那些遇到过的问题

从托管进程中切断.NET COM Interop程序集

And*_*y E 3 .net winapi activex com-interop handle

当ActiveXObject托管在Windows桌面/边栏小工具中时,该ActiveXObject会被缓存,并且其DLL文件被锁定(意味着它无法移动,删除或重命名).问题是这样的; 当小工具随后关闭时,DLL仍然被Windows边栏锁定,无法删除.这导致了一个严重的问题,即新版本的小工具无法安装在小工具的先前版本的顶部,在删除它的过程中失败而没有任何错误消息.

这不是非常用户友好,所以我正在寻找一种方法来在小工具的卸载事件中以某种方式"切断"与ActiveX控件的联系.我希望有人可以告诉我这是否可能,以及是否给我一些关于如何实现它的想法.

仅供参考,Windows边栏小工具实际上只是Internet Explorer服务器窗口,因此假设IE表现出相同的行为可能是安全的.

编辑: Unlocker似乎做了我需要做的事情,所以如何在.NET中以编程方式实现相同的功能呢？

Par*_*ice 5

好的,这是一个相当复杂的问题.我以前见过这种行为,我不熟悉Windows桌面/侧边栏小工具,因为我不使用它.但是我设法提出了三种可能的攻击方法

1. 从TechNet 处理

这不是我的想法,还有另一个StackOverflow线程推荐这种方法.但是我对这是否有效持怀疑态度.文件锁(此实用程序处理的内容)和"加载库"锁之间存在差异,我认为这是您使用ActiveX时遇到的问题.

我稍微修改了该线程的代码,在那里他们使用Process.Kill()释放锁,我认为最好使用handle.exe来释放锁.

public struct LockInfo
{
    public int PID;
    public string Handle;

    public LockInfo(int pid, string handle)
    {
        this.PID = pid;
        this.Handle = handle;
    }
}      

static List<LockInfo> getLockingInfo(string fileName)
{            
    List<LockInfo> lockingProcesses = new List<LockInfo>();

    Process tool = new Process();
    tool.StartInfo.FileName = "handle.exe";
    tool.StartInfo.Arguments = fileName;
    tool.StartInfo.UseShellExecute = false;
    tool.StartInfo.RedirectStandardOutput = true;
    tool.Start();
    tool.WaitForExit();
    string outputTool = tool.StandardOutput.ReadToEnd();

    // I;m not so hot with regex, so a bit of regex and a bit of manual splitting
    string matchPattern = @"(?<=\s+pid:\s+)\b(\d+)\b(\s+)\b(\S+:)";
    foreach (Match match in Regex.Matches(outputTool, matchPattern))
    {
        string[] temp = match.Value.Replace(":", "").Split(new char[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
        if (temp.Length == 2)
        {
            lockingProcesses.Add(new LockInfo(int.Parse(temp[0].Trim()), temp[1].Trim()));
        }
    }
    return lockingProcesses.Count > 0 ? lockingProcesses : null;
}

static bool closeFileHandle(List<LockInfo> lockingInfo)
{
    if ((lockingInfo == null) || (lockingInfo.Count == 0))
    {
        throw new ArgumentException("lockingProcesses cannot be null or empty");
    }

    bool fileClosed = true;

    foreach (LockInfo lockInfo in lockingInfo)
    {
        Process tool = new Process();
        tool.StartInfo.FileName = "handle.exe";
        tool.StartInfo.Arguments = string.Format("-c {0} -y -p {1}", lockInfo.Handle, lockInfo.PID.ToString());
        tool.StartInfo.UseShellExecute = false;
        tool.StartInfo.RedirectStandardOutput = true;
        tool.Start();
        tool.WaitForExit();
        string outputTool = tool.StandardOutput.ReadToEnd();
        if (outputTool.IndexOf("Handle closed") == -1)
        {
            fileClosed = false;
        }
    }
    return fileClosed;
}

public static void Main()
{            
    //Path to locked file, make sure the full path is in quotes
    string fileName = "\"" + @"C:\Your_Path\To_The\ActiveX.ocx" + "\"";
    List<LockInfo> lockInfo = getLockingInfo(fileName);
    if ((lockInfo != null) && (lockInfo.Count > 0))
    {
        closeFileHandle(lockInfo);
    }                                 
}
Run Code Online (Sandbox Code Playgroud)

...

2. Win32风格

关于这一点的互联网上没有太多的信息,似乎有一些未记录的api调用需要顺利地解决这个问题.

我这些c ++示例可能有所帮助.

不幸的是,我无法让它无缝地工作.我已经使用MS Word中加载的ActiveX测试了此方法.然后我尝试解锁ActiveX,它不是很稳定,经常会导致崩溃.我想我没有必要的c ++战争伤口来正确解读上述程序.

与C#中的CreateRemoteThread示例一起,我确实将此代码放在一起.

public struct ProcessInfo
{
    public Process Process;
    public ProcessModule Module;

    public ProcessInfo(Process process, ProcessModule module)
    {
        this.Process = process;
        this.Module = module;
    }
}

private static List<ProcessInfo> getProcessInfo(string fileName, bool partialMatch)
{
    List<ProcessInfo> myProcesses = new List<ProcessInfo>();

    Process[] runningProcesses = Process.GetProcesses();
    int i = 0;
    for (i = 0; i < runningProcesses.Length; i++)
    {
        Process currentProcess = runningProcesses[i];
        try
        {
            if (!currentProcess.HasExited)
            {
                try
                {
                    ProcessModuleCollection modules = currentProcess.Modules;
                    int j = 0;
                    for (j = 0; j < modules.Count; j++)
                    {
                        if (partialMatch)
                        {
                            if ((modules[j].FileName.ToLower().IndexOf(fileName.ToLower()) != -1))
                            {
                                myProcesses.Add(new ProcessInfo(currentProcess, modules[j]));
                                break;
                            }
                        }
                        else
                        {
                            if ((modules[j].FileName.ToLower().CompareTo(fileName.ToLower()) == 0))
                            {
                                myProcesses.Add(new ProcessInfo(currentProcess, modules[j]));
                                break;
                            }
                        }
                    }
                }
                catch (NotSupportedException)
                {
                    // You are attempting to access the Modules property for a process that is running on a remote computer. 
                    // This property is available only for processes that are running on the local computer. 
                }
                catch (InvalidOperationException)
                {
                    // The process Id is not available.
                }
                catch (Win32Exception)
                {
                    // You are attempting to access the Modules property for either the system process or the idle process. 
                    // These processes do not have modules.
                }
            }
        }
        catch (InvalidOperationException)
        {
            // There is no process associated with the object. 
        }
        catch (Win32Exception)
        {
            // The exit code for the process could not be retrieved. 
        }
        catch (NotSupportedException)
        {
            // You are trying to access the HasExited property for a process that is running on a remote computer.
            // This property is available only for processes that are running on the local computer.

        }
    }
    return myProcesses.Count > 0 ? myProcesses : null;
}

private static void forceRemoteCloseHandle(ProcessInfo processInfo)
{
    // Open remote process for write
    IntPtr hProcess = NativeMethods.OpenProcess(NativeMethods.PROCESS_CREATE_THREAD | NativeMethods.PROCESS_VM_OPERATION |
            NativeMethods.PROCESS_VM_WRITE | NativeMethods.PROCESS_VM_READ, false, processInfo.Process.Id);

    // Get the handle to CloseHandle in kernel32.dll
    IntPtr hKernel32 = NativeMethods.LoadLibrary("kernel32.dll");
    IntPtr hCloseHandle = NativeMethods.GetProcAddress(hKernel32, "CloseHandle");
    uint temp = 0;

    // Create the remote thread and point it to CloseHandle
    IntPtr hCreateRemoteThread = NativeMethods.CreateRemoteThread((IntPtr)hProcess, (IntPtr)0, 0, hCloseHandle, (IntPtr)processInfo.Module.BaseAddress, 0, out temp);

    // Wait for thread to end
    NativeMethods.WaitForSingleObject(hCreateRemoteThread, 2000);

    //Closes the remote thread handle
    NativeMethods.CloseHandle(hCreateRemoteThread);

    //Free up the kernel32.dll
    if (hKernel32 != null)
        NativeMethods.FreeLibrary(hKernel32);

    //Close the process handle
    NativeMethods.CloseHandle(hProcess);
}

private static void forceRemoteFreeLibrary(ProcessInfo processInfo)
{
    // Open remote process for write
    IntPtr hProcess = NativeMethods.OpenProcess(NativeMethods.PROCESS_CREATE_THREAD | NativeMethods.PROCESS_VM_OPERATION |
            NativeMethods.PROCESS_VM_WRITE | NativeMethods.PROCESS_VM_READ, false, processInfo.Process.Id);

    // Get the handle to FreeLibrary in kernel32.dll
    IntPtr hKernel32 = NativeMethods.LoadLibrary("kernel32.dll");
    IntPtr hFreeHandle = NativeMethods.GetProcAddress(hKernel32, "FreeLibrary");

    // Create the remote thread and point it to FreeLibrary
    uint temp = 0;
    IntPtr hCreateRemoteThread = NativeMethods.CreateRemoteThread((IntPtr)hProcess, (IntPtr)0, 0, hFreeHandle, (IntPtr)processInfo.Module.BaseAddress, 0, out temp);

    // Wait for thread to end
    NativeMethods.WaitForSingleObject(hCreateRemoteThread, 2000);

    //Closes the remote thread handle
    NativeMethods.CloseHandle(hCreateRemoteThread);

    //Free up the kernel32.dll
    if (hKernel32 != null)
        NativeMethods.FreeLibrary(hKernel32);

    // Close the process handle
    NativeMethods.CloseHandle(hProcess);        
}

public static void Main()
{
    string strFile = @"C:\Program Files\Microsoft Office\OFFICE11\MSCAL.OCX";
    List<ProcessInfo> lockingProcesses = getProcessInfo(strFile, false);

    foreach (ProcessInfo processInfo in lockingProcesses)
    {
        forceRemoteCloseHandle(processInfo);
        // OR
        forceRemoteFreeLibrary(processInfo);
    }

    // OR
    foreach (ProcessInfo procInfo in lockingProcesses)
    {
        procInfo.Process.Kill();
    }

}

internal static class NativeMethods
{
    internal const int PROCESS_TERMINATE = 0x0001;
    internal const int PROCESS_CREATE_THREAD = 0x0002;
    internal const int PROCESS_VM_OPERATION = 0x0008;
    internal const int PROCESS_VM_READ = 0x0010;
    internal const int PROCESS_VM_WRITE = 0x0020;

    internal const int PROCESS_QUERY_INFORMATION = 0x0400;

    [DllImport("Kernel32.dll", CharSet = CharSet.Auto)]
    internal static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
    internal static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("Kernel32.dll", CharSet = CharSet.Auto)]
    internal static extern int WaitForSingleObject(IntPtr hHandle, int dwMilliseconds);

    [DllImport("kernel32", SetLastError = true)]
    internal static extern IntPtr LoadLibrary(string lpFileName);


    [DllImport("kernel32.dll", SetLastError = true)]
    internal static extern bool FreeLibrary(IntPtr hModule);

    [DllImport("kernel32")]
    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out uint lpThreadId);

    [DllImport("Kernel32.dll", CharSet = CharSet.Auto)]
    internal static extern int CloseHandle(IntPtr hPass);
}
Run Code Online (Sandbox Code Playgroud)

...

3.只需使用解锁器

这是我最好的建议.来自technet的句柄无法处理加载的dll/ocx锁(在我的测试中).Win32很乱,没有文档.

Unlocker提供命令行访问权限,因此您可以使用与handle.exe完全相同的方式调用它.只是怪一个/？在命令提示符下的unlocker.exe之后查看开关.

还有一个可移植的Unlocker版本,因此您可以将其捆绑到部署中,而无需强制最终用户安装应用程序.

如果一切都失败了,你可以联系Unlocker的作者,从他的自述文件中查看.

许可

如果您有兴趣以原始或修改的形式重新分发Unlocker,或者希望在产品中使用Unlocker源代码,请发送电子邮件至ccollomb@yahoo.com并提供详细信息.

...

4.使用Process Hacker共享库

我刚刚发现了这个出色的工具:Process Hacker,它是用100%C#代码编写的(尽管它确实通过引擎盖下的P/Invoke使用了很多WinAPI函数).

最好的事情是:它是开源的(LGPL'd)并提供了两个开发人员可以在他们的解决方案中引用的库:ProcessHacker.Common ProcessHacker.Native.

我下载了源代码,只是一句警告,这是一个非常大的解决方案,所以可能需要一些时间来弄清楚究竟是什么/如何使用它.

它使用我在选项2中谈到的未记录的API函数(ntdll.dl),可以完成Unlocker可以做的所有事情以及更多.

归档时间：

查看次数：

651 次

最近记录：

15 年，11 月 前
如何找出使用.NET锁定文件的进程？ 148
更多相关链接
相关归档
正确实施ICloneable的方法 48
如何清除System.Net客户端DNS缓存？ 31
支持DPI和默认字体更改 27
需要一种方法从Zune和Windows Media Player使用Python检索当前播放的歌曲 9
如何有效地等待文件解锁？ 8
确定当前线程是否具有低I/O优先级 7
在 Widows 8/10 中获取 WiFi 通道的 API 5
使用C++进行静态控制背景颜色 3
垃圾收集器使用WinAPI函数时崩溃 3
为什么在Windows 7机器上的Qt Creator中_WIN32_WINNT == 0x400？ 0
难疑归档
如何在Linux上找到包含特定文本的所有文件？ 4914
如何在单个表达式中合并两个词典？ 4349
如何使用CSS垂直居中文本？ 2190
如何获得$(this)选择器的子节点？ 2182
如何检查SQL Server表中是否存在列？ 1792
.gitignore和.gitkeep有什么区别？ 1776
我如何递归grep？ 1619
Dockerfile中CMD和ENTRYPOINT有什么区别？ 1484
如何从Python字符串中修剪空格？ 1103
查找包含具有指定名称的列的所有表 - MS SQL Server 1090