How to get handle of file path that is locked - winapi

Question

There is a file on mydesktop parent.lock which is a text file. I want the PIDs that are locking this file. So I managed to list out all handles in use. Code striked out below.
I want to use CreateFile to open parent.lock on my desktop to get a handle to it, as I don't know the process which has it open I cannot use DuplicateHandle. Is this possible?
GetFullPathFinal is not an option for me for a couple reasons. One being its only Vista+.
I listed out all handles with NtQuerySystemInformation(SystemHandleInformation.... and it returned 54000 handles (does this number sound right?)
There is a file on mydesktop parent.lock which is a text file. I want the PIDs that are locking this file. But I am not able to figure out the file handle for the parent.lock file on my desktop.
This is how I enumerate handles:
Cu.import("resource://gre/modules/ctypes.jsm");
var lib_ntdll = ctypes.open("ntdll.dll");
var lib_kernel32 = ctypes.open("kernel32.dll");
var STATUS_BUFFER_TOO_SMALL = 0xC0000023>>0;
var STATUS_INFO_LENGTH_MISMATCH = 0xC0000004>>0;
var SystemHandleInformation = 16;
var UNICODE_STRING = new ctypes.StructType("UNICODE_STRING", [
{'Length': ctypes.unsigned_short}, //USHORT
{'MaximumLength': ctypes.unsigned_short}, //USHORT
{'Buffer': ctypes.jschar.ptr} ]); //PWSTR
//https://github.com/tjguk/winsys/blob/5f11b308171382046ff0f67ef3129e47e9fee06c/random/file_handles.py#L100
var SYSTEM_HANDLE_TABLE_ENTRY_INFO = new ctypes.StructType('SYSTEM_HANDLE_TABLE_ENTRY_INFO', [ //typedef struct _TagHANDLEINFO
{'UniqueProcessId': ctypes.unsigned_short}, //USHORT dwPid; //UniqueProcessId
{'CreatorBackTraceIndex': ctypes.unsigned_short}, //USHORT CreatorBackTraceIndex; //CreatorBackTraceIndex
{'ObjectTypeIndex': ctypes.unsigned_long}, //BYTE ObjType; //ObjectTypeIndex UCHAR
{'HandleAttributes': ctypes.unsigned_long}, //BYTE HandleAttributes; //im not sure if byte should be unsigned_long, maybe unsigned_char //HandleAttributes UCHAR
{'HandleValue': ctypes.unsigned_short}, //USHORT HndlOffset; //HandleValue USHORT
{'Object': ctypes.void_t.ptr}, //DWORD dwKeObject; //Object PVOID
{'GrantedAccess': ctypes.unsigned_long} //ULONG GrantedAccess; //GrantedAccess ULONG
]); //HANDLEINFO, PHANDLEINFO;
var SYSTEM_HANDLE_INFORMATION = new ctypes.StructType('SYSTEM_HANDLE_INFORMATION', [
{'NumberOfHandles': ctypes.unsigned_long},
{'Handles': ctypes.ArrayType(SYSTEM_HANDLE_TABLE_ENTRY_INFO, 5)}
]);
var NtQuerySystemInformation = lib_ntdll.declare("NtQuerySystemInformation",
ctypes.winapi_abi,
ctypes.long, // return //NTSTATUS
ctypes.int, // SystemInformationClass //SYSTEM_INFORMATION_CLASS
ctypes.void_t.ptr, // SystemInformation //PVOID
ctypes.unsigned_long, // SystemInformationLength //ULONG
ctypes.unsigned_long.ptr); // ReturnLength //PULONG
/* http://msdn.microsoft.com/en-us/library/ms633499%28v=vs.85%29.aspx
* HWND WINAPI FindWindow(
* __in_opt LPCTSTR lpClassName,
* __in_opt LPCTSTR lpWindowName
* );
*/
// NOT SUPPORTED BY WINXP so just doing this to test and then later will figure out how to get handle to path name then look in here
var GetFinalPathNameByHandle = lib_kernel32.declare('GetFinalPathNameByHandleW', ctypes.winapi_abi, ctypes.uint32_t, //DWORD
ctypes.unsigned_short, // HANDLE
ctypes.void_t.ptr, // LPTSTR
ctypes.uint32_t, // DWORD
ctypes.uint32_t // DWORD
);
function enumHandles() {
var res = {};
var _enumBufSize = new ctypes.unsigned_long(0x4000);
var buffer = ctypes.char.array(_enumBufSize.value)();
while (true) {
var status = NtQuerySystemInformation(SystemHandleInformation, buffer,
_enumBufSize, _enumBufSize.address());
if (status == STATUS_BUFFER_TOO_SMALL || status == STATUS_INFO_LENGTH_MISMATCH) {
buffer = ctypes.char.array(_enumBufSize.value)();
} else break;
}
if (status < 0) return null;
var proc = ctypes.cast(buffer.addressOfElement(0), SYSTEM_HANDLE_INFORMATION.ptr).contents;
for (var i=0; i<proc.Handles.length; i++) {
//console.log('i:', proc.Handles[i].HandleValue);
//var nbuff = ctypes.jschar.array()(32); //nbuff.length == 32
//var ret = GetFinalPathNameByHandle(proc.Handles[i].HandleValue, nbuff.address(), nbuff.length, 0);
//console.log(nbuff.readString()); //always blank i have no idea why
if (res[proc.Handles[i].HandleValue]) {
res[proc.Handles[i].HandleValue].push(proc.Handles[i]);
//console.error('multiple handlevalue occourance for handle value of ', res[proc.Handles[i].HandleValue])
} else {
res[proc.Handles[i].HandleValue] = [proc.Handles[i]]
}
}
return res;
}
var allHandles = enumHandles();
console.log('enumHandles:', Object.keys(allHandles).length, allHandles);
lib_ntdll.close();
lib_kernel32.close();

Answer 1

NtQuerySystemInformation(SystemHandleInformation, ...) returns an array of SYSTEM_HANDLE_INFORMATION items, not SYSTEM_HANDLE_TABLE_ENTRY_INFO items. See Enumerating the processes referencing an object and HOWTO: Enumerate handles.
If you already have an open HANDLE to a file/directory path, such as from CreateFile(), then you should already have the original path that was used to open the HANDLE. To find other handles to the same path, you can:
loop through the array looking for all entries whose Handle field matches the HANDLE you already have, if you have one.
loop through the array looking for entries whose ObjectTypeNumber field is HANDLE_TYPE_FILE. For each Handle, use DuplicateHandle() to make it accessible to your app's process space, then use either NtQueryInformationFile(..., FileNameInformation) or GetFinalPathNameByHandle() to query its path, which you can then compare to the path you are looking for (see File handle operations demo).