Add detection of process modules

Author: PolarGoose

Directory.Build.props

@@ -6,12 +6,11 @@
     <BaseIntermediateOutputPath>$(BuildFolder)obj\$(MSBuildProjectName)\$(Configuration)\</BaseIntermediateOutputPath>
     <TargetFramework>net472</TargetFramework>
     <LangVersion>latest</LangVersion>
-    <Platforms>x64</Platforms>
+    <Platforms>AnyCpu</Platforms>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <WarningLevel>5</WarningLevel>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <Version>0.0-dev</Version>
-    <NoWarn>$(NoWarn);IL2026;IL2104</NoWarn>
   </PropertyGroup>
 </Project>

Handle2.sln

@@ -20,28 +20,18 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Handle2", "src\Handle2\Hand
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
-		Release|x64 = Release|x64
-		Release|x86 = Release|x86
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|x64.ActiveCfg = Debug|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|x64.Build.0 = Debug|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|x86.ActiveCfg = Debug|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|x86.Build.0 = Debug|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|x64.ActiveCfg = Release|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|x64.Build.0 = Release|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|x86.ActiveCfg = Release|x64
-		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|x86.Build.0 = Release|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|x64.ActiveCfg = Debug|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|x64.Build.0 = Debug|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|x86.ActiveCfg = Debug|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|x86.Build.0 = Debug|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|x64.ActiveCfg = Release|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|x64.Build.0 = Release|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|x86.ActiveCfg = Release|x64
-		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|x86.Build.0 = Release|x64
+		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{D57C5C4B-3FE1-415E-92F8-A345DF5679AC}.Release|Any CPU.Build.0 = Release|Any CPU
+		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{FABFDFC5-D060-4A71-B0E7-DC9D339F0856}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

README.md

@@ -2,14 +2,16 @@
 
 An open-source alternative to the [Sysinternals Handle](https://learn.microsoft.com/en-us/sysinternals/downloads/handle)<tr>
 * Identifies processes that are locking specific files or folders
+* Include process modules in the search
+  * Note: `Sysinternals Handle` doesn't include process modules in the search. Thus, it can fail to find the locking process.
 * Shows information about all handles in the system
 * Supports JSON output
 * Full Unicode support
   * Note: `Sysinternals Handle` doesn't support Unicode file names ([more details](https://superuser.com/questions/1761951/sysinternals-handle-prints-question-marks-instead-of-non-ascii-symbols))
 
 ## System requirements
 
-* Windows 7 x64 and higher.
+* Windows 7 and higher.
 
 ## Usage
 
@@ -30,18 +32,17 @@ Examples:
 
 Command-line options:
 
-  --json                (Default: false) Json output
+  --json                (Default: false) JSON output. For details on the meanings of the fields provided, please consult
+                        the HandleInfo and SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX structures in the source code.
 
-  --path                Required. (Default: false) path
+  --path                Required. Displays the processes locking the path
 
-  --dump-all-handles    Required. (Default: false) Displays information about all system handles.
+  --dump-all-handles    Required. (Default: false) Displays information about all system handles and modules
 
   --help                Display this help screen.
 
   --version             Display version information.
 ```
 
 ## How to build
-
-* To work with the codebase, `Visual Studio 2022` can be used.
-* To build the project, run `build.ps` script (`git.exe` should be in the PATH)
+To build the project, run `build.ps` script (`git.exe` should be in the PATH)

src/Handle2/HandleInfo/HandleInfoRetriever.cs

@@ -40,7 +40,8 @@ public record struct ProcessInfo(
     string? ProcessExecutablePath,
     string? UserName,
     string? DomainName,
-    IEnumerable<HandleInfo> Handles);
+    IEnumerable<HandleInfo> Handles,
+    IEnumerable<string> ModuleNames);
 
 public static class HandleInfoRetriever
 {
@@ -63,7 +64,7 @@ private static void AddHandleTypeAndNameInfo(SafeFileHandle handle, ref HandleIn
         }
     }
 
-    public static IEnumerable<ProcessInfo> GetAllProcInfos()
+    private static IEnumerable<ProcessInfo> GetProcInfos(Func<string?, bool> handleAndModuleNameFilter)
     {
         var currentProcess = WinApi.GetCurrentProcess();
         var result = new List<ProcessInfo>();
@@ -123,15 +124,21 @@ public static IEnumerable<ProcessInfo> GetAllProcInfos()
                             watchdog.Disarm();
                         }
 
-                        currentHandles.Add(handle);
+                        if(handleAndModuleNameFilter(handle.FullNameIfItIsAFileOrAFolder))
+                        {
+                            currentHandles.Add(handle);
+                        }
                     }
 
-                    if (currentHandles.Any())
+                    var moduleNames = ProcessUtils.GetProcessModules(currentOpenedProcess).Where(name => handleAndModuleNameFilter(name)).ToArray();
+
+                    if (currentHandles.Any() || moduleNames.Any())
                     {
                         var procInfo = new ProcessInfo
                         {
                             Pid = pid.ToUInt64(),
-                            Handles = currentHandles
+                            Handles = currentHandles,
+                            ModuleNames = moduleNames
                         };
                         (procInfo.DomainName, procInfo.UserName) = ProcessUtils.GetOwnerDomainAndUserNames(currentOpenedProcess);
                         procInfo.ProcessExecutablePath = ProcessUtils.GetProcessExeFullName(currentOpenedProcess);
@@ -149,27 +156,14 @@ public static IEnumerable<ProcessInfo> GetAllProcInfos()
         return result;
     }
 
+    public static IEnumerable<ProcessInfo> GetAllProcInfos()
+    {
+        return GetProcInfos(_ => true);
+    }
+
     public static IEnumerable<ProcessInfo> GetProcInfosLockingPath(string path)
     {
         path = FileUtils.ToCanonicalPath(path);
-        var allInfos = GetAllProcInfos();
-        var result = new List<ProcessInfo>();
-
-        foreach(var info in allInfos)
-        {
-            var handles = info.Handles.Where(h => h.FullNameIfItIsAFileOrAFolder?.StartsWith(path, StringComparison.InvariantCultureIgnoreCase) == true);
-            if (handles.Any())
-            {
-                result.Add(new ProcessInfo
-                {
-                    Pid = info.Pid,
-                    ProcessExecutablePath = info.ProcessExecutablePath,
-                    UserName = info.UserName,
-                    DomainName = info.DomainName,
-                    Handles = handles
-                });
-            }
-        }
-        return result;
+        return GetProcInfos(fileName => fileName?.StartsWith(path, StringComparison.InvariantCultureIgnoreCase) == true);
     }
 }

src/Handle2/HandleInfo/Interop/WinApi.cs

@@ -170,12 +170,18 @@ public enum FileFlagsAndAttributes : uint
         SecurityAnonymous = 0x00100000
     }
 
+    public const int ERROR_INSUFFICIENT_BUFFER = 122;
+
     [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
     public static extern bool QueryFullProcessImageName(
         SafeProcessHandle hProcess,
         int dwFlags,
         StringBuilder? lpExeName,
         ref int lpdwSize);
 
-    public const int ERROR_INSUFFICIENT_BUFFER = 122;
+    [DllImport("psapi.dll", SetLastError = true)]
+    public static extern bool EnumProcessModules(SafeProcessHandle hProcess, IntPtr[] lphModule, int cb, out int lpcbNeeded);
+
+    [DllImport("psapi.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    public static extern uint GetModuleFileNameEx(SafeProcessHandle hProcess, IntPtr hModule, [Out] StringBuilder lpFilename, int nSize);
 }

src/Handle2/HandleInfo/Utils/ProcessUtils.cs

@@ -47,7 +47,65 @@ public static (string domain, string user) GetOwnerDomainAndUserNames(SafeProces
 
     public static SafeProcessHandle? OpenProcessToDuplicateHandle(UIntPtr pid)
     {
-        var p = WinApi.OpenProcess(WinApi.ProcessAccessRights.PROCESS_DUP_HANDLE | WinApi.ProcessAccessRights.PROCESS_QUERY_INFORMATION, false, pid);
+        var p = WinApi.OpenProcess(
+            WinApi.ProcessAccessRights.PROCESS_DUP_HANDLE |
+            WinApi.ProcessAccessRights.PROCESS_QUERY_INFORMATION |
+            WinApi.ProcessAccessRights.PROCESS_VM_READ,
+            false, pid);
         return p.IsInvalid ? null : p;
     }
+
+    public static IEnumerable<string> GetProcessModules(SafeProcessHandle openedProc)
+    {
+        for(var arraySize = 1024; ; arraySize *= 2)
+        {
+            var moduleHandles = new IntPtr[arraySize];
+            if (!WinApi.EnumProcessModules(openedProc, moduleHandles, IntPtr.Size * moduleHandles.Length, out var bytesNeeded))
+            {
+                return Array.Empty<string>();
+            }
+
+            var numberOfModules = bytesNeeded / IntPtr.Size;
+
+            if (arraySize < numberOfModules)
+            {
+                continue;
+            }
+
+            return GetModuleNames(openedProc, moduleHandles.Take(numberOfModules));
+        }
+    }
+
+    private static IEnumerable<string> GetModuleNames(SafeProcessHandle openedProc, IEnumerable<IntPtr> moduleHandles)
+    {
+        foreach (var moduleHandle in moduleHandles)
+        {
+            var name = GetModuleName(openedProc, moduleHandle);
+            if(name != null)
+            {
+                yield return name;
+            }
+        }
+    }
+
+    private static string? GetModuleName(SafeProcessHandle openedProc, IntPtr moduleHandle)
+    {
+        for (var moduleNameLength = 1024; ; moduleNameLength *= 2)
+        {
+            var sb = new StringBuilder(moduleNameLength);
+            var resultLen = WinApi.GetModuleFileNameEx(openedProc, moduleHandle, sb, sb.Capacity);
+  
+            if (resultLen == 0)
+            {
+                return null;
+            }
+
+            if (resultLen == sb.Capacity)
+            {
+                continue;
+            }
+
+            return sb.ToString();
+        }
+    }
 }

src/Handle2/Program.cs

@@ -37,6 +37,11 @@
                     Console.WriteLine($"  {handle.HandleType,-15} {name}");
                 }
 
+                foreach (var moduleName in procWithHandles.ModuleNames)
+                {
+                    Console.WriteLine($"  {"Module",-15} {moduleName}");
+                }
+
                 Console.WriteLine("------------------------------------------------------------------------------");
             }
         }
@@ -58,6 +63,11 @@
                     Console.WriteLine($"  {handle.FullNameIfItIsAFileOrAFolder}");
                 }
 
+                foreach (var moduleName in procWithHandles.ModuleNames)
+                {
+                    Console.WriteLine($"  {moduleName}");
+                }
+
                 Console.WriteLine("------------------------------------------------------------------------------");
             }
         }
@@ -90,6 +100,6 @@ public sealed class Options
     [Option("path", Required = true, SetName = "path", HelpText = "Displays the processes locking the path")]
     public string? Path { get; set; }
 
-    [Option("dump-all-handles", Required = true, Default = false, SetName = "dump-all-handles", HelpText = "Displays information about all system handles.")]
+    [Option("dump-all-handles", Required = true, Default = false, SetName = "dump-all-handles", HelpText = "Displays information about all system handles and modules")]
     public bool DumpAllHandles { get; set; }
 }

src/test/ProgramTest.cs

@@ -51,8 +51,9 @@ public void Dump_all_handle_information()
         Assert.That(res.StandardOutput, ContainsIgnoreCase(@"C:\Windows\system32\sihost.exe"));
         Assert.That(res.StandardOutput, ContainsIgnoreCase(@"Desktop"));
         Assert.That(res.StandardOutput, ContainsIgnoreCase(@"\Default"));
-        Assert.That(res.StandardOutput, ContainsIgnoreCase(@"C:\Windows\System32\"));
+        Assert.That(res.StandardOutput, ContainsIgnoreCase(@"  File            C:\Windows\System32\"));
         Assert.That(res.StandardOutput, ContainsIgnoreCase(@"C:\Windows\System32\en-US\KernelBase.dll.mui"));
+        Assert.That(res.StandardOutput, ContainsIgnoreCase(@"  Module          C:\WINDOWS\SYSTEM32\ntdll.dll"));
     }
 
     [Test]
@@ -66,6 +67,8 @@ public void Dump_all_handle_information_json()
         Assert.That(res.StandardOutput, ContainsIgnoreCase(@"C:\\Windows\\System32\\en-US\\propsys.dll.mui"));
         Assert.That(res.StandardOutput, Contains.Substring(@"\\Device\\HarddiskVolume"));
         Assert.That(res.StandardOutput, Contains.Substring(@"        ""HandleType"": ""Section"","));
+        Assert.That(res.StandardOutput, Contains.Substring(@"    ""ModuleNames"": ["));
+        Assert.That(res.StandardOutput, ContainsIgnoreCase(@"      ""C:\\WINDOWS\\SYSTEM32\\ntdll.dll"","));
     }
 
     [Test]