Pywinhandle

Introduction

It is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program, or to close the any handles of a program.

Usage

Find Handles

handles = find_handles(process_ids=[0x6600], handle_names=['HandleName'])

Returns:

[{'process_id': 0x6600, 'handle': 0x9900, 'name': 'HandleName', 'type': 'HandleType'}]

Close Handle

close_handle(process_id=0x6600, handle=0x9900)

Links

Win32 API

• NtQuerySystemInformation function
• NtQueryObject function
• ZwDuplicateObject function

Process Utilities

• Handle
• Process Explorer