CN102902765B - A kind of for removing the method and device that file takies - Google Patents
A kind of for removing the method and device that file takies Download PDFInfo
- Publication number
- CN102902765B CN102902765B CN201210361922.6A CN201210361922A CN102902765B CN 102902765 B CN102902765 B CN 102902765B CN 201210361922 A CN201210361922 A CN 201210361922A CN 102902765 B CN102902765 B CN 102902765B
- Authority
- CN
- China
- Prior art keywords
- handle
- file
- privately owned
- unit
- files
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 270
- 230000008569 process Effects 0.000 claims abstract description 225
- 238000012216 screening Methods 0.000 claims description 12
- 241001280173 Crassula muscosa Species 0.000 claims description 10
- 230000008859 change Effects 0.000 claims description 8
- 230000002776 aggregation Effects 0.000 claims description 3
- 238000004220 aggregation Methods 0.000 claims description 3
- 238000001914 filtration Methods 0.000 claims description 3
- 230000006870 function Effects 0.000 description 10
- 230000026676 system process Effects 0.000 description 9
- 238000005516 engineering process Methods 0.000 description 6
- 230000008901 benefit Effects 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000004590 computer program Methods 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000012217 deletion Methods 0.000 description 1
- 230000037430 deletion Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000004321 preservation Methods 0.000 description 1
- 238000013404 process transfer Methods 0.000 description 1
- 230000009897 systematic effect Effects 0.000 description 1
Abstract
The invention discloses a kind of for removing the method that file takies, comprising: obtain the All Files handle waiting to remove the file destination taken; Wait to remove the privately owned handle table of process that the All Files handle of the file destination taken is affiliated separately described in acquisition; The file handle object of the All Files handle of described file destination is removed by the privately owned handle table of respective process; The reference count of the file handle object of the All Files handle of described file destination is reset from system.The present invention also discloses a kind of for removing the device that file takies.The present invention removes when file takies need not copy handle, can not destroy the normal operation of the file that is opened.
Description
Technical field
The present invention relates to field of computer technology, particularly relating to a kind of for removing the method that file takies.The invention still further relates to a kind of for removing the device that file takies.
Background technology
It is the function that more current fail-safe softwares provide that releasing file takies.Because file is after by process transfer, manually such as operations such as renaming can not be deleted.Utilize this function can remove process taking file, thus allow user can perform deleted file, the change operation such as title, shift position.
Under existing form (window) operating system, a kind of to remove the Method And Principle that file takies as follows: if file is opened by certain process, so this process just has its handle.Function ZwQuerySystemInformation () is used to enumerate handle, each handle DuplicateHandle is copied, determine which file handle belongs to, if the file that will look for, just handle is copied, then use DuplicateHandle to go to close the handle taken.
Above-mentioned method can run into two place's difficult points in practice.First, when the handle processed the named pipes opened (namedpipe) calls ZwQueryInformationFile (), invokes thread can wait for the message in pipe, and message in pipe, may do not had, that is, the thread calling ZwQueryInformationFile () has in fact permanently been hung up.Second, after copy handle, two handles (our process and open file process) will point to same file destination, thus the current input and output mode of file, position hereof and other information associated with the file will be shared by two processes.At this moment, even just file reading (copying handle or original handle) all can cause the change of load position, thus destroys the normal operation of the program of opening file.
Although first above-mentioned difficult point can solve in the following way, namely the acquisition of file destination not be used in the main thread selecting handle and carries out, but start independently thread and arrange a time-out time avoid hang up.But this method comparatively bothers, and efficiency is low.Second above-mentioned difficult point, needs stop taking the thread of file process, copied files or restart the modes such as the process that takies file and solve.But these methods can not be used for many situations, such as registry file to be copied in the system run, in this way would not be successful.Thus still limitation is had on using.
Summary of the invention
In view of the above problems, propose the present invention in case provide a kind of overcome the problems referred to above or solve the problem at least in part for removing method that file takies and corresponding for removing the device that file takies.
According to one aspect of the present invention, providing a kind of for removing the method that file takies, comprising:
Obtain the All Files handle waiting to remove the file destination taken;
Wait to remove the privately owned handle table of process that the All Files handle of the file destination taken is affiliated separately described in acquisition;
The file handle object of the All Files handle of described file destination is removed by the privately owned handle table of respective process;
The reference count of the file handle object of the All Files handle of described file destination is reset from system.
Optionally, described acquisition waits that the All Files handle removing the file destination taken comprises:
Obtain the path of waiting to remove the file destination taken;
The All Files handle that the system of enumerating is opened;
Obtain the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated;
Using the file handle that the match is successful as waiting the handle removing the file destination taken.
Optionally, the All Files handle that system of enumerating described in is opened comprises:
Enumerate all processes of system;
Obtain the privately owned handle table of each process;
Gather the privately owned handle table of all processes, obtain the handle that all processes are opened;
All file handles are found out in the handle that described all processes are opened.
Optionally, all processes enumerating system described at least comprise the steps:
By the data structure that each process in traversal active process chained list is represented in system kernel, realize enumerating active process, obtain plan.
Optionally, described in enumerate the All Files handle that system opens and comprise,
Obtain current process;
Obtain the privately owned handle table of this current process;
The handle watch chain that the privately owned handle table of the privately owned handle table and other process that travel through this current process is formed, obtains other process;
Its privately owned handle table is obtained to the process of all acquisitions;
Gather the privately owned handle table obtained, obtain the handle that all processes are opened;
All file handles are found out in the handle that described all processes are opened.
Optionally, find out all file handles in the described handle opened in described all processes to comprise:
The object head of the handle object of each handle finding each process to open is offset by internal memory;
Reading object categorical data or object type index in object head;
Handle type is judged according to the object type data of object type data or object type index point in object head;
Filter out the handle that type is file handle.
Optionally, file handle object is comprised path by the mode that removes in the handle table of process to wipe or path change.
According to a further aspect in the invention, also providing a kind of for removing the device that file takies, comprising:
File destination handle acquiring unit, waits to remove the All Files handle of the file destination taken for obtaining;
Process handle table acquiring unit, for wait to remove the file destination taken described in obtaining All Files handle separately belonging to the privately owned handle table of process;
File handle object removes unit, and the file handle object for the All Files handle by described file destination removes by the privately owned handle table of respective process;
Reset unit, the reference count for the file handle object of the All Files handle by described file destination resets from system.
Optionally, described file destination handle acquiring unit comprises:
Path acquiring unit, for obtaining the path of waiting to remove the file destination taken;
File handle enumeration unit, for enumerating the All Files handle that system is opened;
Matching unit, for obtaining the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated.
Optionally, described file handle enumeration unit also comprises:
Process enumeration unit, for enumerating all processes of system;
Privately owned handle enumeration unit, for obtaining the privately owned handle table of process;
Privately owned handle table aggregation units, for gathering the privately owned handle table of all processes, obtains the handle that all processes are opened;
File handle screening unit, finds out all file handles in the handle opened in described all processes.
Optionally, described process enumeration unit comprises:
Process traversal performance element, for traveling through the data structure that in active process chained list, each process is represented in system kernel;
Storage unit, for storing the plan of acquisition.
Optionally, described file handle enumeration unit comprises:
Designating unit, is used to specify current arbitrary process;
Privately owned handle enumeration unit, for obtaining the privately owned handle table of current process;
Handle watch chain traversal performance element, the handle watch chain that the privately owned handle table for the privately owned handle table and other process that travel through this current process is formed, obtains other process;
Privately owned handle table merge cells, for gathering obtained privately owned handle table, obtains the handle that all processes are opened;
File handle screening unit, finds out all file handles in the handle opened in described all processes.
Optionally, described file handle screening unit also comprises:
Object head determining unit; For being offset the object head of the handle object of each handle finding each process to open by internal memory;
Object type or types index reading unit, for reading object categorical data in object head or object type index;
Judging unit, for judging handle type according to the object type data of object type data or object type index point in object head;
Screening unit, for filtering out the handle that type is file handle.
Optionally, described file handle object removes unit is file path erase unit or path change unit.
According to specific embodiment provided by the invention, the invention discloses following technique effect: method of the present invention is by finding the file handle of file destination, and directly file handle object is operated in handle table, it is removed by handle table, and the reference count of file handle object is reduced to zero from system, system is thought, and this object quoted without any other process; Thus reach the object removed file and taken by process;
Relative to the method that the releasing file described in background technology takies, method of the present invention need not copy handle, thus do not exist yet call ZwQueryInformationFile thread by the problem forever hung up; Secondly, because method of the present invention need not copy handle, naturally there is not the problem that two handles (copying handle and former handle) point to same file destination simultaneously yet, then do not exist and destroy due to some the operation file in two processes the normal problem run that opens file.
Above-mentioned explanation is only the general introduction of technical solution of the present invention, in order to technological means of the present invention can be better understood, and can be implemented according to the content of instructions, and can become apparent, below especially exemplified by the specific embodiment of the present invention to allow above and other objects of the present invention, feature and advantage.
Accompanying drawing explanation
By reading hereafter detailed description of the preferred embodiment, various other advantage and benefit will become cheer and bright for those of ordinary skill in the art.Accompanying drawing only for illustrating the object of preferred implementation, and does not think limitation of the present invention.And in whole accompanying drawing, represent identical parts by identical reference symbol.In the accompanying drawings:
Fig. 1 is the process flow diagram of a kind of embodiment for removing the method that file takies of the present invention;
Fig. 2 is the structural representation of a kind of embodiment for removing the device that file takies of the present invention.
Embodiment
Below with reference to accompanying drawings exemplary embodiment of the present disclosure is described in more detail.Although show exemplary embodiment of the present disclosure in accompanying drawing, however should be appreciated that can realize the disclosure in a variety of manners and not should limit by the embodiment set forth here.On the contrary, provide these embodiments to be in order to more thoroughly the disclosure can be understood, and complete for the scope of the present disclosure can be conveyed to those skilled in the art.
Please refer to Fig. 1, it is the process flow diagram of a kind of embodiment for removing the method that file takies of the present invention.The method of the present embodiment comprises the steps:
Step 100, obtains the All Files handle waiting to remove the file destination taken.
In Windows operating system, if file open by certain process, so described process just has the handle of this file, and this handle points to the file opened.Find this process, and remove the handle of this file of sensing that this process has, then the operation such as amendment, deletion, preservation of this file is no longer subject to the restriction of this process.Therefore first need to obtain all processes with waiting to remove the file that takies and being associated by the mode of enumeration process in systems in which, and file handle is found out from all handles that this process has, the handle of this file that this process has could be removed.
In this step, described acquisition waits that the All Files handle removing the file destination taken comprises: A, obtain the path of waiting to remove the file destination taken; The All Files handle that B, the system of enumerating are opened; C, obtain the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated; Using the file handle that the match is successful as waiting the handle removing the file destination taken.
Specifically, first, obtain the file waiting to remove the file destination taken and deposit path, this step is not difficult to accomplish.
Then, the All Files handle needing system of enumerating to open.Enumerate two kinds of embodiments in the present embodiment and the All Files handle how enumerated system and open is described.
Embodiment one: b11, enumerates all processes of system; B12 obtains the privately owned handle table of each process; B13 gathers the privately owned handle table of all processes, obtains the handle that all processes are opened; All file handles are found out in the handle that b14 opens in described all processes.The method of the described all processes of system of enumerating have a lot of in, enumerate two kinds wherein here: first method, enumerate system process by the system process of Windows system and thread object handle table (PspCidTable).Wherein, system process and thread object handle table (PspCidTable) are a kind of handle tables in Windows system, wherein deposit to as if system in all enter thread object.As long as this PspCidTable handle table therefore can be traveled through, all processes of system just can be traversed.Be understood that, if for obtaining enumeration process by PspCidTable, then first need to obtain PspCidTable, namely navigate to the first address of described PspCidTablede.The method obtaining described PspCidTablede has a variety of, enumerates one wherein here: by signature search positioning system process in function PsLookupProcessThreadByCid () or PsLookupProcessByProcessId (), PsLookupThreadByThreadId () and thread object handle table.Can use PspCidTable time so-called memory features search refers to and calls these functions, but the place that the PspCidTable in individual system occurs is different, search can be realized according to the feature before and after PspCidTable.Wherein, the feature string of described signature search is likely different under different operating system, is in 0x35FF and 0xe8, Win7 be 0x3D8B and 0xe8 in Windows2000 and 2003.Certainly, PspCidTable can also be obtained by alternate manner, will not enumerate here.
PspCidtable is _ Handle_Table structure, in windows2000 system, it is three layers of fixing list structure, the base address of three layers of table and one-level table (one-level table, also referred to as base table, is orlop table), secondary table and three grades of tables (for the superiors' table) is record in TableCode.In above-mentioned three layers of table, the address pointer deposited in last layer table points to next layer address closed on it, point to the pointer of secondary table as what deposit in three grades of tables, what deposit in secondary table is the pointer pointing to base table, and that deposits in base table is only the pointer pointing to process object or thread.And in Windowsxp and Windows2003, in order to save system space, have employed three layers of list structure of dynamic scalable, when handle number is less time, only adopt base table, just system can enable secondary table when handle number is larger, until three grades of tables.
No matter be the above-mentioned three layers of list structure fixing three layers of list structure or dynamic scalable, all need to travel through according to fixing step-length the address pointer that every one deck deposits according to the base address of every one deck table, all handle list items in this handle table can be obtained.Only in three layers of list structure of dynamic scalable, first need to judge that its real handle top layer number is how many, and then perform the traversal of corresponding layer according to the handle top layer number of this reality.Wherein, in three layers of dynamic scalable table, latter two of TableCode is the foundation judging handle top layer number, and latter two be 00 is one deck list structure, and latter two be 01 is two-layer list structure, and latter two be 10 is three layers of list structure.
As mentioned above, in PspCidTable handle table, what deposit is the object handle of system process and thread.Can be obtained the sensing pointer to object of record in basic unit's table by traversal, but this pointer points to subject, cannot judge that it is process or thread.Therefore also need to obtain type by skew be _ OBJECT_HEADER, the pointer that points to object head, and read its pointer type by object head pointer, what can determine pointed is process or thread.Select the object head pointer that type is process, the subject pointer corresponding to this object head pointer is process object head pointer, by described process object head pointer, both can obtain corresponding process.Travel through this PspCidTable handle table, the described process recorded in this handle table can be obtained, namely obtain the data structure _ EPROCESS of all process objects.
Judge in the present embodiment that in object head pointer, type is the pointer type information of process in the following way, namely obtain current process by the function such as PsGetCurrentProcess () or IoGetCurrentProcess (), obtain its object head pointer by the subject pointer offset of this current process; Its pointer type information is read in this object head pointer.
The described second method enumerating system process is as follows: first, obtains the pointer of current process, such as, can be obtained the PEPROCESS pointer of current process by PsGetCurrentProcess ().Then navigate to the Activelist place recording this current process and other process link information, concrete mode of operation is ActiveList=pCurrentEprocess+0x88, the step-length that namely current process pointer movement is certain.Wherein 0x88 is the step-length of Activelist and pCurrentEprocess under Winxpsp3, and when different win operating system, this step-length is not identical.Then, the data structure traveling through whole Process Movement chained list (Activelistlink) each process upper with the Activelist of located current process, can obtain the current all processes being present in Process Movement chained list.
Above-mentionedly list the two kinds of methods enumerating system process, but and non exhaustive, any method that can be used in enumerating system process all can be applicable to this.
For each process enumerated, obtain its privately owned handle table.Obtain manner is the step-length that the EPROCESS first address skew of process is fixed.For WindowsXP, offset step is 0xc4 (sexadecimal).In WindowsXP, for any process, the offset step between pointer pCurrentProcess and privately owned handle table is 0xc4 (sexadecimal).In the window system of other different editions, such as window2000, vista, win7 etc., offset step is then different, and those skilled in the art can obtain corresponding step-length according to the version of each windows.
By the privately owned handle table set of all processes, all handles that acquisition process is opened.And find out all file handles by described handle in the following way: the object head being offset the handle object of each handle finding each process to open by internal memory; Reading object categorical data or object type index in object head; Handle type is judged according to the object type data of object type data or object type index point in object head; Filter out the handle that type is file handle.
Embodiment two: b21, acquisition current process; B22, obtain the privately owned handle table of this current process; The handle watch chain that the privately owned handle table of b23, the privately owned handle table traveling through this current process and other process is formed, obtains other process; B24, its privately owned handle table is obtained to the process of all acquisitions; The privately owned handle table that b25, set obtain, obtains the handle that all processes are opened; All file handles are found out in b26, the handle opened in described all processes.Specifically, in windows system, each process has a handle table (handletable), and this handle table is called the privately owned handle table of process.The privately owned handle table of described process is one _ HANDLE_TABLE structure, and in system, the privately owned handle table of all processes links together with the form of doubly linked list.If therefore obtain the privately owned handle table of current process, and travel through described doubly linked list according to certain step-length, the privately owned handle table of all processes can be obtained.
A kind of specific implementation of the privately owned handle table of described acquisition current process is as follows: a, obtains the pointer pointing to current process; B, is obtained the privately owned handle list index of current process by the pointer offset of described current process; C, navigates to the privately owned handle table of this current process according to the privately owned handle list index of described current process.Concrete, the pointer of current process can be obtained by PsGetCurrentProcess () or IoGetCurrentProcess ().In windows system, due to the restriction of scheduled resource, same process also can be divided into the execution of different time period parts when performing, different processes is interted together when performing, Gu in interval sometime, multiple process may be had to carry out at the same time.And on sometime, performing in most cases be a process (be certainly also not precluded within comprise the system resource such as CPU (central processing unit), internal memory abundant when, two or more task parallelism runs).Can obtain pointing to the pointer of the process run in the call function moment by described PsGetCurrentProcess () or IoGetCurrentProcess () function, namely point to the pointer pCurrentProcess of the process structure body _ EPROCESS of current process.In the present embodiment, namely current process refers to call the process that the described function moment running.The current process of described acquisition can be any process in windows system,
After obtaining the pointer pCurrentProcess pointing to current arbitrary process, the step-length fixing by described pointer offset, can obtain the privately owned handle table of arbitrary process before deserving.As mentioned above, in windowsXP system, the pointer pCurrentProcess pointing to current process offsets 0xc4 (sexadecimal), can obtain the privately owned handle table of described current process, namely
pHandleTable＝pCurrentProcess+0xc4，
In the systems such as Window2000, vista, Win7, offset step is then different, and those skilled in the art can obtain corresponding step-length according to the version of each Windows.The privately owned handle table of this current process can be navigated to according to the privately owned handle list index of described current process.
As previously mentioned, in windows system, in system, the privately owned handle table of all processes links together with the form of doubly linked list.The privately owned handle table of process is _ HANDLE_TABLE structure, for arbitrary handle table, offsets 0x1c (sexadecimal) can point to its type and be by pHandleTable _ member variable the HandleTableList of LIST_ENTRY, i.e. handle watch chain.Each HandleTableList has Flink and Blink two members, and Flink member is a forward link, points to the next one _ LIST_ENTRY structure; Blink member is then a back link, points to previous LIST_ENTRY structure.Whole chained list forms closed ring, and that is, last Flink points to first LIST_ENTRY structure in chained list, and first Blink then points to last.In system the handle table of all processes be all pass through _ link of the doubly linked list of LIST_ENTRY type gets up.Therefore travel through this doubly linked list according to certain step-length, process that can be all in acquisition system.
When traveling through described doubly linked list, can on the privately owned handle table basis of the current process of aforementioned acquisition, offset forward or backward certain step-length (step-length of described skew is determined according to the version of win system) and obtain adjacent HandleTableList, and namely address offset-the 0x1c (sexadecimal) of the HandleTableList offseting acquisition is each time obtained to the pHandleTable of the privately owned handle table at its place; Namely obtain the privately owned handle table at HandleTableList place.
The privately owned table of all processes, the privately owned handle table described in set can be obtained by traversal, after obtaining the handle that all processes open, can find out all file handles by a kind of described mode of above-described embodiment.
To found out All Files handle, obtain the concrete path of the file of its correspondence, and with wait that the path of removing the file destination taken is mated, wherein, the mode of coupling is the contrast of simple path string, case-insensitive during contrast.If the concrete path of file handle is identical with waiting the path of removing the file destination taken, then the match is successful, using the file handle that the match is successful as waiting the handle removing the file destination taken.
Step 110, waits to remove the privately owned handle table of process that the All Files handle of the file destination taken is affiliated separately described in acquisition.
As mentioned above, file handle is obtained by the privately owned handle table of process by the method enumerating system process, nature, by the file handle also privately owned handle table at its place known and process.
Step 120, removes the file handle object of the All Files handle of described file destination by the privately owned handle table of respective process.
After obtaining all processes and its privately owned handle table opening this file, can directly remove by its privately owned handle table.
Step 130, resets the reference count of the file handle object of the All Files handle of described file destination from system.
File handle object after removing still is present in internal memory, at this time needs the reference count of this file handle object to reduce to zero from system (internal memory), and this object refer to without any other processes to make system think like this.
The method of the present embodiment is by finding the file handle of file destination, and directly file handle object is operated in handle table, it is removed by handle table, and the reference count of file handle object is reduced to zero from system, system is thought, and this object quoted without any other process; Thus reach the object removed file and taken by process;
Relative to the method that the releasing file described in background technology takies, method of the present invention need not copy handle, thus do not exist yet call ZwQueryInformationFile thread by the problem forever hung up; Secondly, because method of the present invention need not copy handle, naturally there is not the problem that two handles (copying handle and former handle) point to same file destination simultaneously yet, then do not exist and destroy due to some the operation file in two processes the normal problem run that opens file.
Disclosed above the embodiment for removing the method that file takies of the present invention, therewith accordingly, the invention also discloses a kind of for removing the device that file takies.Please refer to Fig. 2, it is the schematic diagram of a kind of embodiment for removing the device that file takies of the present invention.Because the embodiment of this device is substantially identical with the embodiment of aforesaid method, the device in the present embodiment is only simply described below.
A kind of embodiment for removing the device that file takies of the present invention, comprising: file destination handle acquiring unit 200, waits to remove the All Files handle of the file destination taken for obtaining; Process handle table acquiring unit 202, for wait to remove the file destination taken described in obtaining All Files handle separately belonging to the privately owned handle table of process; File handle object removes unit 204, and the file handle object for the All Files handle by described file destination removes by the privately owned handle table of respective process; Reset unit 206, the reference count for the file handle object of the All Files handle by described file destination resets from system.
Optionally, described file destination handle acquiring unit 200 comprises: path acquiring unit, the path file handle enumeration unit of the file destination taken is waited to remove for obtaining, for enumerating the All Files handle matching unit that system is opened, for obtaining the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated.
Optionally, described file handle enumeration unit also comprises: process enumeration unit, for enumerating all processes of system; Privately owned handle enumeration unit, for obtaining the privately owned handle table of process; Privately owned handle table aggregation units, for gathering the privately owned handle table of all processes, obtains the handle that all processes are opened; File handle screening unit, finds out all file handles in the handle opened in described all processes.
Optionally, described process enumeration unit comprises: process traversal performance element, for traveling through the data structure that in active process chained list, each process is represented in system kernel; Storage unit, for storing the plan of acquisition.
Optionally, described file handle enumeration unit comprises: designating unit, is used to specify current arbitrary process; Privately owned handle enumeration unit, for obtaining the privately owned handle table of current process; Handle watch chain traversal performance element, the handle watch chain that the privately owned handle table for the privately owned handle table and other process that travel through this current process is formed, obtains other process; Privately owned handle table merge cells, for gathering obtained privately owned handle table, obtains the handle that all processes are opened; File handle screening unit, finds out all file handles in the handle opened in described all processes.
Optionally, described file handle screening unit also comprises: object head determining unit; For being offset the object head of the handle object of each handle finding each process to open by internal memory; Object type or types index reading unit, for reading object categorical data in object head or object type index; Judging unit, for judging handle type screening unit according to the object type data of object type data or object type index point in object head, for filtering out the handle that type is file handle.
Optionally, described file handle object removes unit is file path erase unit or path change unit.
The device of the application embodiment of the present invention can obtain the technique effect identical with said method embodiment, repeats no more here.
The application can be applied to computer system/server, and it can operate with other universal or special computing system environment numerous or together with configuring.The example of the well-known computing system being suitable for using together with computer system/server, environment and/or configuration includes but not limited to: personal computer system, server computer system, thin client, thick client computer, hand-held or laptop devices, system based on microprocessor, Set Top Box, programmable consumer electronics, NetPC Network PC, minicomputer system, large computer system and comprise the distributed cloud computing technology environment of above-mentioned any system, etc.Computer system/server can describe under the general linguistic context of the computer system executable instruction (such as program module) performed by computer system.Usually, program module can comprise routine, program, target program, assembly, logic, data structure etc., and they perform specific task or realize specific abstract data type.Computer system/server can be implemented in distributed cloud computing environment, and in distributed cloud computing environment, task is performed by the remote processing devices by communication network links.In distributed cloud computing environment, program module can be positioned at and comprise on the Local or Remote computing system storage medium of memory device.
Intrinsic not relevant to any certain computer, virtual system or miscellaneous equipment with display at this algorithm provided.Various general-purpose system also can with use based on together with this teaching.According to description above, the structure constructed required by this type systematic is apparent.In addition, the present invention is not also for any certain programmed language.It should be understood that and various programming language can be utilized to realize content of the present invention described here, and the description done language-specific is above to disclose preferred forms of the present invention.
In instructions provided herein, describe a large amount of detail.But can understand, embodiments of the invention can be put into practice when not having these details.In some instances, be not shown specifically known method, structure and technology, so that not fuzzy understanding of this description.
Similarly, be to be understood that, in order to simplify the disclosure and to help to understand in each inventive aspect one or more, in the description above to exemplary embodiment of the present invention, each feature of the present invention is grouped together in single embodiment, figure or the description to it sometimes.But, the method for the disclosure should be construed to the following intention of reflection: namely the present invention for required protection requires feature more more than the feature clearly recorded in each claim.Or rather, as claims below reflect, all features of disclosed single embodiment before inventive aspect is to be less than.Therefore, the claims following embodiment are incorporated to this embodiment thus clearly, and wherein each claim itself is as independent embodiment of the present invention.
Those skilled in the art are appreciated that and adaptively can change the module in the equipment in embodiment and they are arranged in one or more equipment different from this embodiment.Module in embodiment or unit or assembly can be combined into a module or unit or assembly, and multiple submodule or subelement or sub-component can be put them in addition.Except at least some in such feature and/or process or unit be mutually repel except, any combination can be adopted to combine all processes of all features disclosed in this instructions (comprising adjoint claim, summary and accompanying drawing) and so disclosed any method or equipment or unit.Unless expressly stated otherwise, each feature disclosed in this instructions (comprising adjoint claim, summary and accompanying drawing) can by providing identical, alternative features that is equivalent or similar object replaces.
In addition, those skilled in the art can understand, although embodiments more described herein to comprise in other embodiment some included feature instead of further feature, the combination of the feature of different embodiment means and to be within scope of the present invention and to form different embodiments.Such as, in the following claims, the one of any of embodiment required for protection can use with arbitrary array mode.
All parts embodiment of the present invention with hardware implementing, or can realize with the software module run on one or more processor, or realizes with their combination.It will be understood by those of skill in the art that the some or all functions for removing the some or all parts in device that file takies that microprocessor or digital signal processor (DSP) can be used in practice to realize according to the embodiment of the present invention.The present invention can also be embodied as part or all equipment for performing method as described herein or device program (such as, computer program and computer program).Realizing program of the present invention and can store on a computer-readable medium like this, or the form of one or more signal can be had.Such signal can be downloaded from internet website and obtain, or provides on carrier signal, or provides with any other form.
The present invention will be described instead of limit the invention to it should be noted above-described embodiment, and those skilled in the art can design alternative embodiment when not departing from the scope of claims.In the claims, any reference symbol between bracket should be configured to limitations on claims.Word " comprises " not to be got rid of existence and does not arrange element in the claims or step.Word "a" or "an" before being positioned at element is not got rid of and be there is multiple such element.The present invention can by means of including the hardware of some different elements and realizing by means of the computing machine of suitably programming.In the unit claim listing some devices, several in these devices can be carry out imbody by same hardware branch.Word first, second and third-class use do not represent any order.Can be title by these word explanations.
Claims (12)
1., for removing the method that file takies, comprising:
Obtain the All Files handle waiting to remove the file destination taken; Described acquisition waits that the All Files handle removing the file destination taken comprises: obtain the path of waiting to remove the file destination taken; By the All Files handle that process privately owned handle table acquisition system is opened; Obtain the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated; Using the file handle that the match is successful as waiting the handle removing the file destination taken;
Wait to remove the privately owned handle table of process that the All Files handle of the file destination taken is affiliated separately described in acquisition;
The file handle object of the All Files handle of described file destination is removed by the privately owned handle table of respective process;
The reference count of the file handle object of the All Files handle of described file destination is reset from system.
2. according to claim 1 for removing the method that file takies, described method also comprises: the All Files handle that the system of enumerating is opened, described in enumerate the All Files handle that system opens and comprise:
Enumerate all processes of system;
Obtain the privately owned handle table of each process;
Gather the privately owned handle table of all processes, obtain the handle that all processes are opened;
All file handles are found out in the handle that described all processes are opened.
3. according to claim 2 for removing the method that file takies, described in enumerate system all processes at least comprise the steps:
By the data structure that each process in traversal active process chained list is represented in system kernel, realize enumerating active process, obtain plan.
4. according to claim 1 for removing the method that file takies, described method also comprises: the All Files handle that the system of enumerating is opened, described in enumerate the All Files handle that system opens and comprise,
Obtain current process;
Obtain the privately owned handle table of this current process;
The handle watch chain that the privately owned handle table of the privately owned handle table and other process that travel through this current process is formed, obtains other process;
Its privately owned handle table is obtained to the process of all acquisitions;
Gather the privately owned handle table obtained, obtain the handle that all processes are opened;
All file handles are found out in the handle that described all processes are opened.
5. according to claim 2 or 4 for removing the method that file takies, find out all file handles in the described handle opened in described all processes and comprise:
The object head of the handle object of each handle finding each process to open is offset by internal memory;
Reading object categorical data or object type index in object head;
Handle type is judged according to the object type data of object type data or object type index point in object head;
Filter out the handle that type is file handle.
6. according to claim 1 for removing the method that file takies, file handle object is comprised path by the mode that removes in the handle table of process and wipes or path change.
7., for removing the device that file takies, comprising:
File destination handle acquiring unit, waits to remove the All Files handle of the file destination taken for obtaining; Described file destination handle acquiring unit comprises: path acquiring unit, for obtaining the path of waiting to remove the file destination taken; File handle obtains unit, for being obtained the All Files handle that system is opened by the privately owned handle table of process; Matching unit, for obtaining the concrete path of All Files handle respective file, and with wait that the path of removing the file destination taken is mated;
Process handle table acquiring unit, for wait to remove the file destination taken described in obtaining All Files handle separately belonging to the privately owned handle table of process;
File handle object removes unit, and the file handle object for the All Files handle by described file destination removes by the privately owned handle table of respective process;
Reset unit, the reference count for the file handle object of the All Files handle by described file destination resets from system.
8. according to claim 7 for removing the device that file takies, described device also comprises file handle enumeration unit, and described file handle enumeration unit also comprises:
Process enumeration unit, for enumerating all processes of system;
Privately owned handle enumeration unit, for obtaining the privately owned handle table of process;
Privately owned handle table aggregation units, for gathering the privately owned handle table of all processes, obtains the handle that all processes are opened;
File handle screening unit, finds out all file handles in the handle opened in described all processes.
9. according to claim 8 for removing the device that file takies, described process enumeration unit comprises:
Process traversal performance element, for traveling through the data structure that in active process chained list, each process is represented in system kernel;
Storage unit, for storing the plan of acquisition.
10. according to claim 7 for removing the device that file takies, described device also comprises file handle enumeration unit, and described file handle enumeration unit comprises:
Designating unit, is used to specify current arbitrary process;
Privately owned handle enumeration unit, for obtaining the privately owned handle table of current process;
Handle watch chain traversal performance element, the handle watch chain that the privately owned handle table for the privately owned handle table and other process that travel through this current process is formed, obtains other process;
Privately owned handle table merge cells, for gathering obtained privately owned handle table, obtains the handle that all processes are opened;
File handle screening unit, finds out all file handles in the handle opened in described all processes.
Described in 11. according to Claim 8 or 10 for removing the device that file takies, described file handle screening unit also comprises:
Object head determining unit; For being offset the object head of the handle object of each handle finding each process to open by internal memory;
Object type or types index reading unit, for reading object categorical data in object head or object type index;
Judging unit, for judging handle type according to the object type data of object type data or object type index point in object head;
Screening unit, for filtering out the handle that type is file handle.
12. is according to claim 7 for removing the device that file takies, and it is file path erase unit or path change unit that described file handle object removes unit.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210361922.6A CN102902765B (en) | 2012-09-25 | 2012-09-25 | A kind of for removing the method and device that file takies |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201210361922.6A CN102902765B (en) | 2012-09-25 | 2012-09-25 | A kind of for removing the method and device that file takies |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102902765A CN102902765A (en) | 2013-01-30 |
| CN102902765B true CN102902765B (en) | 2015-12-09 |
Family
ID=47574997
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201210361922.6A Active CN102902765B (en) | 2012-09-25 | 2012-09-25 | A kind of for removing the method and device that file takies |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102902765B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104750605B (en) * | 2013-12-30 | 2018-08-14 | 伊姆西公司 | Include in user's dump by kernel objects information |
| US9699152B2 (en) * | 2014-08-27 | 2017-07-04 | Microsoft Technology Licensing, Llc | Sharing content with permission control using near field communication |
| CN105512151A (en) * | 2014-10-16 | 2016-04-20 | 安一恒通（北京）科技有限公司 | Method and device for relieving document occupation |
| CN104503704B (en) * | 2014-12-19 | 2018-05-04 | 北京奇虎科技有限公司 | The method for cleaning and device of a kind of disk space |
| CN106951326B (en) * | 2017-03-16 | 2023-01-06 | 腾讯科技（深圳）有限公司 | File unlocking method and electronic equipment |
| CN107515935A (en) * | 2017-08-29 | 2017-12-26 | 郑州云海信息技术有限公司 | A kind of method and system for releasing file lock failure |
| CN110765456A (en) * | 2018-11-07 | 2020-02-07 | 北京安天网络安全技术有限公司 | Method and device for detecting hidden process and storage equipment |
| CN112711562B (en) * | 2020-12-31 | 2024-03-26 | 珠海豹趣科技有限公司 | File migration method and device, electronic equipment and storage medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| FI108694B (en) * | 1999-05-24 | 2002-02-28 | Nokia Oyj | connection Handle |
| CN101373505B (en) * | 2008-06-17 | 2011-12-21 | 成都市华为赛门铁克科技有限公司 | Method and apparatus for releasing handle and file deleting system |
| CN102214088B (en) * | 2010-04-07 | 2015-07-01 | 腾讯科技（深圳）有限公司 | Document unlocking method and device |
| CN102508713B (en) * | 2011-10-12 | 2015-01-28 | 杭州华三通信技术有限公司 | Progress starting method, kernel and progress |
| CN102662882B (en) * | 2012-03-30 | 2015-04-29 | 北京奇虎科技有限公司 | Method and device for unloading mobile storage equipment |
-
2012
- 2012-09-25 CN CN201210361922.6A patent/CN102902765B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN102902765A (en) | 2013-01-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102902765B (en) | A kind of for removing the method and device that file takies | |
| Isah et al. | A survey of distributed data stream processing frameworks | |
| Bajaber et al. | Big data 2.0 processing systems: Taxonomy and open challenges | |
| US20170017708A1 (en) | Entity-relationship modeling with provenance linking for enhancing visual navigation of datasets | |
| Capriolo et al. | Programming Hive: Data warehouse and query language for Hadoop | |
| US9977659B2 (en) | Managing data set objects | |
| US9747127B1 (en) | Worldwide distributed job and tasks computational model | |
| US7779017B2 (en) | Employing abstract pipeline component connections to maintain data flow | |
| Sakr et al. | Large-scale graph processing using Apache Giraph | |
| Jaeger et al. | A Scientific Workflow Approach to Distributed Geospatial Data Processing using Web Services. | |
| US20110307520A1 (en) | Reflection over objects | |
| US20110107250A1 (en) | Step-wise, cumulative object and relationship aggregation in a graphical system management topology | |
| Nabi | Pro Spark Streaming: The Zen of Real-Time Analytics Using Apache Spark | |
| Sewal et al. | A critical analysis of apache Hadoop and spark for big data processing | |
| Gesing et al. | Workflows in a dashboard: a new generation of usability | |
| CN102945343A (en) | Method and device for enumerating system process | |
| Gulati et al. | Apache Spark 2. x for Java developers | |
| US9098516B2 (en) | Multi-dimensional file system | |
| CN103336671A (en) | Method and equipment for acquiring data from network | |
| Merchant et al. | OT grammars, beyond partial orders: ERC sets and antimatroids | |
| Alkowaileet et al. | Large-scale complex analytics on semi-structured datasets using AsterixDB and Spark | |
| Sankar | Fast Data Processing with Spark 2 | |
| US10963476B2 (en) | Searching and visualizing data for a network search based on relationships within the data | |
| CN102902575B (en) | A kind of method for enumerating system process and device | |
| CN102945346B (en) | A kind of method for enumerating system process and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220713 Address after: Room 801, 8th floor, No. 104, floors 1-19, building 2, yard 6, Jiuxianqiao Road, Chaoyang District, Beijing 100015 Patentee after: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Address before: 100088 room 112, block D, 28 new street, new street, Xicheng District, Beijing (Desheng Park) Patentee before: BEIJING QIHOO TECHNOLOGY Co.,Ltd. Patentee before: Qizhi software (Beijing) Co.,Ltd. |
|
| TR01 | Transfer of patent right |