Pywinhandle

Introduction

It is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program, or to close any handles of a program.

Usage

Find and close handles

handles = find_handles(process_ids=[0x6600], handle_names=['HandleName'])
close_handles(handles)

[
    {
        'process_id': 0x6600,
        'handle': 0x9900,
        'name': 'HandleName',
        'type': 'HandleType'
    }
]

Links

Win32 API

• NtQuerySystemInformation function
• NtQueryObject function
• ZwDuplicateObject function

Process Utilities

• Handle
• Process Explorer