ZwQuerySystemInformation 查看系统进程信息

ZwQuerySystemInformation 查看系统进程信息

[cpp] view plain copy print ?

1. #include <ntddk.h>
3. typedef enum _SYSTEM_INFORMATION_CLASS {
4. SystemBasicInformation,
5. SystemProcessorInformation,
6. SystemPerformanceInformation,
7. SystemTimeOfDayInformation,
8. SystemPathInformation,
9. SystemProcessInformation, //5
10. SystemCallCountInformation,
11. SystemDeviceInformation,
12. SystemProcessorPerformanceInformation,
13. SystemFlagsInformation,
14. SystemCallTimeInformation,
15. SystemModuleInformation,
16. SystemLocksInformation,
17. SystemStackTraceInformation,
18. SystemPagedPoolInformation,
19. SystemNonPagedPoolInformation,
20. SystemHandleInformation,
21. SystemObjectInformation,
22. SystemPageFileInformation,
23. SystemVdmInstemulInformation,
24. SystemVdmBopInformation,
25. SystemFileCacheInformation,
26. SystemPoolTagInformation,
27. SystemInterruptInformation,
28. SystemDpcBehaviorInformation,
29. SystemFullMemoryInformation,
30. SystemLoadGdiDriverInformation,
31. SystemUnloadGdiDriverInformation,
32. SystemTimeAdjustmentInformation,
33. SystemSummaryMemoryInformation,
34. SystemNextEventIdInformation,
35. SystemEventIdsInformation,
36. SystemCrashDumpInformation,
37. SystemExceptionInformation,
38. SystemCrashDumpStateInformation,
39. SystemKernelDebuggerInformation,
40. SystemContextSwitchInformation,
41. SystemRegistryQuotaInformation,
42. SystemExtendServiceTableInformation,
43. SystemPrioritySeperation,
44. SystemPlugPlayBusInformation,
45. SystemDockInformation,
46. SystemPowerInformation2,
47. SystemProcessorSpeedInformation,
48. SystemCurrentTimeZoneInformation,
49. SystemLookasideInformation
50. } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
52. typedef struct _SYSTEM_THREAD_INFORMATION {
53. LARGE_INTEGER KernelTime;
54. LARGE_INTEGER UserTime;
55. LARGE_INTEGER CreateTime;
56. ULONG WaitTime;
57. PVOID StartAddress;
58. CLIENT_ID ClientId;
59. KPRIORITY Priority;
60. LONG BasePriority;
61. ULONG ContextSwitchCount;
62. ULONG State;
63. KWAIT_REASON WaitReason;
64. }SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
66. typedef struct _SYSTEM_PROCESS_INFORMATION {
67. ULONG NextEntryOffset;
68. ULONG NumberOfThreads;
69. LARGE_INTEGER Reserved[3];
70. LARGE_INTEGER CreateTime;
71. LARGE_INTEGER UserTime;
72. LARGE_INTEGER KernelTime;
73. UNICODE_STRING ImageName;
74. KPRIORITY BasePriority;
75. HANDLE ProcessId;
76. HANDLE InheritedFromProcessId;
77. ULONG HandleCount;
78. ULONG Reserved2[2];
79. ULONG PrivatePageCount;
80. VM_COUNTERS VirtualMemoryCounters;
81. IO_COUNTERS IoCounters;
82. SYSTEM_THREAD_INFORMATION Threads[0];
83. } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
85. //不加extern "C" 一直报link错误
86. extern "C" NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(
87. IN ULONG SystemInformationClass,
88. IN PVOID SystemInformation,
89. IN ULONG SystemInformationLength,
90. OUT PULONG ReturnLength);
92. VOID Unload(
93. __in struct _DRIVER_OBJECT *DriverObject
94. )
95. {
96. KdPrint(("unload ....."));
97. }
99. NTSTATUS Ring0EnumProcess()
100. {
101. ULONG cbBuffer = 0x8000; //32k
102. PVOID pSystemInfo;
103. NTSTATUS status;
104. PSYSTEM_PROCESS_INFORMATION pInfo;
106. //为查找进程分配足够的空间
107. do
108. {
109. pSystemInfo = ExAllocatePool(NonPagedPool, cbBuffer);
110. if (pSystemInfo == NULL) //申请空间失败，返回
111. {
112. return 1;
113. }
114. status = ZwQuerySystemInformation(SystemProcessInformation, pSystemInfo, cbBuffer, NULL );
115. if (status == STATUS_INFO_LENGTH_MISMATCH) //空间不足
116. {
117. ExFreePool(pSystemInfo);
118. cbBuffer *= 2;
119. }
120. else if(!NT_SUCCESS(status))
121. {
122. ExFreePool(pSystemInfo);
123. return 1;
124. }
126. } while(status == STATUS_INFO_LENGTH_MISMATCH); //如果是空间不足，就一直循环
128. pInfo = (PSYSTEM_PROCESS_INFORMATION)pSystemInfo; //把得到的信息放到pInfo中
130. for (;;)
131. {
132. LPWSTR pszProcessName = pInfo->ImageName.Buffer;
133. if (pszProcessName == NULL)
134. {
135. pszProcessName = L"NULL";
136. }
137. KdPrint(("PID:%d, process name:%S\n", pInfo->ProcessId, pszProcessName));
138. if (pInfo->NextEntryOffset == 0) //==0，说明到达进程链的尾部了
139. {
140. break;
141. }
142. pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo) + pInfo->NextEntryOffset); //遍历
144. }
145. return STATUS_SUCCESS;
146. }
148. NTSTATUS DriverEntry(
149. __in PDRIVER_OBJECT DriverObject,
150. __in PUNICODE_STRING RegistryPath
151. )
152. {
153. DriverObject->DriverUnload = Unload;
154. Ring0EnumProcess();
155. return STATUS_SUCCESS;
156. }