how to check open file without lsof

Poor man's lsof is to execute

ls -l  /proc/[process id]/fd

Still, you need to be root.

Thanks mike jones and Joqn for the tip with poor man's lsof. I used it in the following on busybox (synology nas) to list the fd directories grouped under each process:

  for p in [0-9]*; do ls -l /proc/$p/fd ;done 

Install busybox, it has a lsof command.

Combining the above /proc based with the answers to this question about searching a directory tree for symlinks gives the following:

# find /proc -ignore_readdir_race -name task -prune -o -path '*/fd/*' -lname '/file/of/interest' -ls -quit
 37023    0 l-wx------   1 username  username        64 Dec 16 09:06 /proc/4140/fd/1 -> /file/of/interest

The -ignore_readdir_race avoids errors due to short lived processes, the -prune gets rid of task level results (not strictly necessary when stopping at the first process, since those paths would still give the same answer, but useful to avoid redundancy in other use cases, like listing all the results)

Combine -print with cut to extract the pid directly:

# find /proc -ignore_readdir_race -name task -prune -o -path '*/fd/*' -lname '/file/of/interest' -print -quit | cut -d / -f 3
4140

Once you have the pid, you can use ps to get the process details (as per the answers to this SuperUser question):

# ps -p 4140 -o command=
/some/command --with=some args

(Note, I tested this on Linux, and it should work the same on BSD, but I'm not 100% sure about Android)