Windows API: find process for a file mapping handle

问题

I created an SSH agent (similar to PuTTY's pageant.exe) which has a predefined protocol: Authentication requests are sent to the agent window via WM_COPYDATA containing the name of a file mapping:

// mapname is supplied via WM_COPYDATA
HANDLE filemap = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, mapname);

Is it possible to find out which process (ultimatively, the process name) created a particular file mapping?

I can use GetSecurityInfo on "filemap" to get the security attributes (SID, GID, ...) but how to I get the process itself?

Important note: It is NOT possible to change the protocol (e.g. add information about the sender to WM_COPYDATA) because this is the predefined protocol used by all PuTTY-like applications!

回答1:

Don't try to find the process by file handle, it's complicated you need to enumerate process to find open handles for each. The WM_COPYDATA message send you the handle of the sender window, a call to GetWindowThreadProcessId should give your answer.

Keep in mind that WM_COPYDATA is a way to communicate between 32 and 64 bits process so your process maybe in different space than the caller.

Edit-->
You receive the sender HWND in the WM_COPYDATA you only have to use that HWND to get the process ID

switch (uiMsg)
{
case WM_COPYDATA:
    {
        DWORD theProcessID;
        GetWindowThreadProcessId((HWND) wParam, &theProcessID);
        COPYDATASTRUCT *pMyCDS = (PCOPYDATASTRUCT) lParam;
        /*...*/
    }
    /*...*/
}

来源：https://stackoverflow.com/questions/20296441/windows-api-find-process-for-a-file-mapping-handle

标签

winapi

ipc

file-mapping