C++ Get Handle of Open Sockets of a Program

by

As Remy said, its not trivial. You have to call OpenProcess with PROCESS_DUP_HANDLE for each process in the system. You might also need PROCESS_QUERY_INFORMATION and PROCESS_VM_READ, but I’ve never needed it (I’ve seen other code that uses it).

For each process, you access the donor process’s handle table with NtQuerySystemInformation (with an information class of SystemHandleInformation). Finally, you call DuplicateHandle to make the process’s handle your handle, too.

You will have to filter the handle types when enumerating the donor process’s handle table. For each handle you have duplicated, call NtQueryObject with ObjectTypeInformation. If the type is a socket, you keep it open and put it in your list. Otherwise, close it and go on.

To perform the compare, the code looks similar to below. The type is returned as a UNICODE_STRING:

// info was returned from NtQueryObject, ObjectTypeInformation
POBJECT_TYPE_INFORMATION pObjectTypeInfo = (POBJECT_TYPE_INFORMATION)(LPVOID)info;

wstring type( pObjectTypeInfo->Name.Buffer, pObjectTypeInfo->Name.Length );
if( 0 != wcscmp( L"Socket", type.c_str() ) ) { /* Not a Socket */ }

If there is no Socket type (I don’t recall), you should try to get the name associated with the handle (its still a UNICODE_STRING), and look for \\Device\\Tcp. This time, you would use the same handle, but call NtQueryObject with ObjectNameInformation:

// info was returned from NtQueryObject, ObjectNameInformation
POBJECT_NAME_INFORMATION pObjectNameInfo = (POBJECT_NAME_INFORMATION)(LPVOID)info;

wstring name( pObjectNameInfo->Name.Buffer, pObjectNameInfo->Name.Length );
if( name.substr(0, 11) == "\\Device\\Tcp" ) ) { /* It's a TCP Socket */ }

Myself an another fellow did similar a few years ago. Instead of Sockets, we used Mutexes and Events to crash privileged Antivirus components from their userland UI program (which was sharing handles with the privileged component for IPC). See Old Dogs and New Tricks: Do You Know Where Your Handles Are?.

More Related Contents:

  1. Title Name not showing and background color not changing
  2. Windows LoadCursor – Does it return the same HCURSOR value each time?
  3. Adding external library into Qt Creator project
  4. How to get main window handle from process id?
  5. Win32 API to enumerate dll export functions?
  6. Embed Text File in a Resource in a native Windows Application
  7. How to get the error message from the error code returned by GetLastError()?
  8. How do I call ::CreateProcess in c++ to launch a Windows executable?
  9. #define NOMINMAX using std::min/max
  10. Detecting Windows 10 version
  11. Can I use CreateFile, but force the handle into a std::ofstream?
  12. Precise thread sleep needed. Max 1ms error
  13. How to get the cpu usage per thread on windows (win32)
  14. How would I load a PNG image using Win32/GDI (no GDI+ if possible)?
  15. How do I use a third-party DLL file in Visual Studio C++?
  16. Is there a way to find all the functions exposed by a dll
  17. Correctly reading a utf-16 text file into a string without external libraries?
  18. CreateProcess doesn’t pass command line arguments
  19. C++ Executing CMD Commands
  20. What does LPCWSTR stand for and how should it be handled?
  21. How to get a list of video capture devices (web cameras) on windows? (C++)
  22. How might I wrap the FindXFile-style APIs to the STL-style Iterator Pattern in C++?
  23. Win32: How to hide 3rd party windows in taskbar by hWnd
  24. Find what directory the running process EXE is stored in [duplicate]
  25. Explicitly initialize DWORD to 1, but debugger shows wildly out of range value
  26. How to call an external program with parameters?
  27. Breaking ReadFile() blocking – Named Pipe (Windows API)
  28. how to get process handle from process id?
  29. How to get the Executable name of a window
  30. C++ Win32 keyboard events

Leave a Comment