我制作了这段糟糕的代码，以获取当前在Windows中播放歌曲的路径。这本来应该是通用软件，所以我希望它可以与多个程序一起使用。最初，我使用handle.exe查询通过foobar2000或vlc或itunes打开的句柄，而实际上会播放音频文件的任何东西。很好用，会吐出这样的东西：
\Device\HarddiskVolume2\Music\Mamorukun Curse OST\Mamoru-kun has been Cursed Meikai Katsugeki Arrange\02 Blossom Shower [MEIKAI ARRANGE VERSION].flac
但是，当我用unicode播放歌曲时，所有内容都会崩溃并且无法正常工作。因此，我将这段代码从任何其他人在很久以前编写的代码中添加到任何地方。它运行了，我得到它吐出了相同类型的输出，但是现在它对Unicode字符做了同样的事情。
不太确定如何以小片段形式分享此内容，因此我将转储整个项目。请记住，这段代码确实不好，令人尴尬，不是C ++或Windows api之类的专家。
#include "Main.h"
#include <Windows.h>
#include <fstream>
PVOID GetLibraryProcAddress(LPCWSTR LibraryName, LPCSTR ProcName)
{
return GetProcAddress(LoadLibrary(LibraryName), ProcName);
}
std::string getFileType(PWSTR buffer, USHORT length) {
char* temp = new char[length];
for (int i = 0; i < length; i++) {
temp[i] = (char)buffer[i];
}
return temp;
}
int main(int argc, WCHAR *argv[])
{
std::wofstream file("example.txt");
_NtQuerySystemInformation NtQuerySystemInformation = (_NtQuerySystemInformation)
GetLibraryProcAddress(L"ntdll.dll", "NtQuerySystemInformation");
_NtDuplicateObject NtDuplicateObject = (_NtDuplicateObject)
GetLibraryProcAddress(L"ntdll.dll", "NtDuplicateObject");
_NtQueryObject NtQueryObject = (_NtQueryObject)
GetLibraryProcAddress(L"ntdll.dll", "NtQueryObject");
NTSTATUS status;
PSYSTEM_HANDLE_INFORMATION handleInfo;
ULONG handleInfoSize = 0x10000;
ULONG pid;
HANDLE processHandle;
ULONG i;
// I'm entering the pid of foobar here.
pid = 17304;
if (!(processHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, pid)))
{
printf("Could not open PID %d! (Don't try to open a system process.)\n", pid);
return 1;
}
handleInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(handleInfoSize);
while ((status = NtQuerySystemInformation(
SystemHandleInformation,
handleInfo,
handleInfoSize,
NULL
)) == STATUS_INFO_LENGTH_MISMATCH)
handleInfo = (PSYSTEM_HANDLE_INFORMATION)realloc(handleInfo, handleInfoSize *= 2);
if (!NT_SUCCESS(status))
return 1;
for (i = 0; i < handleInfo->HandleCount; i++)
{
SYSTEM_HANDLE handle = handleInfo->Handles[i];
HANDLE dupHandle = NULL;
POBJECT_TYPE_INFORMATION objectTypeInfo;
PVOID objectNameInfo;
UNICODE_STRING objectName;
ULONG returnLength;
if (handle.ProcessId != pid)
continue;
if (!NT_SUCCESS(NtDuplicateObject(
processHandle,
handle.Handle,
GetCurrentProcess(),
&dupHandle,
0,
0,
0
)))
{
continue;
}
objectTypeInfo = (POBJECT_TYPE_INFORMATION)malloc(0x1000);
if (!NT_SUCCESS(NtQueryObject(
dupHandle,
ObjectTypeInformation,
objectTypeInfo,
0x1000,
NULL
)))
{
CloseHandle(dupHandle);
continue;
}
/* Query the object name (unless it has an access of
0x0012019f, on which NtQueryObject could hang.
if (handle.GrantedAccess == 0x0012019f)
{
free(objectTypeInfo);
CloseHandle(dupHandle);
continue;
}
*/
objectNameInfo = malloc(0x1000);
if (!NT_SUCCESS(NtQueryObject(
dupHandle,
ObjectNameInformation,
objectNameInfo,
0x1000,
&returnLength
)))
{
/* Reallocate the buffer and try again.
objectNameInfo = realloc(objectNameInfo, returnLength);
if (!NT_SUCCESS(NtQueryObject(
dupHandle,
ObjectNameInformation,
objectNameInfo,
returnLength,
NULL
)))
{
free(objectTypeInfo);
free(objectNameInfo);
CloseHandle(dupHandle);
continue;
}*/
}
我想做的大部分工作都包含在此处的底部，并处理objectname.Buffer，但是我希望问题出在上面的代码中，这对我来说很神奇。
/* Cast our buffer into an UNICODE_STRING. */
objectName = *(PUNICODE_STRING)objectNameInfo;
/* Print the information! */
// looking for audio files.
std::string format[4] = { ".flac",".mp3",".ogg",".wav"};
if (objectName.Length)
{
//get handle type. looking for 'File'
std::string type = getFileType(objectTypeInfo->Name.Buffer, objectTypeInfo->Name.Length / 2);
// Check to see if this Handle is a file type.
if (!type.find("File")) {
int count;
// loop through format array.
for (const std::string & word : format) {
// loop through format word one letter at a time.
count = 0;
for (int i = 0; i < word.length(); i++) {
char bChar = objectName.Buffer[(objectName.Length / 2)-word.length()+i];
// if format word char matches bChar count++ until count == word.length;
if (word.at(i) == bChar) {
count++;
}
else {
break;
}
}
// Write the matching word to file.
if (count == word.length()) {
printf("\nFile Pulled, %ls\n\n", objectName.Buffer);
file << objectName.Buffer;
break;
}
}
}
}
free(objectTypeInfo);
free(objectNameInfo);
CloseHandle(dupHandle);
}
free(handleInfo);
CloseHandle(processHandle);
file.close();
return 0;
}
我吐出来了
\Device\HarddiskVolume2\Music\Yonder Voice\Wonderful View Epilogue\04. ΓRⁿ[Γ∩ΓhΓXΓΦⁿ[Γpⁿ[.flac
这有点令人惊讶，但大多数时候它会吐出类似的东西
\Device\HarddiskVolume2\Music\Unsorted\Yonder Voice -
就好像到达一个Unicode字符的瞬间一样，它会截断它前面的所有内容。
预期的输出看起来像这样
\Device\HarddiskVolume2\Music\Unsorted\Yonder Voice - 秘封活動記録 -月- ORIGINAL SOUNDTRACK\01. 決別の旅(TV-Size).mp3
现在，当前的预期输出看起来像
\Device\HarddiskVolume2\Music\Unsorted\Yonder Voice -
尽管信息必须仍然保留在缓冲区中，因为它读取了要打印出来的.mp3供我查看。
我希望我已经很好地解释了我的问题，它在某些方面已经变得相当利基，从来没有想到过如此看似简单的事情会走上这条令人头痛和困惑的道路。