.
            handleCount = Marshal.ReadInt32(data);
            returnHandles = new SYSTEM_HANDLE_INFORMATION[handleCount];

            for (int i = 0; i < handleCount; i++)
            {
                returnHandles[i] = (SYSTEM_HANDLE_INFORMATION)Marshal.PtrToStructure(
                    new IntPtr(data.ToInt32() + 4 + i * Marshal.SizeOf(typeof(SYSTEM_HANDLE_INFORMATION))),
                    typeof(SYSTEM_HANDLE_INFORMATION));
            }

            Marshal.FreeHGlobal(data);

            return returnHandles;
        }

SYSTEM_HANDLE_INFORMATION[] handles = EnumHandles();
            var winampHandles = from handle in handles
                                where handle.ProcessId == 10004
                                select handle;
            foreach (var winampHandle in winampHandles)
            {
                //do something here...
            }