{"id":28559903,"url":"https://github.com/ghostpack/lockless","last_synced_at":"2025-06-10T09:06:35.891Z","repository":{"id":50254420,"uuid":"250892036","full_name":"GhostPack/Lockless","owner":"GhostPack","description":"Lockless allows for the copying of locked files.","archived":false,"fork":false,"pushed_at":"2021-04-30T17:51:41.000Z","size":34,"stargazers_count":201,"open_issues_count":0,"forks_count":57,"subscribers_count":10,"default_branch":"master","last_synced_at":"2023-11-07T18:18:28.742Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GhostPack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-28T20:57:25.000Z","updated_at":"2023-11-07T01:25:42.000Z","dependencies_parsed_at":"2022-09-04T04:40:37.996Z","dependency_job_id":null,"html_url":"https://github.com/GhostPack/Lockless","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FLockless","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FLockless/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FLockless/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FLockless/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GhostPack","download_url":"https://codeload.github.com/GhostPack/Lockless/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FLockless/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259043765,"owners_count":22797161,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-10T09:06:35.168Z","updated_at":"2025-06-10T09:06:35.881Z","avatar_url":"https://github.com/GhostPack.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# LockLess\n\n----\n\nLockLess is a C# tool that allows for the enumeration of open file handles and the copying of locked files.\n\nIt was inspired by [@fuzzysec](https://twitter.com/fuzzysec)'s [Get-Handles.ps1](https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Get-Handles.ps1) and draws on [code from Stackoverflow](https://stackoverflow.com/questions/860656/using-c-how-does-one-figure-out-what-process-locked-a-file) as well.\n\nHandles are enumerated with NtQuerySystemInformation:SystemHandleInformation.\n\nTo copy out a locked file, the code:\n* Opens the process that has a lock on the file with `DuplicateHandle` permissions.\n* Uses `DuplicateHandle()` to duplicate the specific file handle associated with the file we're wanting to copy.\n* Uses `CreateFileMapping()` to create a mapping of the duplicated file handle.\n* Uses `MapViewOfFile()` to map the entire file into memory.\n* Uses `WriteFile()` to write out the mapped contents to the temporary file specified.\n\n\nLockLess is licensed under the BSD 3-Clause license.\n\n## Usage\n\n    C:\\Temp\\LockLess.exe\n\n        LockLess.exe \u003cfile.ext | all\u003e [/process:NAME1,NAME2,...] [/copy | /copy:C:\\Temp\\file.ext]\n\n\nFile out which process has a handled to the locked \"WebCacheV01.dat\" file:\n\n    C:\\Temp\u003eLockLess.exe WebCacheV01.dat\n\n    [*] Searching processes for an open handle to \"WebCacheV01.dat\"\n    [+] Process \"taskhostw\" (5332) has a file handle (ID 880) to \"C:\\Users\\harmj0y\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\"\n\n\nCopy the locked \"WebCacheV01.dat\" file to a temporary file:\n\n    C:\\Temp\u003eLockLess.exe WebCacheV01.dat /copy\n\n    [*] Searching processes for an open handle to \"WebCacheV01.dat\"\n    [+] Process \"taskhostw\" (5332) has a file handle (ID 880) to \"C:\\Users\\harmj0y\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\"\n    [*] Copying to: C:\\Users\\harmj0y\\AppData\\Local\\Temp\\tmp18BE.tmp\n    [*] Copied 23068672 bytes from \"C:\\Users\\harmj0y\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\" to \"C:\\Users\\harmj0y\\AppData\\Local\\Temp\\tmp18BE.tmp\"\n\n\nCopy the file \"WebCacheV01.dat\" locked by \"taskhostw\" to a specific location:\n\n    C:\\Temp\u003eLockLess.exe WebCacheV01.dat /process:taskhostw /copy:C:\\Temp\\out.tmp\n\n    [*] Searching processes for an open handle to \"WebCacheV01.dat\"\n    [+] Process \"taskhostw\" (9668) has a file handle (ID 892) to \"C:\\Users\\harmj0y\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\"\n    [*] Copying to: C:\\Temp\\out.tmp\n    [*] Copied 23068672 bytes from \"C:\\Users\\harmj0y\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat\" to \"C:\\Temp\\out.tmp\"\n\n\nEnumerate all open handles, outputting as a CSV:\n\n    C:\\Temp\u003eLockLess.exe all\n\n    ProcessName,ProcessID,FileHandleID,FileName\n    Code,4740,64,C:\\Users\\harmj0y\\AppData\\Local\\Programs\\Microsoft VS Code\n    ...(snip)...\n\n\n## Compile Instructions\n\nWe are not planning on releasing binaries for LockLess, so you will have to compile yourself :)\n\nLockLess has been built against .NET 3.5 and is compatible with [Visual Studio 2019 Community Edition](https://visualstudio.microsoft.com/downloads/). Simply open up the project .sln, choose \"release\", and build.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostpack%2Flockless","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fghostpack%2Flockless","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostpack%2Flockless/lists"}