C#获取句柄列表，AcessViolationException

信息：

• .Net 4.5

测试日期：

• Win7 64位

• Win10 64位（虚拟盒）

我试图获取一个外部进程句柄的列表，并将它们的名称作为字符串返回，以便以后可以关闭一个特定的句柄。因此，我使用Win32API编写了此函数，该函数将检查句柄是否是我要关闭的句柄：`

        const int CNST_SYSTEM_HANDLE_INFORMATION = 16;
        const uint STATUS_INFO_LENGTH_MISMATCH = 0xc0000004;

        public static string getObjectTypeName(Win32API.SYSTEM_HANDLE_INFORMATION shHandle, Process process)
        {
            IntPtr m_ipProcessHwnd = Win32API.OpenProcess(Win32API.ProcessAccessFlags.All, false, process.Id);
            IntPtr ipHandle = IntPtr.Zero;
            var objBasic = new Win32API.OBJECT_BASIC_INFORMATION();
            IntPtr ipBasic = IntPtr.Zero;
            var objObjectType = new Win32API.OBJECT_TYPE_INFORMATION();
            IntPtr ipObjectType = IntPtr.Zero;
            IntPtr ipObjectName = IntPtr.Zero;
            string strObjectTypeName = "";
            int nLength = 0;
            int nReturn = 0;
            IntPtr ipTemp = IntPtr.Zero;


            if (!Win32API.DuplicateHandle(m_ipProcessHwnd, shHandle.Handle,
                                          Win32API.GetCurrentProcess(), out ipHandle,
                                          0, false, Win32API.DUPLICATE_SAME_ACCESS))
                return null;



            ipBasic = Marshal.AllocHGlobal(Marshal.SizeOf(objBasic));
            Win32API.NtQueryObject(ipHandle, (int)Win32API.ObjectInformationClass.ObjectBasicInformation,
                                   ipBasic, Marshal.SizeOf(objBasic), ref nLength);
            objBasic = (Win32API.OBJECT_BASIC_INFORMATION)Marshal.PtrToStructure(ipBasic, objBasic.GetType());
            Marshal.FreeHGlobal(ipBasic);

            ipObjectType = Marshal.AllocHGlobal(objBasic.TypeInformationLength);
            nLength = objBasic.TypeInformationLength;
            while ((uint)(nReturn = Win32API.NtQueryObject(
                ipHandle, (int)Win32API.ObjectInformationClass.ObjectTypeInformation, ipObjectType,
                  nLength, ref nLength)) ==
                Win32API.STATUS_INFO_LENGTH_MISMATCH)
            {
                Marshal.FreeHGlobal(ipObjectType);
                ipObjectType = Marshal.AllocHGlobal(nLength);
            }

            objObjectType = (Win32API.OBJECT_TYPE_INFORMATION)Marshal.PtrToStructure(ipObjectType, objObjectType.GetType());
            if (Is64Bits())
            {
                ipTemp = new IntPtr(Convert.ToInt64(objObjectType.Name.Buffer.ToString(), 10) >> 32);
            }
            else
            {
                ipTemp = objObjectType.Name.Buffer;
            }

        strObjectTypeName = Marshal.PtrToStringUni(ipTemp, objObjectType.Name.Length >> 1);


        Marshal.FreeHGlobal(ipObjectType);
            Win32API.CloseHandle(ipHandle);
            return strObjectTypeName;
        }`

但是，问题是此代码在Win7 64位中工作，而不是在Win10中工作！-->在Win 10

strObjectTypeName=Marshal.PtrToStringUni（）中抛出一个
AcessViolationException
（代码中的最后几行）

System.AccessViolationException尝试读取或写入受保护内存。这通常表示其他内存已损坏

我是否遗漏了win10中非托管内存的访问方式？
我刚刚遇到了同样的问题。我没有尝试过Win7，但当您在Win10（x64）上以32位运行代码（例如，设置应用程序的“首选32位标志”）时，它应该可以工作。
发生异常时，如果变量“ipTemp”仅显示问号或错误消息，则将其拖放到Visual Studio的“内存窗口”中，因为您没有有效的指针。
据我所知，此API使用的64位结构版本中有（更多）填充字节：
对象类型信息包含UNICODE字符串，UNICODE字符串在64位模式下的缓冲区字段前有4个填充字节。
我的工作是：

[StructLayout(LayoutKind.Sequential, Pack = 1)]
public struct UNICODE_STRING
{
    private IntPtr _dummy; // the two ushorts seem to be padded with 4 bytes in 64bit mode only

    /// <summary>
    /// The length, in bytes, of the string stored in Buffer. If the string is null-terminated, Length does not include the trailing null character.
    /// </summary>
    public ushort Length
    {
        get { return (ushort)Marshal.ReadInt16(this, 0); }
    }

    /// <summary>
    /// The length, in bytes, of Buffer.
    /// </summary>
    public ushort MaximumLength
    {
        get { return (ushort)Marshal.ReadInt16(this, 2); }
    }

    public IntPtr Buffer;
}

[StructLayout（LayoutKind.Sequential，Pack=1）]
公共结构UNICODE\u字符串
{
private IntPtr _dummy；//两个ushort似乎仅在64位模式下填充了4个字节
/// 
///存储在缓冲区中的字符串的长度（字节）。如果字符串以null结尾，则长度不包括尾随的null字符。
/// 
公共短距离
{
获取{return（ushort）Marshal.ReadInt16（this，0）；}
}
/// 
///缓冲区的长度（以字节为单位）。
/// 
公共ushort最大长度
{
获取{return（ushort）Marshal.ReadInt16（this，2）；}
}
公共IntPtr缓冲区；
}

在我的研究中，我发现了很多关于这个主题的问题，基本上有两种示例代码
我正在考虑创建一个名为WinKernelObjectsDotNet的开源库

更新：该库现在可用。它支持查找用一行代码锁定文件或串行端口（COM）的进程。
我建议以这种方式更改UNICODE字符串结构

    public struct UNICODE_STRING
    {
            public ushort Length;
            public ushort MaximumLength;
            [MarshalAs(UnmanagedType.LPWStr)] public string Buffer;
    }

因此getObjectTypeName方法类似于此，适用于32/64：

    public static string getObjectTypeName(SYSTEM_HANDLE_INFORMATION shHandle, Process process) {
        IntPtr ipProcessHwnd = OpenProcess(ProcessAccessFlags.All, false, process.Id);
        if (!DuplicateHandle(ipProcessHwnd, shHandle.Handle, GetCurrentProcess(), out IntPtr ipHandle, 0, false, DUPLICATE_SAME_ACCESS)) {
            return null;
        }

        OBJECT_BASIC_INFORMATION objBasicInformation = new OBJECT_BASIC_INFORMATION();
        IntPtr ipBasicInformation = Marshal.AllocHGlobal(Marshal.SizeOf(objBasicInformation));
        int iBasicInformationLength = 0;
        NtQueryObject(ipHandle, (int) ObjectInformationClass.ObjectBasicInformation, ipBasicInformation, Marshal.SizeOf(objBasicInformation), ref iBasicInformationLength);
        objBasicInformation = (OBJECT_BASIC_INFORMATION) Marshal.PtrToStructure(ipBasicInformation, typeof(OBJECT_BASIC_INFORMATION));
        Marshal.FreeHGlobal(ipBasicInformation);

        int iObjectTypeInformationLength = objBasicInformation.TypeInformationLength;
        IntPtr ipObjectTypeInformation = Marshal.AllocHGlobal(iObjectTypeInformationLength);
        while (Win32API.STATUS_INFO_LENGTH_MISMATCH == (uint) (NtQueryObject(ipHandle, (int) ObjectInformationClass.ObjectTypeInformation, ipObjectTypeInformation, iObjectTypeInformationLength, ref iObjectTypeInformationLength))) {
            Marshal.FreeHGlobal(ipObjectTypeInformation);
            ipObjectTypeInformation = Marshal.AllocHGlobal(iObjectTypeInformationLength);
        }
        CloseHandle(ipHandle);

        OBJECT_TYPE_INFORMATION objObjectType = (OBJECT_TYPE_INFORMATION)Marshal.PtrToStructure(ipObjectTypeInformation, typeof(OBJECT_TYPE_INFORMATION));
        Marshal.FreeHGlobal(ipObjectTypeInformation);

        return objObjectType.Name.Buffer;
    }