changeset 56:6ff7aabeb9d7

deps: add animia for open files detection
author Paper <mrpapersonic@gmail.com>
date Thu, 28 Sep 2023 12:35:21 -0400
parents 466ac9870df9
children 3c802806b74a
files CMakeLists.txt dep/animia/CMakeLists.txt dep/animia/LICENSE dep/animia/README.md dep/animia/include/animia.h dep/animia/include/bsd.h dep/animia/include/linux.h dep/animia/include/win32.h dep/animia/src/bsd.cpp dep/animia/src/linux.cpp dep/animia/src/main.cpp dep/animia/src/win32.cpp dep/animia/test/CMakeLists.txt dep/animia/test/main.cpp
diffstat 14 files changed, 674 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/CMakeLists.txt	Tue Sep 26 11:18:50 2023 -0400
+++ b/CMakeLists.txt	Thu Sep 28 12:35:21 2023 -0400
@@ -8,6 +8,7 @@
 endif()
 
 add_subdirectory(dep/anitomy)
+add_subdirectory(dep/animia)
 
 # Fix for mingw64
 list(APPEND CMAKE_FIND_LIBRARY_SUFFIXES ".dll.a" ".a")
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/CMakeLists.txt	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,25 @@
+cmake_minimum_required(VERSION 3.9)
+project(animia)
+set(SRC_FILES
+	src/main.cpp
+)
+if(LINUX)
+	list(APPEND SRC_FILES src/linux.cpp)
+elseif(UNIX) # this won't run on Linux
+	list(APPEND SRC_FILES src/bsd.cpp)
+elseif(WIN32)
+	list(APPEND SRC_FILES src/win32.cpp)
+endif()
+add_library(animia SHARED ${SRC_FILES})
+set_target_properties(animia PROPERTIES
+    PUBLIC_HEADER animia/animia.h CXX_STANDARD 17)
+target_include_directories(animia PRIVATE include)
+
+if(BUILD_TESTS)
+	project(test LANGUAGES CXX)
+	add_executable(test test/main.cpp)
+
+	target_include_directories(test PUBLIC include)
+	target_link_libraries(test PUBLIC animia)
+	set_target_properties(test PROPERTIES CXX_STANDARD 17)
+endif()
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/LICENSE	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, Paper
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/README.md	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,3 @@
+# Animia
+Animia is a wrapper around Linux's `/proc` and BSD's system calls.
+Its primary purpose is to provide a map of PIDs and a list of opened files to the user.
\ No newline at end of file
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/include/animia.h	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,16 @@
+#ifndef __animia__animia_h
+#define __animia__animia_h
+#include <vector>
+#include <string>
+#include <unordered_map>
+
+namespace Animia {
+
+std::vector<int> get_all_pids();
+std::string get_process_name(int pid);
+std::vector<std::string> get_open_files(int pid);
+std::unordered_map<int, std::vector<std::string>> get_all_open_files();
+
+}
+
+#endif // __animia__animia_h
\ No newline at end of file
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/include/bsd.h	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,16 @@
+#ifndef __animia__bsd_h
+#define __animia__bsd_h
+#include <vector>
+#include <string>
+#include <unordered_map>
+
+namespace Animia::Unix {
+
+std::vector<int> get_all_pids();
+std::string get_process_name(int pid);
+std::vector<std::string> get_open_files(int pid);
+std::unordered_map<int, std::vector<std::string>> get_all_open_files();
+
+}
+
+#endif // __animia__bsd_h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/include/linux.h	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,16 @@
+#ifndef __animia__linux_h
+#define __animia__linux_h
+#include <vector>
+#include <string>
+#include <unordered_map>
+
+namespace Animia::Linux {
+
+std::vector<int> get_all_pids();
+std::string get_process_name(int pid);
+std::vector<std::string> get_open_files(int pid);
+std::unordered_map<int, std::vector<std::string>> get_all_open_files();
+
+}
+
+#endif // __animia__linux_h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/include/win32.h	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,16 @@
+#ifndef __animia__windows_h
+#define __animia__windows_h
+#include <vector>
+#include <string>
+#include <unordered_map>
+
+namespace Animia::Windows {
+
+std::vector<int> get_all_pids();
+std::string get_process_name(int pid);
+std::vector<std::string> get_open_files(int pid);
+std::unordered_map<int, std::vector<std::string>> get_all_open_files();
+
+}
+
+#endif // __animia__windows_h
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/src/bsd.cpp	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,102 @@
+/**
+ * bsd.cpp 
+ *  - provides support for most* versions of BSD
+ *  - this *should* also work for OS X
+ * more technical details: this is essentially a wrapper
+ * around the very C-like BSD system functions that are...
+ * kind of unnatural to use in modern C++.
+**/
+#include <vector>
+#include <string>
+#include <unordered_map>
+#include <sys/types.h>
+#include <sys/sysctl.h>
+#include <sys/user.h>
+#include <fcntl.h>
+#include <iostream>
+#ifdef __FreeBSD__
+#include <libutil.h>
+#elif defined(__APPLE__)
+#include <libproc.h>
+#endif
+
+namespace Animia::Unix {
+
+/* this is a cleaned up version of a function from... Apple?
+   ...anyway, what it essentially does is gets the size and stuff from
+   sysctl() and reserves the space in a vector to store the PIDs */
+std::vector<int> get_all_pids() {
+    std::vector<int> ret;
+    struct kinfo_proc* result = NULL;
+    size_t             length = 0;
+    static const int   name[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL, 0 };
+
+    /* get appropriate length from sysctl() */
+    sysctl((int*)name, (sizeof(name) / sizeof(*name)) - 1, NULL, &length, NULL, 0);
+
+    result = (struct kinfo_proc*)malloc(length);
+    if (result == NULL)
+        return std::vector<int>();
+
+    /* actually get our results */
+    if (sysctl((int*)name, (sizeof(name) / sizeof(*name)) - 1, result, &length, NULL, 0) == ENOMEM) {
+        assert(result != NULL);
+        free(result);
+        throw std::bad_alloc();
+    }
+
+    /* add pids to our vector */
+    ret.reserve(length/sizeof(*result));
+    for (int i = 0; i < length/sizeof(*result); i++)
+        ret.push_back(result[i].kp_proc.p_pid);
+
+    return ret;
+}
+
+std::string get_process_name(int pid) {
+    std::string ret;
+#ifdef __FreeBSD__
+    struct kinfo_proc* proc = kinfo_getproc(pid);
+    if (!proc) {
+        return "";
+    ret = proc->ki_comm;
+    free(proc);
+#elif defined(__APPLE__)
+    struct proc_bsdinfo proc;
+
+    int st = proc_pidinfo(pid, PROC_PIDTBSDINFO, 0, &proc, PROC_PIDTBSDINFO_SIZE);
+    if (st != PROC_PIDTBSDINFO_SIZE)
+        return "";
+    return proc.pbi_comm;
+#endif
+    return ret;
+}
+
+std::vector<std::string> get_open_files(int pid) {
+    // initialize buffer
+    std::vector<std::string> ret;
+    int bufsz = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
+    struct proc_fdinfo *info = (struct proc_fdinfo *)malloc(bufsz);
+    proc_pidinfo(pid, PROC_PIDLISTFDS, 0, info, bufsz);
+
+    // iterate over stuff
+    for (int i = 0; i < bufsz/sizeof(info[0]); i++) {
+        if (info[i].proc_fdtype == PROX_FDTYPE_VNODE) {
+            struct vnode_fdinfowithpath vnodeInfo;
+            proc_pidfdinfo(pid, info[i].proc_fd, PROC_PIDFDVNODEPATHINFO, &vnodeInfo, PROC_PIDFDVNODEPATHINFO_SIZE);
+	    ret.push_back(vnodeInfo.pvip.vip_path);
+        }
+    }
+    return ret;
+}
+
+std::unordered_map<int, std::vector<std::string>> get_all_open_files() {
+    std::unordered_map<int, std::vector<std::string>> map;
+    std::vector<int> pids = get_all_pids();
+    for (int i: pids) {
+        map[i] = get_open_files(i);
+    }
+    return map;
+}
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/src/linux.cpp	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,109 @@
+#include <string>
+#include <vector>
+#include <fstream>
+#include <filesystem>
+#include <unordered_map>
+#include <iostream>
+#include <sstream>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <algorithm>
+
+#define PROC_LOCATION "/proc"
+
+namespace Animia::Linux {
+
+std::vector<int> get_all_pids() {
+	std::vector<int> ret;
+	for (const auto& dir : std::filesystem::directory_iterator(PROC_LOCATION)) {
+		int pid;
+		try {
+			pid = std::stoi(dir.path().stem());
+		} catch (std::invalid_argument) {
+			continue;
+		}
+		ret.push_back(pid);
+	}
+	return ret;
+}
+
+std::string get_process_name(int pid) {
+	std::string path = PROC_LOCATION "/" + std::to_string(pid) + "/comm";
+	std::ifstream t(path);
+	std::stringstream buf;
+	buf << t.rdbuf();
+	std::string str = buf.str();
+	str.erase(std::remove(str.begin(), str.end(), '\n'), str.end());
+	return str;
+}
+
+static bool is_regular_file(std::string link) {
+	struct stat sb;
+	if (stat(link.c_str(), &sb) == -1)
+		return false;
+	return S_ISREG(sb.st_mode);
+}
+
+static bool are_flags_ok(int pid, int fd) {
+	std::string path = PROC_LOCATION "/" + std::to_string(pid) + "/fdinfo/" + std::to_string(fd);
+	std::ifstream t(path);
+	std::stringstream buffer;
+	buffer << t.rdbuf();
+	std::string raw;
+	int flags = 0;
+	while (std::getline(buffer, raw)) {
+		if (raw.rfind("flags:", 0) == 0) {
+			flags = std::stoi(raw.substr(raw.find_last_not_of("0123456789") + 1));
+		}
+	}
+	if (flags & O_WRONLY || flags & O_RDWR)
+		return false;
+	return true;
+}
+
+static int get_size_of_link(std::string link) {
+	struct stat sb;
+	if (lstat(link.c_str(), &sb) == -1)
+		return -1;
+	return sb.st_size + 1;
+}
+
+std::vector<std::string> get_open_files(int pid) {
+	std::vector<std::string> ret;
+	std::string path = PROC_LOCATION "/" + std::to_string(pid) + "/fd";
+	try {
+		for (const auto& dir : std::filesystem::directory_iterator(path)) {
+			if (!are_flags_ok(pid, std::stoi(dir.path().stem())))
+				continue;
+			/* get filename size */
+			int size = get_size_of_link(dir.path().string());
+			/* allocate buffer */
+			char* buf = (char*)calloc(size, sizeof(char));
+			//std::string buf('\0', size);
+			/* read filename to buffer */
+			int r = readlink(dir.path().c_str(), buf, size);
+
+			if (r < 0)
+				continue;
+			if (!is_regular_file(buf))
+				continue;
+			ret.push_back(buf);
+			free(buf);
+		}
+	} catch (std::filesystem::filesystem_error const& ex) {
+		if (ex.code().value() != 13) // 13 == permissions error, common with /proc, ignore
+			throw;
+	}
+	return ret;
+}
+
+std::unordered_map<int, std::vector<std::string>> get_all_open_files() {
+	std::unordered_map<int, std::vector<std::string>> map;
+	std::vector<int> pids = get_all_pids();
+	for (int i: pids)
+		map[i] = get_open_files(i);
+	return map;
+}
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/src/main.cpp	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,66 @@
+#include "bsd.h"
+#include "linux.h"
+#include "win32.h"
+#include <vector>
+#include <string>
+#include <unordered_map>
+#ifdef __linux__
+#	define ON_LINUX
+#elif (defined(unix) || defined(__unix__) || defined(__unix) || \
+		(defined(__APPLE__) && defined(__MACH__)))
+#	define ON_UNIX
+#elif defined(_WIN32)
+#	define ON_WINDOWS
+#endif
+
+namespace Animia {
+
+std::vector<int> get_all_pids() {
+#ifdef ON_UNIX
+	return Unix::get_all_pids();
+#elif defined(ON_LINUX)
+	return Linux::get_all_pids();
+#elif defined(ON_WINDOWS)
+	return Windows::get_all_pids();
+#else
+	return {};
+#endif
+}
+
+std::string get_process_name(int pid) {
+#ifdef ON_UNIX
+	return Unix::get_process_name(pid);
+#elif defined(ON_LINUX)
+	return Linux::get_process_name(pid);
+#elif defined(ON_WINDOWS)
+	return Windows::get_process_name(pid);
+#else
+	return "";
+#endif
+}
+
+std::vector<std::string> get_open_files(int pid) {
+#ifdef ON_UNIX
+	return Unix::get_open_files(pid);
+#elif defined(ON_LINUX)
+	return Linux::get_open_files(pid);
+#elif defined(ON_WINDOWS)
+	return Windows::get_open_files(pid);
+#else
+	return {};
+#endif
+}
+
+std::unordered_map<int, std::vector<std::string>> get_all_open_files() {
+#ifdef ON_UNIX
+	return Unix::get_all_open_files();
+#elif defined(ON_LINUX)
+	return Linux::get_all_open_files();
+#elif defined(ON_WINDOWS)
+	return Windows::get_all_open_files();
+#else
+	return {};
+#endif
+}
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/src/win32.cpp	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,258 @@
+#include "win32.h"
+#include <windows.h>
+#include <winternl.h>
+#include <libloaderapi.h>
+#include <ntdef.h>
+#include <psapi.h>
+#include <tlhelp32.h>
+#include <fileapi.h>
+#include <handleapi.h>
+#include <vector>
+#include <iostream>
+#include <string>
+#include <unordered_map>
+#include <stdexcept>
+#include <locale>
+#include <codecvt>
+/* This file is noticably more complex than Unix and Linux, and that's because
+   there is no "simple" way to get the paths of a file. */
+
+#define SystemExtendedHandleInformation ((SYSTEM_INFORMATION_CLASS)0x40)
+constexpr NTSTATUS STATUS_INFO_LENGTH_MISMATCH = 0xC0000004UL;
+constexpr NTSTATUS STATUS_SUCCESS = 0x00000000UL;
+
+static unsigned short file_type_index = 0;
+
+struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
+	PVOID Object;
+	ULONG_PTR UniqueProcessId;
+	HANDLE HandleValue;
+	ACCESS_MASK GrantedAccess;
+	USHORT CreatorBackTraceIndex;
+	USHORT ObjectTypeIndex;
+	ULONG HandleAttributes;
+	ULONG Reserved;
+};
+
+struct SYSTEM_HANDLE_INFORMATION_EX {
+	ULONG_PTR NumberOfHandles;
+	ULONG_PTR Reserved;
+	SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
+};
+
+namespace Animia::Windows {
+
+std::vector<int> get_all_pids() {
+	std::vector<int> ret;
+    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+    PROCESSENTRY32 pe32;
+	pe32.dwSize = sizeof(PROCESSENTRY32);
+
+    if (hProcessSnap == INVALID_HANDLE_VALUE)
+        return std::vector<int>();
+
+	if (!Process32First(hProcessSnap, &pe32))
+		return std::vector<int>();
+
+	ret.push_back(pe32.th32ProcessID);
+	while (Process32Next(hProcessSnap, &pe32)) {
+		ret.push_back(pe32.th32ProcessID);
+	}
+	// clean the snapshot object
+	CloseHandle(hProcessSnap);
+
+    return ret;
+}
+
+std::string get_process_name(int pid) {
+	HANDLE handle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
+	if (!handle)
+		return "";
+
+	std::string ret(MAX_PATH, '\0');
+	if (!GetModuleBaseNameA(handle, 0, &ret.front(), ret.size()))
+		throw std::runtime_error("GetModuleBaseNameA failed: " + std::to_string(GetLastError()));
+	CloseHandle(handle);
+
+	return ret;
+}
+
+/* All of this BS is required on Windows. Why? */
+
+HANDLE DuplicateHandle(HANDLE process_handle, HANDLE handle) {
+	HANDLE dup_handle = nullptr;
+	const bool result = ::DuplicateHandle(process_handle, handle,
+		::GetCurrentProcess(), &dup_handle, 0, false, DUPLICATE_SAME_ACCESS);
+	return result ? dup_handle : nullptr;
+}
+
+PVOID GetNTDLLAddress(LPCSTR proc_name) {
+	return reinterpret_cast<PVOID>(GetProcAddress(GetModuleHandleA("ntdll.dll"), proc_name));
+}
+
+NTSTATUS QuerySystemInformation(SYSTEM_INFORMATION_CLASS cls, PVOID sysinfo, ULONG len, PULONG retlen) {
+	static const auto func = reinterpret_cast<decltype(::NtQuerySystemInformation)*>(GetNTDLLAddress("NtQuerySystemInformation"));
+	return func(cls, sysinfo, len, retlen);
+}
+
+NTSTATUS QueryObject(HANDLE handle, OBJECT_INFORMATION_CLASS cls, PVOID objinf, ULONG objinflen, PULONG retlen) {
+	static const auto func = reinterpret_cast<decltype(::NtQueryObject)*>(GetNTDLLAddress("NtQueryObject"));
+	return func(handle, cls, objinf, objinflen, retlen);
+}
+
+std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> GetSystemHandleInformation() {
+	std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> res;
+	ULONG cb = 1 << 19;
+	NTSTATUS status = STATUS_SUCCESS;
+	SYSTEM_HANDLE_INFORMATION_EX* info;
+
+	do {
+		status = STATUS_NO_MEMORY;
+
+		if (!(info = (SYSTEM_HANDLE_INFORMATION_EX*)malloc(cb *= 2)))
+			continue;
+
+		if (0 <= (status = QuerySystemInformation(SystemExtendedHandleInformation, info, cb, &cb))) {
+			if (ULONG_PTR handles = info->NumberOfHandles) {
+				SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* entry = info->Handles;
+				do {
+					if (entry) res.push_back(*entry);
+				} while (entry++, --handles);
+			}
+		}
+		free(info);
+	} while (status == STATUS_INFO_LENGTH_MISMATCH);
+
+	return res;
+}
+
+OBJECT_TYPE_INFORMATION QueryObjectTypeInfo(HANDLE handle) {
+	OBJECT_TYPE_INFORMATION info;
+	QueryObject(handle, ObjectTypeInformation, &info, sizeof(info), NULL);
+	return info;
+}
+
+std::string UnicodeStringToStdString(UNICODE_STRING string) {
+	ANSI_STRING result;
+	static const auto uc_to_ansi = reinterpret_cast<decltype(::RtlUnicodeStringToAnsiString)*>(GetNTDLLAddress("RtlUnicodeStringToAnsiString"));
+	uc_to_ansi(&result, &string, TRUE);
+	std::string ret = std::string(result.Buffer, result.Length);
+	static const auto free_ansi = reinterpret_cast<decltype(::RtlFreeAnsiString)*>(GetNTDLLAddress("RtlFreeAnsiString"));
+	free_ansi(&result);
+	return ret;
+}
+
+std::string GetHandleType(HANDLE handle) {
+	OBJECT_TYPE_INFORMATION info = QueryObjectTypeInfo(handle);
+	return UnicodeStringToStdString(info.TypeName);
+}
+
+/* GetFinalPathNameByHandleA literally just doesn't work */
+std::string GetFinalPathNameByHandle(HANDLE handle) {
+	std::wstring buffer;
+
+	int result = ::GetFinalPathNameByHandleW(handle, NULL, 0, FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+	buffer.resize(result);
+	::GetFinalPathNameByHandleW(handle, &buffer.front(), buffer.size(), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+
+	std::wstring_convert<std::codecvt_utf8<wchar_t>, wchar_t> converter;
+
+	return converter.to_bytes(buffer);
+}
+
+std::string GetSystemDirectory() {
+	std::string windir = std::string(MAX_PATH, '\0');
+	::GetWindowsDirectoryA(&windir.front(), windir.length());
+	return "\\\\?\\" + windir;
+}
+
+/* This function is useless. I'm not exactly sure why, but whenever I try to compare the two
+   values, they both come up as different. I'm assuming it's just some Unicode BS I can't be bothered
+   to deal with. */
+bool IsSystemDirectory(const std::string& path) {
+	std::string path_l = path;
+	CharUpperBuffA(&path_l.front(), path_l.length());
+
+	std::string windir = GetSystemDirectory();
+	CharUpperBuffA(&windir.front(), windir.length());
+
+	return path_l.rfind(windir, 0) != std::string::npos;
+}
+
+bool IsFileHandle(HANDLE handle, unsigned short object_type_index) {
+	if (file_type_index)
+		return object_type_index == file_type_index;
+	else if (!handle)
+		return true;
+	else if (GetHandleType(handle) == "File") {
+		file_type_index = object_type_index;
+		return true;
+	}
+	return false;
+}
+
+bool IsFileMaskOk(ACCESS_MASK access_mask) {
+	/* this filters out any file handles that, legitimately,
+	   do not make sense (for what we're using it for)
+	
+	   shoutout to erengy for having these in Anisthesia */
+
+	if (!(access_mask & FILE_READ_DATA))
+		return false;
+
+	if ((access_mask & FILE_APPEND_DATA) ||
+	    (access_mask & FILE_WRITE_EA) ||
+	    (access_mask & FILE_WRITE_ATTRIBUTES))
+		return false;
+
+	return true;
+}
+
+bool IsFilePathOk(const std::string& path) {
+	if (path.empty() || IsSystemDirectory(path))
+		return false;
+
+	const auto file_attributes = GetFileAttributesA(path.c_str());
+	if ((file_attributes == INVALID_FILE_ATTRIBUTES) ||
+	    (file_attributes & FILE_ATTRIBUTE_DIRECTORY))
+		return false;
+
+	return true;
+}
+
+std::vector<std::string> get_open_files(int pid) {
+	std::unordered_map<int, std::vector<std::string>> map = get_all_open_files();
+	return map[pid];
+}
+
+std::unordered_map<int, std::vector<std::string>> get_all_open_files() {
+	std::unordered_map<int, std::vector<std::string>> map;
+	std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> info = GetSystemHandleInformation();
+	for (auto& h : info) {
+		int pid = h.UniqueProcessId;
+
+		if (!IsFileHandle(nullptr, h.ObjectTypeIndex))
+			continue;
+		if (!IsFileMaskOk(h.GrantedAccess))
+			continue;
+
+		const HANDLE proc = ::OpenProcess(PROCESS_DUP_HANDLE, false, pid);
+		HANDLE handle = DuplicateHandle(proc, h.HandleValue);
+		if (!handle)
+			continue;
+
+		if (GetFileType(handle) != FILE_TYPE_DISK)
+			continue;
+
+		std::string path = GetFinalPathNameByHandle(handle);
+		if (!IsFilePathOk(path))
+			continue;
+
+		if (map.find(pid) == map.end())
+			map[pid] = {};
+		map[pid].push_back(path);
+	}
+	return map;
+}
+
+}
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/test/CMakeLists.txt	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,6 @@
+cmake_minimum_required(VERSION 3.16)
+add_subdirectory(.. ${CMAKE_CURRENT_BINARY_DIR}/animia)
+project(test LANGUAGES CXX)
+add_executable(test main.cpp)
+
+target_include_directories(test PUBLIC ../include)
\ No newline at end of file
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dep/animia/test/main.cpp	Thu Sep 28 12:35:21 2023 -0400
@@ -0,0 +1,11 @@
+#include "animia.h"
+#include <iostream>
+
+int main() {
+	std::unordered_map<int, std::vector<std::string>> map = Animia::get_all_open_files();
+	for (int i = 0; i < map.size(); i++) {
+		for (std::string s: map[i]) {
+			std::cout << Animia::get_process_name(i) << " (" << i << "): " << s << "\n";
+		}
+	}
+}