当我们启动一个子进程，
打开读写管道，同时设置子进程继承这些管道的句柄，
我们就可以操作子进程的标准输入和标准输出了。
这样有个弊端，子进程会继承父进程打开的所有文件句柄。
如果子进程不退出，一直持续任务，那么，被打开的文件就无法重命名和删除了。
有两个解决的办法：
1. CreateFile的时候属性参数直接指定不允许继承句柄。但是这个方法有个弊端：
c/c++的文件操作并没有提供属性设置，默认的属性是被继承的。
如果写的是跨平台程序必须使用标准库时，就没有办法了。
2. 使用系统API枚举所有打开的句柄内核对象，然后关闭这些内核对象。
代码如下：
头文件定义如下：
1 #pragma warning(disable: 4996) // _tcsnicmp deprecated 2 #include <winternl.h> 3 4 // This makro assures that INVALID_HANDLE_VALUE (0xFFFFFFFF) returns FALSE 5 #define IsConsoleHandle(h) (((((ULONG_PTR)h) & 0x10000003) == 0x3) ? TRUE : FALSE) 6 #define SystemHandleInformation (SystemProcessInformation + 11) 7 #define ObjectNameInformation (ObjectTypeInformation - 1) 8 9 struct OBJECT_NAME_INFORMATION 10 { 11 UNICODE_STRING Name; // defined in winternl.h 12 TCHAR NameBuffer; 13 }; 14 15 typedef NTSTATUS(NTAPI* PNtQueryObject)(HANDLE Handle, OBJECT_INFORMATION_CLASS Info, PVOID Buffer, ULONG BufferSize, PULONG ReturnLength); 16 17 typedef LONG NTSTATUS; 18 19 typedef struct _SYSTEM_HANDLE 20 { 21 DWORD dwProcessId; 22 BYTE bObjectType; 23 BYTE bFlags; 24 WORD wValue; 25 PVOID pAddress; 26 DWORD GrantedAccess; 27 }SYSTEM_HANDLE; 28 29 typedef struct _SYSTEM_HANDLE_INFORMATION 30 { 31 DWORD dwCount; 32 SYSTEM_HANDLE Handles[1]; 33 } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION, **PPSYSTEM_HANDLE_INFORMATION; 34 35 36 typedef NTSTATUS(WINAPI *PNtQuerySystemInformation) 37 (IN SYSTEM_INFORMATION_CLASS SystemInformationClass, 38 OUT PVOID SystemInformation, 39 IN ULONG SystemInformationLength, 40 OUT PULONG ReturnLength OPTIONAL);
实现代码：
// returns // "\Device\HarddiskVolume3" (Harddisk Drive) // "\Device\HarddiskVolume3\Temp" (Harddisk Directory) // "\Device\HarddiskVolume3\Temp\transparent.jpeg" (Harddisk File) // "\Device\Harddisk1\DP(1)0-0+6\foto.jpg" (USB stick) // "\Device\TrueCryptVolumeP\Data\Passwords.txt" (Truecrypt Volume) // "\Device\Floppy0\Autoexec.bat" (Floppy disk) // "\Device\CdRom1\VIDEO_TS\VTS_01_0.VOB" (DVD drive) // "\Device\Serial1" (real COM port) // "\Device\USBSER000" (virtual COM port) // "\Device\Mup\ComputerName\C$\Boot.ini" (network drive share, Windows 7) // "\Device\LanmanRedirector\ComputerName\C$\Boot.ini" (network drive share, Windwos XP) // "\Device\LanmanRedirector\ComputerName\Shares\Dance.m3u" (network folder share, Windwos XP) // "\Device\Afd" (internet socket) // "\Device\Console000F" (unique name for any Console handle) // "\Device\NamedPipe\Pipename" (named pipe) // "\BaseNamedObjects\Objectname" (named mutex, named event, named semaphore) // "\REGISTRY\MACHINE\SOFTWARE\Classes\.txt" (HKEY_CLASSES_ROOT\.txt) DWORD GetNtPathFromHandle(HANDLE h_File, CString* ps_NTPath) { if (h_File == 0 || h_File == INVALID_HANDLE_VALUE) return ERROR_INVALID_HANDLE; // NtQueryObject() returns STATUS_INVALID_HANDLE for Console handles if (IsConsoleHandle(h_File)) { ps_NTPath->Format(_T("\\Device\\Console%04X"), (DWORD)(DWORD_PTR)h_File); return ERROR_SUCCESS; } BYTE u8_Buffer[2000]; DWORD u32_ReqLength = 0; UNICODE_STRING* pk_Info = &((OBJECT_NAME_INFORMATION*)u8_Buffer)->Name; pk_Info->Buffer = 0; pk_Info->Length = 0; HMODULE h_NtDll = GetModuleHandle(_T("Ntdll.dll")); // Ntdll is loaded into EVERY process! PNtQueryObject NtQueryObject = (PNtQueryObject)GetProcAddress(h_NtDll, "NtQueryObject"); if (NtQueryObject == NULL) { return ERROR_FUNCTION_FAILED; } // IMPORTANT: The return value from NtQueryObject is bullshit! (driver bug?) // - The function may return STATUS_NOT_SUPPORTED although it has successfully written to the buffer. // - The function returns STATUS_SUCCESS although h_File == 0xFFFFFFFF NtQueryObject(h_File, OBJECT_INFORMATION_CLASS(ObjectNameInformation), u8_Buffer, sizeof(u8_Buffer), &u32_ReqLength); // On error pk_Info->Buffer is NULL if (!pk_Info->Buffer || !pk_Info->Length) return ERROR_FILE_NOT_FOUND; pk_Info->Buffer[pk_Info->Length / 2] = 0; // Length in Bytes! *ps_NTPath = pk_Info->Buffer; return ERROR_SUCCESS; } // converts // "\Device\HarddiskVolume3" -> "E:" // "\Device\HarddiskVolume3\Temp" -> "E:\Temp" // "\Device\HarddiskVolume3\Temp\transparent.jpeg" -> "E:\Temp\transparent.jpeg" // "\Device\Harddisk1\DP(1)0-0+6\foto.jpg" -> "I:\foto.jpg" // "\Device\TrueCryptVolumeP\Data\Passwords.txt" -> "P:\Data\Passwords.txt" // "\Device\Floppy0\Autoexec.bat" -> "A:\Autoexec.bat" // "\Device\CdRom1\VIDEO_TS\VTS_01_0.VOB" -> "H:\VIDEO_TS\VTS_01_0.VOB" // "\Device\Serial1" -> "COM1" // "\Device\USBSER000" -> "COM4" // "\Device\Mup\ComputerName\C$\Boot.ini" -> "\\ComputerName\C$\Boot.ini" // "\Device\LanmanRedirector\ComputerName\C$\Boot.ini" -> "\\ComputerName\C$\Boot.ini" // "\Device\LanmanRedirector\ComputerName\Shares\Dance.m3u" -> "\\ComputerName\Shares\Dance.m3u" // returns an error for any other device type DWORD GetDosPathFromNtPath(const TCHAR* u16_NTPath, CString* ps_DosPath) { DWORD u32_Error; if (_tcsnicmp(u16_NTPath, _T("\\Device\\Serial"), 14) == 0 || // e.g. "Serial1" _tcsnicmp(u16_NTPath, _T("\\Device\\UsbSer"), 14) == 0) // e.g. "USBSER000" { HKEY h_Key; if (u32_Error = RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("Hardware\\DeviceMap\\SerialComm"), 0, KEY_QUERY_VALUE, &h_Key)) return u32_Error; TCHAR u16_ComPort[50]; DWORD u32_Type; DWORD u32_Size = sizeof(u16_ComPort); if (u32_Error = RegQueryValueEx(h_Key, u16_NTPath, 0, &u32_Type, (BYTE*)u16_ComPort, &u32_Size)) { RegCloseKey(h_Key); return ERROR_UNKNOWN_PORT; } *ps_DosPath = u16_ComPort; RegCloseKey(h_Key); return ERROR_SUCCESS; } if (_tcsnicmp(u16_NTPath, _T("\\Device\\LanmanRedirector\\"), 25) == 0) // Win XP { *ps_DosPath = _T("\\\\"); *ps_DosPath += (u16_NTPath + 25); return ERROR_SUCCESS; } if (_tcsnicmp(u16_NTPath, _T("\\Device\\Mup\\"), 12) == 0) // Win 7 { *ps_DosPath = _T("\\\\"); *ps_DosPath += (u16_NTPath + 12); return ERROR_SUCCESS; } TCHAR u16_Drives[300]; if (!GetLogicalDriveStrings(300, u16_Drives)) return GetLastError(); TCHAR* u16_Drv = u16_Drives; while (u16_Drv[0]) { TCHAR* u16_Next = u16_Drv + _tcslen(u16_Drv) + 1; u16_Drv[2] = 0; // the backslash is not allowed for QueryDosDevice() TCHAR u16_NtVolume[1000]; u16_NtVolume[0] = 0; // may return multiple strings! // returns very weird strings for network shares if (!QueryDosDevice(u16_Drv, u16_NtVolume, sizeof(u16_NtVolume) / sizeof(TCHAR))) return GetLastError(); int s32_Len = (int)_tcslen(u16_NtVolume); if (s32_Len > 0 && _tcsnicmp(u16_NTPath, u16_NtVolume, s32_Len) == 0) { *ps_DosPath = u16_Drv; *ps_DosPath += (u16_NTPath + s32_Len); return ERROR_SUCCESS; } u16_Drv = u16_Next; } return ERROR_BAD_PATHNAME; } //EnableTokenPrivilege( SE_DEBUG_NAME ); BOOL EnableTokenPrivilege(LPCTSTR pszPrivilege) { // do it only once static bool bEnabled = false; if (bEnabled) { return TRUE; } bEnabled = true; HANDLE hToken = 0; TOKEN_PRIVILEGES tkp = { 0 }; // Get a token for this process. if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) { return FALSE; } // Get the LUID for the privilege. if (LookupPrivilegeValue(NULL, pszPrivilege, &tkp.Privileges[0].Luid)) { tkp.PrivilegeCount = 1; // one privilege to set tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // Set the privilege for this process. AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0); if (GetLastError() != ERROR_SUCCESS) return FALSE; return TRUE; } return FALSE; } /* * Basically, with the above code, we can close the handles created by another process. * After closing the handle, we can rename or delete that file or directory. * But there are cases where after closing the handle, we can rename the folder but deleting is not possible. * using this option on a DLL used by another process is just ignored. */ BOOL CloseHandleWithProcess(SYSTEM_HANDLE& sh) { HANDLE hFile = (HANDLE)sh.wValue; HANDLE hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, sh.dwProcessId); if (hProcess) { HANDLE hDup = 0; BOOL b = DuplicateHandle(hProcess, hFile, GetCurrentProcess(), &hDup, DUPLICATE_SAME_ACCESS, FALSE, DUPLICATE_CLOSE_SOURCE); if (hDup) { CloseHandle(hDup); } CloseHandle(hProcess); } return FALSE; } BOOL RenameWithClose(const CString& srcpath, const CString& dstpath) { if (MoveFileEx(srcpath, dstpath, MOVEFILE_REPLACE_EXISTING)) { return TRUE; } else { // The process cannot access the file because it is being used by another process // Try to close file handle used by another process if (GetLastError() == ERROR_SHARING_VIOLATION) { HMODULE hModule = GetModuleHandle(_T("ntdll.dll")); PNtQuerySystemInformation NtQuerySystemInformation = (PNtQuerySystemInformation)GetProcAddress(hModule, "NtQuerySystemInformation"); if (NtQuerySystemInformation == NULL) { SetLastError(ERROR_SHARING_VIOLATION); return FALSE; } else { // Get the list of all handles in the system PSYSTEM_HANDLE_INFORMATION pSysHandleInformation = new SYSTEM_HANDLE_INFORMATION; DWORD size = sizeof(SYSTEM_HANDLE_INFORMATION); DWORD needed = 0; NTSTATUS status = NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS(SystemHandleInformation), pSysHandleInformation, size, &needed); if (!NT_SUCCESS(status)) { if (0 == needed) { delete pSysHandleInformation; SetLastError(ERROR_SHARING_VIOLATION); return FALSE;// some other error } // The previously supplied buffer wasn't enough. delete pSysHandleInformation; size = needed + 1024; pSysHandleInformation = (PSYSTEM_HANDLE_INFORMATION)new BYTE[size]; status = NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS(SystemHandleInformation), pSysHandleInformation, size, &needed); if (!NT_SUCCESS(status)) { // some other error so quit. delete pSysHandleInformation; SetLastError(ERROR_SHARING_VIOLATION); return FALSE; } } // iterate over every handle for (DWORD i = 0; i < pSysHandleInformation->dwCount; i++) { HANDLE hDup = (HANDLE)pSysHandleInformation->Handles[i].wValue; if (pSysHandleInformation->Handles[i].dwProcessId == GetCurrentProcessId()) { CString strNtPath; CString strDosPath; GetNtPathFromHandle(hDup, &strNtPath); GetDosPathFromNtPath(strNtPath, &strDosPath); if (strDosPath == srcpath) { _tprintf(_T("%s: (process id: %d) (filetype: %d) with handle 0x%x\n"), (LPCTSTR)strDosPath, pSysHandleInformation->Handles[i].dwProcessId, pSysHandleInformation->Handles[i].bObjectType, pSysHandleInformation->Handles[i].wValue); //now we can close file open by another process //do rename or delete file again //EnableTokenPrivilege(SE_DEBUG_NAME); //CloseHandleWithProcess(pSysHandleInformation->Handles[i]); } } } delete pSysHandleInformation; } } else { return FALSE; } } return TRUE; }