src/WhoUses/WhoUses.cpp

   1 // Written by Zoltan Csizmadia, zoltan_csizmadia@yahoo.com
   2 // For companies(Austin,TX): If you would like to get my resume, send an email.
   3 //
   4 // The source is free, but if you want to use it, mention my name and e-mail
   5 // address
   6 //
   7 ///////////////////////////////////////////////////////////////////////////////
   8 //
   9 // WhoUses.cpp : Defines the entry point for the console application.
  10 //
  11
  12 #include <windows.h>
  13 #include <tchar.h>
  14 #include <stdio.h>
  15 #include "SystemInfo.h"
  16
  17 LPCTSTR GetFileNamePosition( LPCTSTR lpPath )
  18 {
  19         LPCTSTR lpAct = lpPath + _tcslen( lpPath );
  20
  21         while ( lpAct > lpPath && *lpAct != _T('\\') && *lpAct != _T('/') )
  22                 lpAct--;
  23
  24         if ( lpAct > lpPath )
  25                 lpAct++;
  26
  27         return lpAct;
  28 }
  29
  30 void WhoUsesModule( LPCTSTR lpFileName, BOOL bFullPathCheck )
  31 {
  32         string processName;
  33         BOOL bShow = FALSE;
  34         SystemProcessInformation::SYSTEM_PROCESS_INFORMATION* p;
  35
  36         SystemProcessInformation pi;
  37         SystemModuleInformation mi;
  38
  39         if ( !mi.Refresh() )
  40         {
  41                 _tprintf( _T("SystemModulesInformation::Refresh() failed.\n") );
  42                 return;
  43         }
  44
  45         if ( mi.m_ModuleInfos.empty() )
  46         {
  47                 _tprintf( _T("No module information\n") );
  48                 return;
  49         }
  50
  51         pi.Refresh();
  52
  53         _tprintf( _T("%-6s  %-20s  %s\n"), _T("PID"), _T("Name"), _T("Path") );
  54         _tprintf( _T("------------------------------------------------------------------\n") );
  55
  56         for (list<SystemModuleInformation::MODULE_INFO>::iterator iter2 = mi.m_ModuleInfos.begin(); iter2 != mi.m_ModuleInfos.end(); iter2++) {
  57                 SystemModuleInformation::MODULE_INFO& m = *iter2;
  58
  59                 if ( bFullPathCheck )
  60                         bShow = _tcsicmp( m.FullPath, lpFileName ) == 0;
  61                 else
  62                         bShow = _tcsicmp( GetFileNamePosition(m.FullPath), lpFileName ) == 0;
  63
  64                 if ( bShow )
  65                 {
  66                         p = pi.m_ProcessInfos[m.ProcessId];
  67                         if (p) {
  68                                 SystemInfoUtils::Unicode2string( &p->usName, processName );
  69                         }
  70                         else
  71                                 processName = "";
  72
  73                                 _tprintf( _T("0x%04X  %-20s  %s\n"),
  74                                         m.ProcessId,
  75                                         processName.c_str(),
  76                                         m.FullPath );
  77                 }
  78         }
  79 }
  80
  81 void WhoUsesFile( LPCTSTR lpFileName, BOOL bFullPathCheck )
  82 {
  83         BOOL bShow = FALSE;
  84         string name;
  85         string processName;
  86         string deviceFileName;
  87         string fsFilePath;
  88         SystemProcessInformation::SYSTEM_PROCESS_INFORMATION* p;
  89         SystemProcessInformation pi;
  90         SystemHandleInformation hi;
  91
  92         if ( bFullPathCheck )
  93         {
  94                 if ( !SystemInfoUtils::GetDeviceFileName( lpFileName, deviceFileName ) )
  95                 {
  96                         _tprintf( _T("GetDeviceFileName() failed.\n") );
  97                         return;
  98                 }
  99         }
 100
 101         hi.SetFilter( _T("File"), TRUE );
 102
 103         if ( hi.m_HandleInfos.empty() )
 104         {
 105                 _tprintf( _T("No handle information\n") );
 106                 return;
 107         }
 108
 109         pi.Refresh();
 110
 111         _tprintf( _T("%-6s  %-20s  %s\n"), _T("PID"), _T("Name"), _T("Path") );
 112         _tprintf( _T("------------------------------------------------------\n") );
 113
 114         for (list<SystemHandleInformation::SYSTEM_HANDLE>::iterator iter = hi.m_HandleInfos.begin(); iter != hi.m_HandleInfos.end(); iter++) {
 115                 SystemHandleInformation::SYSTEM_HANDLE& h = *iter;
 116
 117                 p = pi.m_ProcessInfos[h.ProcessID];
 118                 if (p) {
 119                         SystemInfoUtils::Unicode2string( &p->usName, processName );
 120                 }
 121                 else
 122                         processName = "";
 123
 124                 //NT4 Stupid thing if it is the services.exe and I call GetName :((
 125                 if ( INtDll::dwNTMajorVersion == 4 && _tcsicmp( processName.c_str(), _T("services.exe" ) ) == 0 )
 126                         continue;
 127
 128                 hi.GetName( (HANDLE)h.HandleNumber, name, (DWORD)h.ProcessID );
 129
 130                 if ( bFullPathCheck )
 131                         bShow = _tcsicmp( name.c_str(), deviceFileName.c_str() ) == 0;
 132                 else
 133                         bShow = _tcsicmp( GetFileNamePosition(name.c_str()), lpFileName ) == 0;
 134
 135                 if ( bShow )
 136                 {
 137                         if ( !bFullPathCheck )
 138                         {
 139                                 fsFilePath = "";
 140                                 SystemInfoUtils::GetFsFileName( name.c_str(), fsFilePath );
 141                         }
 142
 143                         _tprintf( _T("0x%04X  %-20s  %s\n"),
 144                                 h.ProcessID,
 145                                 processName.c_str(),
 146                                 !bFullPathCheck ? fsFilePath.c_str() : lpFileName );
 147                 }
 148         }
 149 }
 150
 151 void EnableDebugPriv( void )
 152 {
 153         HANDLE hToken;
 154         LUID sedebugnameValue;
 155         TOKEN_PRIVILEGES tkp;
 156
 157         // enable the SeDebugPrivilege
 158         if ( ! OpenProcessToken( GetCurrentProcess(),
 159                 TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
 160         {
 161                 _tprintf( _T("OpenProcessToken() failed, Error = %d SeDebugPrivilege is not available.\n") , GetLastError() );
 162                 return;
 163         }
 164
 165         if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) )
 166         {
 167                 _tprintf( _T("LookupPrivilegeValue() failed, Error = %d SeDebugPrivilege is not available.\n"), GetLastError() );
 168                 CloseHandle( hToken );
 169                 return;
 170         }
 171
 172         tkp.PrivilegeCount = 1;
 173         tkp.Privileges[0].Luid = sedebugnameValue;
 174         tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 175
 176         if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
 177                 _tprintf( _T("AdjustTokenPrivileges() failed, Error = %d SeDebugPrivilege is not available.\n"), GetLastError() );
 178
 179         CloseHandle( hToken );
 180 }
 181
 182 void ShowUsage()
 183 {
 184         _tprintf( _T("WhoUses 1.0 for www.codeguru.com\n") );
 185         _tprintf( _T("Written by Zoltan Csizmadia, zoltan_csizmadia@yahoo.com \n") );
 186         _tprintf( _T("\n") );
 187         _tprintf( _T("Usage: WhoUses.exe [-M] fileName\n") );
 188         _tprintf( _T("\n") );
 189         _tprintf( _T("          -M            fileName is a module name ( EXE, DLL, ... )\n") );
 190         _tprintf( _T("          fileName      File name\n") );
 191         _tprintf( _T("\n") );
 192         _tprintf( _T("Examples:\n") );
 193         _tprintf( _T("\n") );
 194         _tprintf( _T("          WhoUses.exe -M kernel32.dll\n") );
 195         _tprintf( _T("          WhoUses.exe -M c:\\test\\test.dll\n") );
 196         _tprintf( _T("          WhoUses.exe yourTextFile.txt\n") );
 197         _tprintf( _T("          WhoUses.exe c:\\pagefile.sys\n") );
 198         _tprintf( _T("          WhoUses.exe Serial0\n") );
 199 }
 200
 201 int _tmain(int argc, TCHAR* argv[])
 202 {
 203         ULONG nonSwitchCount = 0;
 204         BOOL bModule = FALSE;
 205         LPCTSTR lpPath = NULL;
 206         BOOL bFullPathCheck = FALSE;
 207         BOOL bUsage = TRUE;
 208         TCHAR lpFilePath[_MAX_PATH];
 209
 210         for ( int i = 1; i < argc; i++ )
 211         {
 212                 if ( _tcsicmp( argv[i], _T("-h" ) ) == 0 || _tcsicmp( argv[i], _T("-?" ) ) == 0 )
 213                 {
 214                         bUsage = TRUE;
 215                         break;
 216                 }
 217                 else
 218                 if ( _tcsicmp( argv[i], _T("-m" ) ) == 0 || _tcsicmp( argv[i], _T("-m" ) ) == 0 )
 219                 {
 220                         bModule = TRUE;
 221                 }
 222                 else
 223                 {
 224                         if ( nonSwitchCount != 0 )
 225                         {
 226                                 bUsage = TRUE;
 227                                 break;
 228                         }
 229
 230                         lpPath = argv[i];
 231
 232                         bUsage = FALSE;
 233
 234                         nonSwitchCount++;
 235                 }
 236         }
 237
 238         if ( bUsage )
 239         {
 240                 ShowUsage();
 241                 return -1;
 242         }
 243
 244         EnableDebugPriv();
 245
 246         bFullPathCheck = GetFileNamePosition( lpPath ) != lpPath ;
 247
 248         if ( bFullPathCheck )
 249         {
 250                 if ( GetFullPathName( lpPath, _MAX_PATH, lpFilePath, NULL ) == 0 )
 251                 {
 252                         _tprintf( _T("GetFullPathName() failed. Error = %d\n"), GetLastError() );
 253                         return -2;
 254                 }
 255         }
 256         else
 257                 _tcscpy( lpFilePath, GetFileNamePosition( lpPath ) );
 258
 259         if ( bModule )
 260                 WhoUsesModule( lpFilePath, bFullPathCheck );
 261         else
 262                 WhoUsesFile( lpFilePath, bFullPathCheck );
 263
 264         return 0;
 265 }