时间戳

首页 > 解决方案 > 使用 WINAPI 找出特殊文件上的进程活动句柄（锁定）

windows - 使用 WINAPI 找出特殊文件上的进程活动句柄（锁定）

问题描述

我想将此脚本用作资源，通过使用 Windows API（重置管理器）编写与 Go for Windows 相同的资源

到目前为止我的代码是

Rstrtmgr := syscall.NewLazyDLL("Rstrtmgr.dll")
RmStartSession := Rstrtmgr.NewProc("RmStartSession")
RmRegisterResources := Rstrtmgr.NewProc("RmRegisterResources")
RmGetList := Rstrtmgr.NewProc("RmGetList")

var dwSession uint32 = 0
var szSessionKey = Utils.RandString(32)
ret, _, callErr := RmStartSession.Call(
    uintptr(unsafe.Pointer(&dwSession)),
    uintptr(0),
    uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(szSessionKey))))


var rgsFileNames = unsafe.Pointer(syscall.StringToUTF16Ptr(szPath))
ret, _, callErr = RmRegisterResources.Call(
    uintptr(dwSession),
    uintptr(1),
    uintptr(unsafe.Pointer(&rgsFileNames)),
    uintptr(0),
    uintptr(unsafe.Pointer(nil)),
    uintptr(0),
    uintptr(unsafe.Pointer(nil)))


var nProcInfoNeeded uint32 = 0
var nProcInfo  uint32 = 10
var lpdwRebootReasons uint32 = 0

type RM_UNIQUE_PROCESS struct {
    dwProcessId         uint32
    ProcessStartTime    windows.Filetime
}

type ApplicationType struct {
    RmUnknownApp   uint32
    RmMainWindow   uint32
    RmOtherWindow  uint32
    RmService      uint32
    RmExplorer     uint32
    RmConsole      uint32
    RmCritical     uint32
}

type RM_PROCESS_INFO struct{
    RM_UNIQUE_PROCESS    RM_UNIQUE_PROCESS
    strAppName           string
    strServiceShortName  string
    RM_APP_TYPE          ApplicationType
    AppStatus            uint32
    TSSessionId          uint32
    bRestartable         bool
}

var _RM_PROCESS_INFO [10]RM_PROCESS_INFO
ret, _, callErr = RmGetList.Call(
    uintptr(dwSession),
    uintptr(unsafe.Pointer(&nProcInfoNeeded)),
    uintptr(unsafe.Pointer(&nProcInfo)),
    uintptr(unsafe.Pointer(&_RM_PROCESS_INFO)),
    uintptr(unsafe.Pointer(&lpdwRebootReasons)),
    )
_ = ret
_ = callErr

但我在 RmGetList 上有错误

我的目标是获取该进程的 PID 通过路径锁定我的文件

我编辑我的代码。请审查它

标签： windowsgowinapi

解决方案

RmRegisterResources需要一个 rgsFileName s，这意味着文件名字符串的指针，您可以传递字符串的数组，或者如果您只需要处理一个特殊文件，则只需传递文件名字符串的地址。

var rgsFileNames = unsafe.Pointer(syscall.StringToUTF16Ptr(szPath));
ret, _, callErr = syscall.Syscall9(RmRegisterResources,
    7,
    uintptr(dwSession),
    uintptr(1),
    uintptr(unsafe.Pointer(&rgsFileNames)),
    uintptr(0),
    uintptr(unsafe.Pointer(nil)),
    uintptr(0),
    uintptr(unsafe.Pointer(nil)),
    0,
    0)

推荐阅读