|
i use NtQuerySystemInformation
but i get a error
if(!NtQuerySystemInformation(16,&hInfo,sizeof(hInfo),NULL))
{
printf("Load NtQuery Unsucessfull");
Sleep(-1);
return 1;
}
CString szTam;
szTam.Format(L"%d",hInfo.HandleCount);
MessageBox(0,szTam,0,0);
for(int i=0;i < hInfo.HandleCount;i++)
{
SYSTEM_HANDLE hSystem=hInfo.Handles[i];
HANDLE hdupHandle=NULL;
......
}
can you help me?
or i must ReadProcessMemory?
|
|
|
|
|
so0_lanhlung2 wrote: if(!NtQuerySystemInformation(16,&hInfo,sizeof(hInfo),NULL))
What does the '16' stand for? On my winternl.h file the SYSTEM_INFORMATION_CLASS enumeration does not contain such a value.
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
|
Would help if you'd tell us -so we don't have to try and look it up- which SystemInformationClass '16' is and what is hInfo.
I checked NtQuerySystemInformation[^] in MSDN, and i guess you might be using SYSTEM_PROCESS_INFORMATION. In the documentation it says:
The HandleCount member contains the total number of handles being used by the process in question; use GetProcessHandleCount to retrieve this information instead. Maybe you should use GetProcessHandleCount[^] instead? However, MSDN does not seem to list a Handles member there so i might be off track, altrough this GetProcessHandleCount thing might be applicable to your case too.
> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<
modified on Saturday, March 19, 2011 6:07 AM
|
|
|
|
|
void CShowHandlesOfProc::AddHandlesToList(CListCtrl *m_list,DWORD pid)
{
int nItem=0;
NTSTATUS status;
PSYSTEM_HANDLE_INFORMATION handleInfo;
ULONG handleInfoSize = 0x10000;
HANDLE processHandle;
ULONG i;
_NtQuerySystemInformation NtQuerySystemInformation =
(_NtQuerySystemInformation)GetLibraryProcAddress("ntdll.dll", "NtQuerySystemInformation");
_NtDuplicateObject NtDuplicateObject =
(_NtDuplicateObject)GetLibraryProcAddress("ntdll.dll", "NtDuplicateObject");
_NtQueryObject NtQueryObject =
(_NtQueryObject)GetLibraryProcAddress("ntdll.dll", "NtQueryObject");
if(!(processHandle = OpenProcess(PROCESS_DUP_HANDLE|PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE,pid))) return;
handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);
while((status = NtQuerySystemInformation(SystemHandleInformation,handleInfo,handleInfoSize,NULL)) == STATUS_INFO_LENGTH_MISMATCH)
handleInfo = (PSYSTEM_HANDLE_INFORMATION)realloc(handleInfo, handleInfoSize *= 2);
if(!NT_SUCCESS(status)) return;
for(i = 0; i < handleInfo->HandleCount; i++)
{
SYSTEM_HANDLE handle = handleInfo->Handles[i];
HANDLE dupHandle = NULL;
POBJECT_TYPE_INFORMATION objectTypeInfo;
PVOID objectNameInfo;
UNICODE_STRING objectName;
ULONG returnLength;
if(handle.ProcessId != pid) continue;
if(!NT_SUCCESS(NtDuplicateObject(processHandle,(HANDLE)handle.Handle,GetCurrentProcess(),&dupHandle,0,0,0))) continue;
objectTypeInfo = (POBJECT_TYPE_INFORMATION)malloc(0x1000);
if(!NT_SUCCESS(NtQueryObject(dupHandle,ObjectTypeInformation,objectTypeInfo,0x1000,NULL)))
{
CloseHandle(dupHandle);
continue;
}
if((handle.GrantedAccess != 0x0012019f)
&& (handle.GrantedAccess != 0x001a019f)
&& (handle.GrantedAccess != 0x00120189)
&& (handle.GrantedAccess != 0x00100000))
{
wprintf(L"%s - 0x%X - ",objectTypeInfo->Name.Buffer, handle.Handle);
CString szType,szHandle,szName;
szHandle.Format(L"0x%X",handle.Handle);
m_list->InsertItem(nItem,szHandle);
nItem++;
objectNameInfo = malloc(0x1000);
if(!NT_SUCCESS(NtQueryObject(dupHandle,ObjectNameInformation,objectNameInfo,0x1000,&returnLength)))
{
objectNameInfo = realloc(objectNameInfo, returnLength);
if(!NT_SUCCESS(NtQueryObject(dupHandle,ObjectNameInformation,objectNameInfo,returnLength,NULL)))
{
free(objectTypeInfo);
free(objectNameInfo);
CloseHandle(dupHandle);
continue;
}
}
objectName = *(PUNICODE_STRING)objectNameInfo;
if(objectName.Length) wprintf(L"%s",objectName.Buffer);
else wprintf(L"\0");
wprintf(L"\n");
}
free(objectTypeInfo);
free(objectNameInfo);
CloseHandle(dupHandle);
}
free(handleInfo);
CloseHandle(processHandle);
return;
}
this is my structs
#define SystemHandleInformation 16
#define ObjectBasicInformation 0
#define ObjectNameInformation 1
#define ObjectTypeInformation 2
typedef ULONG (NTAPI *_NtQuerySystemInformation)(
ULONG SystemInformationClass,
PVOID SystemInformation,
ULONG SystemInformationLength,
PULONG ReturnLength
);
typedef ULONG (NTAPI *_NtDuplicateObject)(
HANDLE SourceProcessHandle,
HANDLE SourceHandle,
HANDLE TargetProcessHandle,
PHANDLE TargetHandle,
ACCESS_MASK DesiredAccess,
ULONG Attributes,
ULONG Options
);
typedef ULONG (NTAPI *_NtQueryObject)(
HANDLE ObjectHandle,
ULONG ObjectInformationClass,
PVOID ObjectInformation,
ULONG ObjectInformationLength,
PULONG ReturnLength
);
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _SYSTEM_HANDLE
{
ULONG ProcessId;
BYTE ObjectTypeNumber;
BYTE Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
ULONG HandleCount;
SYSTEM_HANDLE Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
typedef enum _POOL_TYPE
{
NonPagedPool,
PagedPool,
NonPagedPoolMustSucceed,
DontUseThisType,
NonPagedPoolCacheAligned,
PagedPoolCacheAligned,
NonPagedPoolCacheAlignedMustS
} POOL_TYPE, *PPOOL_TYPE;
typedef struct _OBJECT_TYPE_INFORMATION
{
UNICODE_STRING Name;
ULONG TotalNumberOfObjects;
ULONG TotalNumberOfHandles;
ULONG TotalPagedPoolUsage;
ULONG TotalNonPagedPoolUsage;
ULONG TotalNamePoolUsage;
ULONG TotalHandleTableUsage;
ULONG HighWaterNumberOfObjects;
ULONG HighWaterNumberOfHandles;
ULONG HighWaterPagedPoolUsage;
ULONG HighWaterNonPagedPoolUsage;
ULONG HighWaterNamePoolUsage;
ULONG HighWaterHandleTableUsage;
ULONG InvalidAttributes;
GENERIC_MAPPING GenericMapping;
ULONG ValidAccess;
BOOLEAN SecurityRequired;
BOOLEAN MaintainHandleCount;
USHORT MaintainTypeList;
POOL_TYPE PoolType;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
} OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
this funciton run in Console project
but when i creat dialog MFC..and i try add handle to ListCtrl have Error
Access violation reading location 0xbaadf00d.
i don't know...
help me plz
|
|
|
|
|
so0_lanhlung2 wrote: Access violation reading location 0xbaadf00d.
i
I think this value suggests that you are trying to use a pointer that has not been initialised. It's a pity you posted all this code above, but not the part that causes the error.
I must get a clever new signature for 2011.
|
|
|
|
|
From http://en.wikipedia.org/wiki/Hexspeak[^]:
# 0xBAADF00D ("bad food") is used by Microsoft's LocalAlloc(LMEM_FIXED) to indicate uninitialised allocated heap memory when the debug heap is used. [3[^]]
My guess would be that something goes wrong during memory allocation. Maybe you are trying to allocate too much (continous) memory. Check out Listing Used Files[^] here on CodeProject, it seems to be doing something similar than you are, there seems to be a way to query how much memory you need so you don't need to keep increasing the buffer with realloc until it is big enough. Can't say anything better at this point, am not much familiar with sysinternals.
> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<
|
|
|
|
|
thanks for reply  ...
i'll reseach
|
|
|
|
|
Just a silly attempt: could you try to comment out all the lines below the offending one, until for loop ends?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
I create a new project with AppWizard. I select single document and do not use document view architecture, and it works fine. But if I comment out the line CPaintDC dc(this);
in the OnPaint handler and run it what happens is when I minimize the window and then restore it the status bar and the toolbar don not display. Clicking on the window brings back the status bar and moving the window or opening a menu brings back the toolbar. I thought it was something in my code on another program but this is all created by AppWizard and I'm not smart enough to figure it out. Has anyone else seen this or is it my computer?
|
|
|
|
|
I think that is not you computer or your code problem. You should not comment CPaintDC dc(this); Line.If you don't want to handle wm_paint message you have to comment out on_wm_paint() message(you should not handle it);If you are going to hanel it the line CPaintDC dc(this); Must be present.try by commenting the line on_wm_paint in BEGIN_MESSAGE_MAP.For more information on wm_paint read the following article from msdn.
http://msdn.microsoft.com/en-us/library/dd145213%28v=vs.85%29.aspx[^]
|
|
|
|
|
Thanks for your reply. My point is this is a new app created by AppWizard and I haven't
added anything. The only code in OnPaint is the declaration of the CPaintDC. It never gets used. I stepped through the construction code for CPaiintDC and I don't see anything to do with the toolbar or the status bar. Its not a problem its just something I noticed and was trying to figure out what one thing had to do with another.
|
|
|
|
|
I have seen a similar issue in a pure Win32 program when not calling BeginPaint() in the handler for the WM_PAINT message. I believe it has something to do with the way messages are cascaded through the windows from the frame down. Bottom line is to leave the basic structure of the wizard generated code intact, especially since you do not know what is under the covers in MFC.
I must get a clever new signature for 2011.
|
|
|
|
|
As Richard MacCutchan also mentioned, this most likely has to do with BeginPaint. I read it somewhere in MSDN that if you do not call this function in response to the WM_PAINT message, WM_PAINT will be re-posted into the message queue until BeginPaint is called in response to make sure a window will be repainted -sooner or later- as needed. I guess, by commenting out CPaintDC, you are flooding your process' message queue with WM_PAINTs, and once this happens, odd things start to happen.
> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> //TODO: Implement signature here<
|
|
|
|
|
I have an SDI application that execute an specific moment an thread .From there , I send thorugh ::PostMessage(...) an CString :
CString* pMessage = new CString("Ready");
::PostMessage(m_window,WMU_UPDATE,0,(LPARAM)pMessage);
and , in CMainFrame I receive pMessage in the follow way :
LRESULT CMainFrame::OnUpdate(WPARAM wParam, LPARAM lParam)
{
CString* pMessage = (CString*)lParam;
SetMessageText(*pMessage);
delete pMessage;
}
and goes well , but still , in case that I shut down the application while second thread goes , I have memory leaks :
Dumping objects ->
strcore.cpp(118) : {1945} normal block at 0x003034F0, 268 bytes long.
I have to mention that when I close the application I wait to second thread to stop :
WaitForSingleObject(m_threadHandle, INFINITE);
How can I send CString through ::PostMessage in safe way ?
|
|
|
|
|
Why don't you properly synchronize (e.g. with Critical Section, Mutex,...) the access to the shared resource (i.e. a CString allocated on the stack by the main thread) and use the message only to notify that the resource has been updated?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
Great ideea ! Now work fine ! Thank you !
|
|
|
|
|
You are welcome.
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
Hi . How can I tell the compiler that should compile only VC6 code ? I have the follow code :
BOOL CMainFrame::ShowNotifyBaloon(PTSTR szBalloonTitle, PTSTR szBalloonMsg, DWORD dwIcon , UINT nTimeOut)
{
VERIFY((nTimeOut *= 1000) >= 10000);
ASSERT (dwIcon == NIIF_WARNING || dwIcon == NIIF_ERROR || dwIcon == NIIF_INFO || dwIcon == NIIF_NONE);
m_NID.dwInfoFlags = dwIcon;
m_NID.uFlags |= NIF_INFO;
m_NID.uTimeout = nTimeOut;
::strcpy(m_NID.szInfoTitle,szBalloonTitle);
::strcpy(m_NID.szInfo,szBalloonMsg);
return ::Shell_NotifyIcon(NIM_MODIFY,&m_NID);
}
that is not recognize in VC6 , but is in VC7 .... does exist some an compiler directive to compile only VC6 code and not VC7 code ?
|
|
|
|
|
There are a number of things you can look for. Open your stdafx.h and check
WINVER,_WIN32_WINNT,_WIN32_WINDOWS,_WIN32_IE,_MSC_VER
They define SDK and compiler version. You can use these in #if directives in your code to make it conditional.
|
|
|
|
|
Here is my stdafx.h
#if !defined(AFX_STDAFX_H__B5537D0B_2DD5_11E0_8FF9_0050BF29759A__INCLUDED_)
#define AFX_STDAFX_H__B5537D0B_2DD5_11E0_8FF9_0050BF29759A__INCLUDED_
#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000
#define VC_EXTRALEAN // Exclude rarely-used stuff from Windows headers
#include <afxwin.h>
#include <afxext.h>
#include <afxdisp.h>
#include <afxdtctl.h>
#ifndef _AFX_NO_AFXCMN_SUPPORT
#include <afxcmn.h>
#endif // _AFX_NO_AFXCMN_SUPPORT
and it's about _MSC_VER ? And which version is it ?
|
|
|
|
|
According to MSDN, if you type cl /? at the command line, you will see the full version for the compiler you are using.
Just make sure you know the difference between SDK version and compiler version before you proceed. You might be able to download a later SDK for your old compiler and make it work.
|
|
|
|
|
It should be 1200 for VC6.
|
|
|
|
|
Yes , it's 1200 , because if I write > 1200 won't compile VC7 code , but if I wrote >= 1200 compile VC7 code ,and , of course give error . Thanks !
|
|
|
|
|
I couldn't understand what you want to achieve exactly.
Flaviu 2 wrote: How can I tell the compiler that should compile only VC6 code ?
If you don't want to compile some codes in later releases than VC6. You can use this guard.
#if _MSC_VER <= 1200
...
#endif
But, your problem seems to be related with SDK version rather than compiler version. If so, (that is, a new feature which is not exist older vers,) you should use other macros such as WINVER, _WIN32_WINNT, _WIN32_WINDOWS, _WIN32_IE or _MFC_VER depending on your feature. Or you can use newer SDK as indicated by Niklas. Or may be, you just need to define target platform or similar appropriately on top of stdafx.h.
#define _WIN32_WINDOWS 0x0600
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
