I have:
WinDbg 6.12.0002.633 x86
Windows 7 SP1 x64
Articles(
http://www.codeproject.com/KB/debug/cdbntsd5.aspx) and
docs(with WinDbg) say that I can call:
!process
!handle with 4 parameters.
But WinDbg says:
0:001> !process
No export process found
0:001> !handle 314 ff 123
Unknown type '123'
What I want - see all names of files in File handle types. Like in
article:
kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
...
PROCESS fcc77200 SessionId: 0 Cid: 0338 Peb: 7ffdf000 ParentCid:
02c8
DirBase: 079de000 ObjectTable: fccc30c8 TableSize: 74.
Image: notepad.exe
kd> !handle 120 ff fcc77200
processor number 0
PROCESS fcc77200 SessionId: 0 Cid: 0338 Peb: 7ffdf000 ParentCid:
02c8
DirBase: 079de000 ObjectTable: fccc30c8 TableSize: 74.
Image: notepad.exe
Handle Table at e1e5f000 with 74 Entries in use
0120: Object: fcd32448 GrantedAccess: 00120089
Object: fcd32448 Type: (fced7c40) File
ObjectHeader: fcd32430
HandleCount: 1 PointerCount: 1
Directory Object: 00000000 Name: \TripItinerary.txt
{HarddiskVolume1}
What is wrong? What extensions should I load?
I need it because want to get next information - what thread or .NET
AppDomain hold handle preventing file from deletion.
Thanks