通过关闭设备句柄,强制弹出移动硬盘失败,求大神解答
通过NtQuerySystemInformation等api找到File类型的句柄,
GetFileType判断为FILE_TYPE_DISK后,怎么确定这个句柄就是移动硬盘的设备句柄?我用了DeviceIoControl,GetFinalPathNameByHandle等api都返回句柄无效的错误
procexp看到 handle name 是/Device/00000086。
下面是部分代码:
// 遍历所有句柄,并找出文件句柄
for (ULONG i = 0; i < pInfo->NumberOfHandles; i++)
{
// 获取源进程的句柄
hSourceProcessHandle = OpenProcess(PROCESS_ALL_ACCESS|PROCESS_DUP_HANDLE|PROCESS_SUSPEND_RESUME, FALSE,pInfo->Information[i].ProcessId);
if(hSourceProcessHandle == NULL)
{
DWORD dwErrCode = GetLastError();
continue ;
}
// 转换句柄
if (!DuplicateHandle(hSourceProcessHandle, (HANDLE)pInfo->Information[i].Handle,
GetCurrentProcess(), &hNewHandle, 0, FALSE, DUPLICATE_SAME_ACCESS) )
{
CloseHandle(hSourceProcessHandle);
hSourceProcessHandle = NULL;
DWORD dwErrorCode = GetLastError();
continue;
}
// 判断是否为文件句柄
CHAR szBuf[1024] = {0};
//memset(&stTypeName,0,sizeof(stTypeName));
//dwRetLen = 0;
POBJECT_NAME_INFORMATION pTypeName = (POBJECT_NAME_INFORMATION)szBuf;
status = m_NtQueryObject( hNewHandle, ObjectTypeInformation, szBuf, sizeof(szBuf), &dwRetLen);
if(pTypeName->Name.Length <=0 || 0 != _wcsicmp((wchar_t *)pTypeName->Name.Buffer, L"File") )
{
CloseHandle(hNewHandle);
CloseHandle(hSourceProcessHandle);
hNewHandle = NULL;
hSourceProcessHandle = NULL;
continue;
}
DWORD dwFileType = GetFileType(hNewHandle);
if(dwFileType == FILE_TYPE_DISK)
{
// 找到了
// DWORD dwBytesReturned = 0;
// STORAGE_DEVICE_NUMBER st;
// memset(&st,0,sizeof(st));
// if(!DeviceIoControl(hNewHandle,IOCTL_STORAGE_GET_DEVICE_NUMBER,NULL,0,&st,sizeof(st),&dwBytesReturned,NULL))
// {
// DWORD dwErrCode = GetLastError();
// dlplog_info(g_log_handle,"DeviceIoControl error: %d",GetLastError());
// }
//
// STORAGE_DEVICE_NUMBER device_num;
// DWORD bytes_returned = 0;
// if (!DeviceIoControl((HANDLE)pInfo->Information[i].Handle, IOCTL_STORAGE_GET_DEVICE_NUMBER,NULL, 0,
// &device_num, sizeof(device_num),
// &bytes_returned, (LPOVERLAPPED) NULL))
// {
// DWORD dwErrCode = GetLastError();
// dlplog_info(g_log_handle,"DeviceIoControl error: %d",GetLastError());
// }
CHAR szFilePath[1024] = {0};
DWORD dwErrCode = GetFinalPathNameByHandle(hNewHandle,szFilePath,sizeof(szFilePath)-1,FILE_NAME_NORMALIZED);
dlplog_info(g_log_handle,"szFilePath=%s",szFilePath);
m_NtQueryVolumeInformationFile(hNewHandle,&IoStatus,&NmInfo.Info,sizeof(NM_INFO)-sizeof(HANDLE),FileFsDriverPathInformation);
}
}
CloseHandle(hNewHandle);
CloseHandle(hSourceProcessHandle);
hNewHandle = NULL;
hSourceProcessHandle = NULL;
continue;