列举某进程打开的文件列表

  unsigned long needed;
    DWORD size;
    SYSTEM_HANDLE shandle;
    HMODULE module = LoadLibraryW(L"Ntdll.dll");
    NtQuerySystemInformation = (QuerySystemInformation)GetProcAddress(module, "NtQuerySystemInformation");
    NtQueryObject = (QueryObject)GetProcAddress(module, "NtQueryObject");
 
    BYTE *buf = new BYTE[1024*1024*10];
    size=1024*1024*10;
	
    NTSTATUS ret = NtQuerySystemInformation(16,buf,size,&needed);
    
    HANDLE process=OpenProcess(PROCESS_ALL_ACCESS,FALSE,PID);
    HANDLE temp;
   
    for (DWORD i=4;i<needed;i+=sizeof(SYSTEM_HANDLE))
    {
        CopyMemory(&shandle,buf+i,sizeof(SYSTEM_HANDLE));
        if (shandle.dwProcessId==PID)
        {
            if (DuplicateHandle(process, (HANDLE)shandle.wValue, GetCurrentProcess(), &temp, 0, FALSE, DUPLICATE_SAME_ACCESS))
            {
				char Name[1024];
				ZeroMemory(Name, sizeof(Name));

				OBJECT_NAME_INFORMATION name,*pname;
				ULONG len;

				NtQueryObject(temp,1,&name,sizeof name,&len);
				pname=reinterpret_cast<POBJECT_NAME_INFORMATION>(new char[len]);
				NtQueryObject(temp,1,pname,len,&len);
				CComBSTR str = pname->Name.Buffer;


....................................

#include <atlbase.h>
#include <comutil.h>
#include <Ntsecapi.h>
#pragma comment(lib,"comsupp.lib")

#define PID 25780

typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION {
    ULONG Attributes;
    ACCESS_MASK GrantedAccess;
    ULONG HandleCount;
    ULONG PointerCount;
    ULONG Reserved[10];    // reserved for internal use
} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION;

typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION {
    UNICODE_STRING TypeName;
    ULONG Reserved [22];    // reserved for internal use
} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION;

typedef struct _OBJECT_NAME_INFORMATION
{
    UNICODE_STRING Name;
} OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;


typedef struct _SYSTEM_HANDLE
{
    DWORD    dwProcessId;
    BYTE     bObjectType;
    BYTE     bFlags;
    WORD     wValue;
    PVOID    pAddress;
    DWORD    GrantedAccess;
}
SYSTEM_HANDLE;


typedef NTSTATUS (__stdcall *QuerySystemInformation)(int,void*,unsigned long,unsigned long*);
typedef NTSTATUS (__stdcall *QueryObject)(HANDLE,int,void*,unsigned long,unsigned long*);


QueryObject NtQueryObject;
QuerySystemInformation NtQuerySystemInformation;

  因项目需要，需要列举进程打开的文件列表。网上找了一大圈，实在是没有现成的代码，终于搜罗了一段可以用的代码。