Handle.ps1

<#
.Synopsis
    Gets open system handles.
.DESCRIPTION
   Gets open system handles. This cmdlet can filter by process and handle name. 
.EXAMPLE
   Get-Process Notepad | Get-Handle
.EXAMPLE
   Get-Handle -Name "*myfile.txt"
#>
function Get-Handle
{
    [CmdletBinding()]
    param(
    # A process to return open handles for.
    [Parameter(ValueFromPipeline=$true)]
    [System.Diagnostics.Process]$Process,
    # The name of the handle
	[Parameter()]
    [String]$Name = $null,
	[Parameter()]
	[ValidateSet("File", "Directory")]
	[String]$Type = $null

    )

	Begin {
		#$Handles =
	}

    Process {
	 Get-AllHandles

        #if ($Process -ne $Null)
        #{
        #    $Handles | Where-Object { $_.ProcessId -eq $Process.Id -and $_.Name -match $Name} 
        #}
        #elseif ($Name -ne $null)
        #{
        #    $Handles |  Where-Object { $_.Name -like $Name} 
        #}
        #else
        #{
        #    $Handles
        #}
    }
}

<#
.Synopsis
    Closes open system handles.
.DESCRIPTION
   Closes open system handles. This cmdlet can cause system instability.
.EXAMPLE
   Get-Process Notepad | Get-Handle | Close-Handle
.EXAMPLE
   Get-Handle -Name "*myfile.txt" | Close-Handle
#>
function Close-Handle
{
    [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact='High')]
    param(
    [Parameter(ValueFromPipeline=$true)]
    $Handle
    )

    Process
    {
        if ($PSCmdlet.ShouldProcess($Handle.Name,"Closing a handle can cause system instability. Close handle?"))
        {
            $Handle.Close()
        }
    }
}

<#
.SYNOPSIS

Converts a DOS-style file name into a regular Windows file name.
.DESCRIPTION



This function can convert a DOS-style (\Device\HarddiskVolume1\MyFile.txt) file name into a regular Windows (C:\MyFile.txt)
file name. 

.PARAMETER RawFileName

The DOS-style file name.

.EXAMPLE

ConvertTo-RegularFileName -RawFileName "\Device\HarddiskVolume1\MyFile.txt"

#>
function ConvertTo-RegularFileName
{
	param($RawFileName)

    foreach ($logicalDrive in [Environment]::GetLogicalDrives())
    {
        $targetPath = New-Object System.Text.StringBuilder 256
        if ([PoshInternals.Kernel32]::QueryDosDevice($logicalDrive.Substring(0, 2), $targetPath, 256) -eq 0)
        {
            return $targetPath
        }
        $targetPathString = $targetPath.ToString()
        if ($RawFileName.StartsWith($targetPathString))
        {
            $RawFileName = $RawFileName.Replace($targetPathString, $logicalDrive.Substring(0, 2))
            break
        }
    }
    $RawFileName
}

<#
.SYNOPSIS

Converts a SystemHandleEntry into a PSCustomObject.
.DESCRIPTION

This function is intended to convert a SystemHandleEntry returned by
Get-FileHandle into a PSCustomObject that exposes a Process property and a
file name. 

.PARAMETER HandleEntry

The SystemHandleEntry as returned by Get-FileHandle

.EXAMPLE

Get-FileHandle | ConvertTo-HandleHashTable
#>
function ConvertTo-HandleHashTable
{
	[CmdletBinding()]
	param(
		[Parameter(Mandatory, ValueFromPipeline=$true)]
		$HandleEntry,
		[Parameter(Mandatory)]
		[IntPtr]$ProcessHandle
	)

	Process
	{
		if ($HandleEntry.GrantedAccess -eq 0x0012019f -or $HandleEntry.GrantedAccess -eq 0x00120189 -or $HandleEntry.GrantedAccess -eq 0x120089)
		{
			return
		}

		$HandleType = Find-HandleType -HandleEntry $HandleEntry -ProcessHandle $ProcessHandle

		$length = 0
		$Result = [PoshInternals.NtDll]::NtQueryObject($ProcessHandle, 'ObjectNameInformation', [IntPtr]::Zero, 0, [ref]$length) 
		$ptr = [IntPtr]::Zero

		if ($Result -ne [PoshInternals.NT_STATUS]::STATUS_INFO_LENGTH_MISMATCH)
		{
			return
		}

		try 
		{
			$ptr = [Runtime.InteropServices.Marshal]::AllocHGlobal($length)
			if ([PoshInternals.NtDll]::NtQueryObject($ProcessHandle, 'ObjectNameInformation', $ptr, $length, [ref]$length) -ne [PoshInternals.NT_STATUS]::STATUS_SUCCESS)
			{
				return
			}

			$Path = [Runtime.InteropServices.Marshal]::PtrToStringUni([IntPtr]([long]$ptr + 2 * [IntPtr]::Size))

			if ($HandleType -eq "File" -or $HandleType -eq "Directory")
			{
				$Path = ConvertTo-RegularFileName $Path
			}

			$PsObject = [PSCustomObject]@{
				Type=$HandleType;
				Path=$Path;
				Process=$HandleEntry.OwnerProcessId;
			}
			
			return $PsObject
		}
		catch 
		{
			Write-Warning $_.Exception.Message
		}
		finally 
		{
			[Runtime.InteropServices.Marshal]::FreeHGlobal($ptr)
		}
	}
}

$HandleTypeCache = @{}

function Find-HandleType {
	param( 
	    [Parameter(Mandatory)]
		$HandleEntry,
		[Parameter(Mandatory)]
		[IntPtr]$ProcessHandle)

	if ($HandleTypeCache.ContainsKey($HandleEntry.ObjectTypeNumber))
	{
		return $HandleTypeCache[$HandleEntry.ObjectTypeNumber]
	}

	$length = 0
    $Result = [PoshInternals.NtDll]::NtQueryObject($ProcessHandle, 'ObjectTypeInformation', [IntPtr]::Zero, 0, [ref] $length)
    $ptr = [IntPtr]::Zero

	if ($Result -ne [PoshInternals.NT_STATUS]::STATUS_INFO_LENGTH_MISMATCH)
	{
		return
	}

    try
    {
        $ptr = [Runtime.InteropServices.Marshal]::AllocHGlobal($length)
        if ([PoshInternals.NtDll]::NtQueryObject($ProcessHandle, 'ObjectTypeInformation', $ptr, $length, [ref] $length) -ne [PoshInternals.NT_STATUS]::STATUS_SUCCESS)
		{
			return
		}
             
        $typeStr = [Runtime.InteropServices.Marshal]::PtrToStringUni([IntPtr]([long]$ptr + 0x58 + 2 * [IntPtr]::Size))
        $HandleTypeCache[$HandleEntry.ObjectTypeNumber] = $typeStr 

		$typeStr
    }
	catch
	{
		Write-Warning $_.Exception.Message
	}
    finally
    {
        [Runtime.InteropServices.Marshal]::FreeHGlobal($ptr)
    }
}

<#
.SYNOPSIS

Returns open file handles found on the system. 
.DESCRIPTION

This function returns all open file handles found on the system. In its current state
this cmdlet will only work on a Windows 8 machine.

.EXAMPLE

Get-Handle
#>
function Get-AllHandles
{
    param($Type)

    $length = 0x10000
    $ptr = [IntPtr]::Zero
    try
    {
        while ($true)
        {
            $ptr = [Runtime.InteropServices.Marshal]::AllocHGlobal($length)
            $wantedLength = 0
			[PoshInternals.SYSTEM_INFORMATION_CLASS]$HandleInfo = 'SystemHandleInformation'
            $result = [PoshInternals.NtDll]::NtQuerySystemInformation($HandleInfo, $ptr, $length, [ref] $wantedLength)
            if ($result -eq [PoshInternals.NT_STATUS]::STATUS_INFO_LENGTH_MISMATCH)
            {
                $length = [Math]::Max($length, $wantedLength)
                [Runtime.InteropServices.Marshal]::FreeHGlobal($ptr)
                $ptr = [IntPtr]::Zero
            }
            elseif ($result -eq [PoshInternals.NT_STATUS]::STATUS_SUCCESS)
			{
                break
			}
            else
			{
                throw (New-Object System.ComponentModel.Win32Exception)
			}
        }

		if ([IntPtr]::Size -eq 4)
		{
			$handleCount = [Runtime.InteropServices.Marshal]::ReadInt32($ptr)
		}
		else
		{
			$handleCount = [Runtime.InteropServices.Marshal]::ReadInt64($ptr)
		}

		if ($handleCount -gt [Int32]::MaxValue)
		{
			Write-Error "Handle count too large!"
			continue
		}

		$She = New-Object -TypeName PoshInternals.SystemHandleEntry
        $size = [Runtime.InteropServices.Marshal]::SizeOf($She)

		$CurrentProcessHandle = (Get-Process -Id $Pid).Handle

		$ClassName = "StructArray$(Get-Random -Minimum 1 -Maximum 10000)"
		$StructName = "Struct$(Get-Random -Minimum 1 -Maximum 10000)"

		Add-Type -TypeDefinition "
			using System.Runtime.InteropServices;

			[StructLayout(LayoutKind.Sequential)]
			public struct $StructName
			{
				public int OwnerProcessId;
				public byte ObjectTypeNumber;
				public byte Flags;
				public ushort Handle;
				public System.IntPtr Object;
				public int GrantedAccess;
			}

			[StructLayout(LayoutKind.Sequential)]
			public struct $ClassName
			{
				[MarshalAsAttribute(UnmanagedType.ByValArray, SizeConst = $HandleCount, ArraySubType = UnmanagedType.Struct)]
				public $StructName [] Entries;
			}
		"

		$HandleArray = New-Object -TypeName $ClassName
		$HandleArray = [Runtime.InteropServices.Marshal]::PtrToStructure([IntPtr]([long]$ptr + [IntPtr]::Size), [Type]$HandleArray.GetType())

        for ($i = 0; $i -lt $handleCount; $i++)
        {
			$HandleEntry = $HandleArray.Entries[$i]

			$sourceProcessHandle = [IntPtr]::Zero
			$handleDuplicate = [IntPtr]::Zero
			$sourceProcessHandle = [PoshInternals.Kernel32]::OpenProcess(0x40, $true, $HandleEntry.OwnerProcessId)
			if ($sourceProcessHandle -eq [IntPtr]::Zero)
			{
				continue
			}

			if (-not [PoshInternals.Kernel32]::DuplicateHandle($sourceProcessHandle, [IntPtr]$HandleEntry.Handle, $CurrentProcessHandle, [ref]$handleDuplicate, 0, $false, 2))
			{
				continue
			}

			$HandleEntry | ConvertTo-HandleHashTable -ProcessHandle $handleDuplicate
        }
    }
    finally
    {
        if ($ptr -ne [IntPtr]::Zero)
		{
            [System.Runtime.InteropServices.Marshal]::FreeHGlobal($ptr)
		}
    }
}