Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 01-04-2006, 02:56
SecondAnt
 
Posts: n/a
for Windows 95/98 sample:

Code:
// OpenFiles.cpp (Windows 95/98 Only!)
//
// This example will show you how you can retrieve the information
// about what files are currently open on your Windows 95/98 system.
// The information includes the path, the way the file has been opened
// and the access and share modes.
//
// (c)1999 Ashot Oganesyan K, SmartLine, Inc
// mailto:[email protected], http://www.protect-me.com, http://www.codepile.com




#include <windows.h>
#include <stdio.h>


typedef struct _DIOC_REGISTERS { 
    DWORD reg_EBX;
    DWORD reg_EDX;
    DWORD reg_ECX;
    DWORD reg_EAX;
    DWORD reg_EDI;
    DWORD reg_ESI;
    DWORD reg_Flags;
} DIOC_REGISTERS, *PDIOC_REGISTERS;


#if !defined VWIN32_DIOC_DOS_IOCTL
#define VWIN32_DIOC_DOS_IOCTL          0x0001
#endif

// Intel x86 processor status flags
#define CARRY_FLAG                     0x0001

// Access modes 
#define OPEN_ACCESS_READONLY           0x0000
#define OPEN_ACCESS_WRITEONLY          0x0001
#define OPEN_ACCESS_READWRITE          0x0002
#define OPEN_ACCESS_RO_NOMODLASTACCESS 0x0004
// Share modes 
#define OPEN_SHARE_COMPATIBLE          0x0000
#define OPEN_SHARE_DENYREADWRITE       0x0010
#define OPEN_SHARE_DENYWRITE           0x0020
#define OPEN_SHARE_DENYREAD            0x0030
#define OPEN_SHARE_DENYNONE            0x0040
// Open flags 
#define OPEN_FLAGS_NOINHERIT           0x0080
#define OPEN_FLAGS_NO_BUFFERING        0x0100
#define OPEN_FLAGS_NO_COMPRESS         0x0200
#define OPEN_FLAGS_ALIAS_HINT          0x0400
#define OPEN_FLAGS_NOCRITERR           0x2000
#define OPEN_FLAGS_COMMIT              0x4000
// File types
#define FILENORMAL                     0x0000
#define MEMORYMAPPED                   0x0001
#define DLLOREXECUTABLE                0x0002
#define SWAPFILE                       0x0004

// Opens a handle to VWIN32 that can be used to issue low-level commands
HANDLE WINAPI OpenVWin32 (void);
// Closes the handle opened by OpenVWin32
BOOL WINAPI CloseVWin32 (HANDLE hVWin32);


void main(void)
{
	HANDLE hVWin32 = OpenVWin32();
	if (hVWin32 == INVALID_HANDLE_VALUE)
		return;

	DWORD Dev = GetLogicalDrives();
	
	DIOC_REGISTERS	regs;
	int i;
	char buf[MAX_PATH];
	BOOL fResult;
	DWORD cb;

	for (register int k=0; k<26; ++k)
	{
		if (Dev & 0x01)
		{
			i=0;
			while (TRUE)
			{
				ZeroMemory(&regs,sizeof(regs));
				regs.reg_EBX = k+1;        // Drive ID (0-Default drive,A-1,B-2,C-3,...)
				regs.reg_EDX = (DWORD)buf; // File name
				regs.reg_ECX = 0x486D;     // Enumerate Open Files
				regs.reg_EAX = 0x440D;     // IOCTL for block devices
				regs.reg_EDI = 0x0000;     // 0-enum all,1-unmovable files only
				regs.reg_ESI = i++;        // Zero-based file ID

				fResult = DeviceIoControl (hVWin32, VWIN32_DIOC_DOS_IOCTL,
									  &regs, sizeof(regs), &regs, sizeof(regs),
									  &cb, 0);

				if (!fResult || regs.reg_Flags & CARRY_FLAG)
					break;

				printf("%s\t",buf);

				switch(LOWORD(regs.reg_ECX))
				{
				case FILENORMAL:
					printf("Normal\t");
					break;
				case MEMORYMAPPED:
					printf("Memory Mapped\t");
					break;
				case DLLOREXECUTABLE:
					printf("DLL or Executable\t");
					break;
				case SWAPFILE:
					printf("Swap File\t");
					break;
				default:
					printf("Unknown\t");
					break;
				}

				if (LOWORD(regs.reg_EAX) & OPEN_ACCESS_RO_NOMODLASTACCESS)
					printf("NOMODALASTACCESS\t");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_ACCESS_READWRITE)
					printf("READWRITE\t");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_ACCESS_WRITEONLY)
					printf("WRITEONLY\t");
				else
					printf("READONLY\t");


				if (LOWORD(regs.reg_EAX) & OPEN_SHARE_DENYNONE)
					printf("DENYNONE\t");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_SHARE_DENYWRITE)
					printf("DENYWRITE\t");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_SHARE_DENYREAD)
					printf("DENYREAD\t");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_SHARE_DENYREADWRITE)
					printf("DENYREADWRITE\t");
				else
					printf("COMPATIBLE\t");


				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_COMMIT)
					printf("COMMIT\n");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_NOCRITERR)
					printf("NOCRITERR\n");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_ALIAS_HINT)
					printf("ALIASHINT\n");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_NO_COMPRESS)
					printf("NOCOMPRESS\n");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_NO_BUFFERING)
					printf("NOBUFFER\n");
				else
				if (LOWORD(regs.reg_EAX) & OPEN_FLAGS_NOINHERIT)
					printf("NOINHERIT\n");
				else
					printf("\n");
			}
		}

		Dev = Dev >> 1;
	}

	CloseVWin32(hVWin32);
}



HANDLE WINAPI OpenVWin32 (void)
{ 
   return CreateFile (TEXT("\\\\.\\vwin32"), 0, 0, NULL, 0,
                      FILE_FLAG_DELETE_ON_CLOSE, NULL);
}

BOOL WINAPI CloseVWin32 (HANDLE hVWin32)
{ 
   return CloseHandle (hVWin32);
} [QUOTE]
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Issue with IDB file watch list crashing IDA Chuck954 General Discussion 1 01-17-2019 01:20
File: *.htz ? (how to open it) hosiminh General Discussion 2 12-21-2004 06:17
LINK : fatal error LNK1104: cannot open file 'libcid.lib' Nilrem General Discussion 6 04-04-2004 23:17


All times are GMT +8. The time now is 04:38.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )