Find the process that is locking a file/folder

Get help with using AutoHotkey and its commands and hotkeys
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Find the process that is locking a file/folder

07 Apr 2016, 10:12

I'd like to programmatically find out which process is responsible for locking a certain file/folder.
Much like the Resource monitor does under CPU/Associated Handles.
Image


Has anyone done this before? Any idea what would be the quickest way to find it?
Do you just "scan" every process for all their handles, resolve them and check if they contain the filename or how would this be done?
And if so, how would I get all the handles of a process?
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

07 Apr 2016, 15:42

I found an interesting piece of code on the Internet that might do what I want. It's written in C++ though and I don't understand the crucial parts.

Code: [Select all] [Expand] [Download] (Untitled.cpp)GeSHi © Codebox Plus



Here's what I got figured out for now. Using my functions RunAsAdmin(), OpenProcess(), SetPrivilege() and EnumProcesses() I managed to get the handles of every process... well sort of... I get a handle on most of them, but I always get a LastError=5 or 6 which is "ERROR_ACCESS_DENIED" and "ERROR_INVALID_HANDLE".
No idea what I'm doing wrong here tbh. But even if I got this figured out, I'm completely lost where it starts with "if (NT::ZwDuplicateObject [...]" in the C++ code.

Code: [Select all] [Expand] [Download] (Untitled.ahk)GeSHi © Codebox Plus

HotKeyIt
Posts: 1534
Joined: 29 Sep 2013, 18:35
Contact:

Re: Find the process that is locking a file/folder

08 Apr 2016, 22:00

That is not that simple, you owe me a beer :D
Requires AutoHotkey_H v1 or v2:

Code: [Select all] [Expand] [Download] GeSHi © Codebox Plus

User avatar
TLM
Posts: 1143
Joined: 01 Oct 2013, 07:52

Re: Find the process that is locking a file/folder

09 Apr 2016, 06:10

HotKeyIt wrote:That is not that simple, you owe me a beer :D
Requires AutoHotkey_H v1 or v2:

Code: [Select all] [Expand] [Download] GeSHi © Codebox Plus


Image
;) great job
Image
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

11 Apr 2016, 04:07

Hey, thank you so much! Man AHK_H is so cool!! I'll have to translate it into AHK_L code for now though.
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

12 Apr 2016, 02:25

Is there a way to resolve `\Device\HarddiskVolumeX` to the drive letter?
User avatar
jNizM
Posts: 2290
Joined: 30 Sep 2013, 01:33
GitHub: jNizM
Contact:

Re: Find the process that is locking a file/folder

12 Apr 2016, 02:36

Can you show what you got so far?

Just found a way to convert C: DriveLetters to "\Device\HardDiskVolumeX"

Code: [Select all] [Download] GeSHi © Codebox Plus

MsgBox % QueryDosDevice("C:")

QueryDosDevice(DeviceName := "C:")
{
size := VarSetCapacity(TargetPath, 260 * (A_IsUnicode ? 2 : 1)) + 1
DllCall("QueryDosDevice", "str", DeviceName, "str", TargetPath, "uint", size)
return TargetPath
}


Ref: Displaying Volume Paths
FindFirst / NextVolume gives you Volume names GUID \?\\...
QueryDosDevice gives you a Device name \Device\HarddiskVolume from a GUID or DriveLetter
GetVolumePathNamesForVolumeName gives you the Drive letter C: from a GUID

So what you can do is loop all drives with DriveGet and QueryDosDevice and store them in an array and later you can recheck them.
[AHK] 1.1.26.01 x64 Unicode | [WIN] 10 Pro (Version 1703) x64
My GitHub Profile | Donations are appreciated if I could help you
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

12 Apr 2016, 09:32

Well, I don't really have anything so far. I found that the Diskpart could be parsed for that.

Code: [Select all] [Download] (Untitled.ahk)GeSHi © Codebox Plus

DISKPART> list volume

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 H DVD-ROM 0 B No Media
Volume 1 NTFS Partition 350 MB Healthy System
Volume 2 C NTFS Partition 232 GB Healthy Boot
Volume 3 D Samsung USB NTFS Removable 59 GB Healthy


But that wouldn't be very elegant.

I really like your way and I think it's good enough. :)

Code: [Select all] [Expand] [Download] (Untitled.ahk)GeSHi © Codebox Plus



I just tried it on HotkeyIt's example and it works like a charm:

Code: [Select all] [Expand] [Download] (Untitled.ahk)GeSHi © Codebox Plus

Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

12 Apr 2016, 15:49

Okay this is getting really nice and usable. I'm still on AHK_H for now, but I still think it's worth sharing.
It's much nicer and way faster than the resource monitor garbage. I even got icons to work, which makes it way easier to spot certain files and it just looks nice. :D

Code: [Select all] [Expand] [Download] GeSHi © Codebox Plus


Image
Image
Image

It might also be a cool idea to show which process is using/blocking which port.
I'm also wondering if we could close the handles that are locking a file without closing the process responsible. That would be pretty neat. :D
User avatar
jNizM
Posts: 2290
Joined: 30 Sep 2013, 01:33
GitHub: jNizM
Contact:

Re: Find the process that is locking a file/folder

13 Apr 2016, 02:04

Looks nice, thanks for sharing =)
Maybe someone (like just me) can assist you to translate it into pure ahk_l.

Do you want to create a "Scripts and Functions" Topic? So I can add a Process Explorer like tool into your Topic too.
(or creatinging 1 big one together - maybe on github or something like this)
Image
[AHK] 1.1.26.01 x64 Unicode | [WIN] 10 Pro (Version 1703) x64
My GitHub Profile | Donations are appreciated if I could help you
User avatar
jNizM
Posts: 2290
Joined: 30 Sep 2013, 01:33
GitHub: jNizM
Contact:

Re: Find the process that is locking a file/folder

13 Apr 2016, 03:22

For closing handles you can maybe use CloseHandle function (Ref: Kernel Objects)
The CloseHandle function closes handles to the following objects:
Access token
Communications device
Console input
Console screen buffer
Event
File
File mapping
I/O completion port
Job
Mailslot
Memory resource notification
Mutex
Named pipe
Pipe
Process <======
Semaphore
Thread <======
Transaction
Waitable timer

Code: [Select all] [Download] GeSHi © Codebox Plus

CloseHandle(handle)
{
if !(DllCall("CloseHandle", "ptr", handle))
return A_LastError
return 1
]


And with GetHandleInformation function you can check if the handle is protected from closing

Code: [Select all] [Download] GeSHi © Codebox Plus

GetHandleInformation(handle)
{
static FLAG := {1: "INHERIT", 2: "PROTECT_FROM_CLOSE"}
if !(DllCall("GetHandleInformation", "ptr", handle, "uint*", flags))
return A_LastError
return flags
}


with SetHandleInformation function you can (maybe) set a handle protection or remove a protection

Code: [Select all] [Download] GeSHi © Codebox Plus

SetHandleInformation(handle, mask := 1, flags := 1)
{
if !(DllCall("SetHandleInformation", "ptr", handle, "uint", mask, "uint", flags))
return A_LastError
return 1
}
[AHK] 1.1.26.01 x64 Unicode | [WIN] 10 Pro (Version 1703) x64
My GitHub Profile | Donations are appreciated if I could help you
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

13 Apr 2016, 03:41

https://autohotkey.com/boards/viewtopic.php?f=6&t=15857
That process explorer looks pretty cool. But your tool shows a list of processes that can be filtered, while my tool shows a list of handles that can be filtered. I guess we could add a new window that opens when you doubleclick a process to show all of its handles. The use-case would be a different one though.
I will, however, try to abstract the code into useful functions or classes so that you can easily add it to your process explorer.

EDIT:
Thanks, the handle functions look promising. :)
just me
Posts: 4781
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: Find the process that is locking a file/folder

13 Apr 2016, 03:43

Hello Bruttosozialprodukt,

I'm wondering about some structure definitions and offsets. Did you run it on x64 with AHK 64?
Last edited by just me on 13 Apr 2016, 03:44, edited 1 time in total.
Remaining with AHK 1.1.25.02 until v2 will become beta.
User avatar
jNizM
Posts: 2290
Joined: 30 Sep 2013, 01:33
GitHub: jNizM
Contact:

Re: Find the process that is locking a file/folder

13 Apr 2016, 03:43

If you finished the translation to ahk_l i will pm you the code from the process explorer (rewrite it a bit atm) and we can create a big process / handles / ... tool.

Welcome just me =)

[ot]
since we are german speaking guys we should move the follow communication for this into german help subforum, so its easier for all.
[/ot]
[AHK] 1.1.26.01 x64 Unicode | [WIN] 10 Pro (Version 1703) x64
My GitHub Profile | Donations are appreciated if I could help you
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

13 Apr 2016, 03:47

I ran it on Window 8.1 x64. I think I used AHK_H v2 32bit version, but I can't remember.
Edit:
Yes, I used AHK_H v2 Win32w. Using the x64w version it doesn't work, no errors, but the list stays empty. So you're probably right with your suspicion.
just me
Posts: 4781
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: Find the process that is locking a file/folder

13 Apr 2016, 04:23

If you have time, please try this:

Code: [Select all] [Download] GeSHi © Codebox Plus

    SYSTEM_HANDLE_INFORMATION :="
(
// Information Class 16
int ProcessID;
byte ObjectTypeNumber;
byte Flags; // 0x01 = PROTECT_FROM_CLOSE, 0x02 = INHERIT
ushort Handle;
pvoid Object_Pointer; // <<<<< changed int to pvoid
int GrantedAccess;
)"
Remaining with AHK 1.1.25.02 until v2 will become beta.
Bruttosozialprodukt
Posts: 451
Joined: 24 Jan 2014, 22:28

Re: Find the process that is locking a file/folder

13 Apr 2016, 04:31

Just the same. It still works with AHK_H 32 bit and the list is empty using the 64 bit version.
just me
Posts: 4781
Joined: 02 Oct 2013, 08:51
Location: Germany

Re: Find the process that is locking a file/folder

13 Apr 2016, 04:50

Hmmm, seems to need more. See you later!
Remaining with AHK 1.1.25.02 until v2 will become beta.
HotKeyIt
Posts: 1534
Joined: 29 Sep 2013, 18:35
Contact:

Re: Find the process that is locking a file/folder

13 Apr 2016, 05:11

jNizM wrote:And with GetHandleInformation function you can check if the handle is protected from closing

Code: [Select all] [Download] GeSHi © Codebox Plus

GetHandleInformation(handle)
{
static FLAG := {1: "INHERIT", 2: "PROTECT_FROM_CLOSE"}
if !(DllCall("GetHandleInformation", "ptr", handle, "uint*", flags))
return A_LastError
return flags
}
This is already available in Flags, see SYSTEM_HANDLE_INFORMATION.

For 64-bit change A_PtrSize to 4: h:=Struct("SYSTEM_HANDLE_INFORMATION", (&p) + 4) ;)

Return to “Ask For Help”

Who is online

Users browsing this forum: No registered users and 38 guests