SYSTEM_HANDLE_INFORMATION structure

data-structures sysinternals
striker picture striker · Mar 30, 2010 · Viewed 8.8k times · Source

From where does this structure originates? I know that it is declared in famous ntdll.h and is a part of undocumented windows API. But isn't it vary between different versions of windows? Is there a way to dump this structure from working system? I tried 'dt SYSTEM_HANLDE_INFORMATION' in Windbg and 'type SYSTEM_HANLDE_INFORMATION' in SoftIce but all I get is 'no such symbol' message. I also dumped ntoskrnl.pdb with PdbDump.exe and searched among the dumped structures - and could not find neither SYSTEM_HANLDE_INFORMATION nor SYSTEM_HANLDE.

Could you help me?

Answer

xjdrew picture xjdrew · Mar 2, 2011

You can refer to this paper on CodeProject on querying all open handles to files, where it is defined as:

typedef struct _SYSTEM_HANDLE
{
    DWORD    dwProcessId;
    BYTE     bObjectType;
    BYTE     bFlags;
    WORD     wValue;
    PVOID    pAddress;
    DWORD    GrantedAccess;
}
SYSTEM_HANDLE;

Related questions

What is the difference between Python's list methods append and extend?

What's the difference between the list methods append() and extend()?

Read More
How to remove a key from a Python dictionary?

When deleting a key from a dictionary, I use: if 'key' in my_dict: del my_dict['key'] Is there a one line way of doing this?

Read More
How do I sort a list of dictionaries by a value of the dictionary?

I have a list of dictionaries and want each item to be sorted by a specific value. Take into consideration the list: [{'name':'Homer', 'age':39}, {'name':'Bart', 'age':10}] When sorted by name, it should become: [{'name':'Bart', 'age':10}, {'name':'Homer', …

Read More