4

Given I have a list of all file handles of all processes, how could I find out which of these handles are actually locking a file?

From what I understand I could simply try to open the files and try to get all the permissions and if something goes wrong I'd know it is locked. But that sound extremely inefficient. I mean I already have the handles is there no way to check which permissions the handles have?

Preferably I'd like to see a solution that works on Windows XP and above.

I already searched through the GetFileInformationByHandleEx function, but I couldn't find anything about access permissions. :/

Edit: I don't need real-time information on the file lock. The files that I'm planning to work on will either be locked until certain applications are closed or not be locked at all.

user2864740
  • 60,010
  • 15
  • 145
  • 220
Forivin
  • 14,780
  • 27
  • 106
  • 199
  • 4
    Better to ask forgiveness than permission – David Heffernan Apr 14 '16 at 16:49
  • You can read the "lockness" of file by trying to writing to the handle, since the read/write are only by the owner of the handle. – Joel Apr 14 '16 at 17:15
  • 8
    There is no way to do this. Any kind of IsFileLocked() function can never work reliably on a multi-tasking operating system. The value it returns is instantly stale and provides no guarantee that it is still unlocked when you try to access the file. You find out by accessing the file, that is atomic. It is not inefficient, only what you do when it is locked might be. Which is the exact same thing you'd do if a hypothetical IsFileLocked() function returned TRUE. Avoid all this by preventing another process from locking the file when you open it. – Hans Passant Apr 14 '16 at 17:40
  • @Joel: When you open a file, you specify the share mode (among others). You can open a file for writing, and allow others to read/write to the same file. Handle ownership has nothing to do with this. Plus, there are other operations on a file besides reading and writing, e.g. deleting it, or querying for information. – IInspectable Apr 15 '16 at 06:47
  • I don't need real-time information on the file lock. The files that I'm planning to work on will either be locked until certain applications are closed or not be locked at all. – Forivin Apr 15 '16 at 09:56
  • I'm also wondering if the handle could be altered to remove the locks. (Yes, I know that this might lead to unexpected behavior.) – Forivin Apr 15 '16 at 10:24

2 Answers2

1

This question is a duplicate of Win32 files locked for reading: how to find out who's locking them.

Also, Hans Passant's commentary is correct: querying the locked state of any Win32 file gives stale information. Disregarding this warning will cause hard-to-find bugs.

If you control all bits of code that you think will access the files, it's better to use a named pipe for interprocess communication, instead of querying locked files.

Community
  • 1
  • 1
johnwbyrd
  • 3,432
  • 2
  • 29
  • 25
  • Not really a duplicate. I'm not only interested in read-locks. I'm interested in any kind of lock. delete, write, read and also locks that only lock a specific area in a file. And again it really doesn't matter how stale that info is. And I'm not planning to reverse engineer processes to inject piping functionality and whatnot. – Forivin Apr 17 '16 at 09:50
  • @Forivin: those aren't locks, which is probably what caused the confusion. The sharing violations arise from an independent concept: the sharing flags. So if a file was opened and allows reading it, any other process (provided other checks pass) will be able to gain read access to that file. But that's not the same as locking as far as I know. So you need to get your terminology straight. – 0xC0000022L Oct 21 '21 at 12:42
  • @Forivin Also compare the `ERROR_SHARING_VIOLATION` and `ERROR_LOCK_VIOLATION` error codes (winerror.h). – 0xC0000022L Oct 21 '21 at 12:51
0

You can use NtQueryObject API to get information about the handle including the following:

ULONG Attributes;
ACCESS_MASK GrantedAccess;

Or you can access the same information using NtQueryInformationFile using FileModeInformation and FileAccessInformation values for FileInformationClass parameter.

kerem
  • 2,699
  • 1
  • 32
  • 37
  • 2
    I created a lot of test files and created handles on them with every combination of read/write/delete and write-lock access. Then in another application that runs elevated with SeDebugPrivilege etc. I checked GrantedAccess, Attributes, Flags etc. Here is the result: http://i.snag.gy/uHOMr.jpg I think it's safe to say that neither of those contains any useful information concerning the lock state. – Forivin Apr 18 '16 at 12:17
  • This make only sense if you inherited a handle or so. Otherwise your own process is the one who opened it (well, KM may have, too). And the granted access is already tied to the object. But sharing, locking and initial access are related, yet independent concepts. – 0xC0000022L Oct 21 '21 at 12:41