Accessing Files Open in EhShell

In MCE I used to determine the filename of a playing video from the MRU list in the registry but this doesn’t exist in VMC.  It looks like it may be possible to see the files open in the ehShell process using NtQuerySystemInformation in Vista.  I wanted to find some example managed code to achieve this but this was not easy.  I eventually found some code on a french web site and combined this with some other code to obtain a working example.  I have posted the source code for this solution at http://www.axcis.com.au/bb/viewtopic.php?p=505 to assist others trying to achieve a similar objective.

The web sites that helped me were http://files.codes-sources.com/fichier.aspx?id=40231&f=win32lsof%5cCOpenedHandles.cs and Soheil Rashidi’s blog at http://www.themanaged.net/.

Leave a Reply

You must be logged in to post a comment.