NtQuerySystemInformation

最新推荐文章于 2024-02-07 11:42:06 发布
最新推荐文章于 2024-02-07 11:42:06 发布
阅读量1.7k 收藏
点赞数
分类专栏： VC++
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/farmwang/article/details/80658662
版权 
// CPPTest.cpp: 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>
#include <stdio.h>
#include <thread>

#define SYSTEM_PERF_INFO             0x02
#define SYSTEM_PROC_TIME             0x08
#define SYSTEM_PAGE_INFO             0x12
#define SYSTEM_CACHE_INFO            0x15
#define NT_PROCESSTHREAD_INFO        0x05
#define MAX_INFO_BUF_LEN             0x500000
#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH  ((NTSTATUS)0xC0000004L)


typedef LONG  NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;

typedef struct _LSA_UNICODE_STRING
{
	USHORT  Length;
	USHORT  MaximumLength;
	PWSTR   Buffer;
}LSA_UNICODE_STRING, *PLSA_UNICODE_STRING;

typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

typedef struct _CLIENT_ID
{
	HANDLE UniqueProcess;
	HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;

typedef struct _VM_COUNTERS
{
	ULONG PeakVirtualSize;
	ULONG VirtualSize;
	ULONG PageFaultCount;
	ULONG PeakWorkingSetSize;
	ULONG WorkingSetSize;
	ULONG QuotaPeakPagedPoolUsage;
	ULONG QuotaPagedPoolUsage;
	ULONG QuotaPeakNonPagedPoolUsage;
	ULONG QuotaNonPagedPoolUsage;
	ULONG PagefileUsage;
	ULONG PeakPagefileUsage;
}VM_COUNTERS, *PVM_COUNTERS;

typedef enum _THREAD_STATE
{
	StateInitialized,
	StateReady,
	StateRunning,
	StateStandby,
	StateTerminated,
	StateWait,
	StateTransition,
	StateUnknown
}THREAD_STATE;

typedef enum _KWAIT_REASON
{
	Executive,
	FreePage,
	PageIn,
	PoolAllocation,
	DelayExecution,
	Suspended,
	UserRequest,
	WrExecutive,
	WrFreePage,
	WrPageIn,
	WrPoolAllocation,
	WrDelayExecution,
	WrSuspended,
	WrUserRequest,
	WrEventPair,
	WrQueue,
	WrLpcReceive,
	WrLpcReply,
	WrVertualMemory,
	WrPageOut,
	WrRendezvous,
	Spare2,
	Spare3,
	Spare4,
	Spare5,
	Spare6,
	WrKernel
}KWAIT_REASON;

typedef struct _SYSTEM_THREADS
{
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG         WaitTime;
	PVOID         StartAddress;
	CLIENT_ID     ClientId;
	KPRIORITY     Priority;
	KPRIORITY     BasePriority;
	ULONG         ContextSwitchCount;
	THREAD_STATE  State;
	KWAIT_REASON  WaitReason;
}SYSTEM_THREADS, *PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES
{
	ULONG          NextEntryDelta;
	ULONG          ThreadCount;
	ULONG          Reserved1[6];
	LARGE_INTEGER  CreateTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  KernelTime;
	UNICODE_STRING ProcessName;
	KPRIORITY      BasePriority;
	ULONG          ProcessId;
	ULONG          InheritedFromProcessId;
	ULONG          HandleCount;
	ULONG          Reserved2[2];
	VM_COUNTERS    VmCounters;
	IO_COUNTERS    IoCounters;
	SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;

typedef DWORD    SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS(__stdcall *NTQUERYSYSTEMINFORMATION)
(IN     SYSTEM_INFORMATION_CLASS,
	IN OUT PVOID,
	IN     ULONG,
	OUT    PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
	LARGE_INTEGER  IdleTime;
	LARGE_INTEGER  ReadTransferCount;
	LARGE_INTEGER  WriteTransferCount;
	LARGE_INTEGER  OtherTransferCount;
	ULONG          ReadOperationCount;
	ULONG          WriteOperationCount;
	ULONG          OtherOperationCount;
	ULONG          AvailablePages;
	ULONG          TotalCommittedPages;
	ULONG          TotalCommitLimit;
	ULONG          PeakCommitment;
	ULONG          PageFaults;
	ULONG          WriteCopyFaults;
	ULONG          TransitionFaults;
	ULONG          Reserved1;
	ULONG          DemandZeroFaults;
	ULONG          PagesRead;
	ULONG          PageReadIos;
	ULONG          Reserved2[2];
	ULONG          PagefilePagesWritten;
	ULONG          PagefilePageWriteIos;
	ULONG          MappedFilePagesWritten;
	ULONG          MappedFileWriteIos;
	ULONG          PagedPoolUsage;
	ULONG          NonPagedPoolUsage;
	ULONG          PagedPoolAllocs;
	ULONG          PagedPoolFrees;
	ULONG          NonPagedPoolAllocs;
	ULONG          NonPagedPoolFress;
	ULONG          TotalFreeSystemPtes;
	ULONG          SystemCodePage;
	ULONG          TotalSystemDriverPages;
	ULONG          TotalSystemCodePages;
	ULONG          SmallNonPagedLookasideListAllocateHits;
	ULONG          SmallPagedLookasideListAllocateHits;
	ULONG          Reserved3;
	ULONG          MmSystemCachePage;
	ULONG          PagedPoolPage;
	ULONG          SystemDriverPage;
	ULONG          FastReadNoWait;
	ULONG          FastReadWait;
	ULONG          FastReadResourceMiss;
	ULONG          FastReadNotPossible;
	ULONG          FastMdlReadNoWait;
	ULONG          FastMdlReadWait;
	ULONG          FastMdlReadResourceMiss;
	ULONG          FastMdlReadNotPossible;
	ULONG          MapDataNoWait;
	ULONG          MapDataWait;
	ULONG          MapDataNoWaitMiss;
	ULONG          MapDataWaitMiss;
	ULONG          PinMappedDataCount;
	ULONG          PinReadNoWait;
	ULONG          PinReadWait;
	ULONG          PinReadNoWaitMiss;
	ULONG          PinReadWaitMiss;
	ULONG          CopyReadNoWait;
	ULONG          CopyReadWait;
	ULONG          CopyReadNoWaitMiss;
	ULONG          CopyReadWaitMiss;
	ULONG          MdlReadNoWait;
	ULONG          MdlReadWait;
	ULONG          MdlReadNoWaitMiss;
	ULONG          MdlReadWaitMiss;
	ULONG          ReadAheadIos;
	ULONG          LazyWriteIos;
	ULONG          LazyWritePages;
	ULONG          DataFlushes;
	ULONG          DataPages;
	ULONG          ContextSwitches;
	ULONG          FirstLevelTbFills;
	ULONG          SecondLevelTbFills;
	ULONG          SystemCall;
}SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct __SYSTEM_PROCESSOR_TIMES
{
	LARGE_INTEGER IdleTime;
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER DpcTime;
	LARGE_INTEGER InterruptTime;
	ULONG         InterruptCount;
}SYSTEM_PROCESSOR_TIMES, *PSYSTEM_PROCESSOR_TIMES;

typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
	ULONG NetxEntryOffset;
	ULONG CurrentSize;
	ULONG TotalUsed;
	ULONG PeakUsed;
	UNICODE_STRING FileName;
}SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;

typedef struct _SYSTEM_CACHE_INFORMATION
{
	ULONG SystemCacheWsSize;
	ULONG SystemCacheWsPeakSize;
	ULONG SystemCacheWsFaults;
	ULONG SystemCacheWsMinimum;
	ULONG SystemCacheWsMaximum;
	ULONG TransitionSharedPages;
	ULONG TransitionSharedPagesPeak;
	ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION, *PSYSTEM_CACHE_INFORMATION;


DWORD EnumProcess()
{
	PSYSTEM_PROCESSES  pSystemProc;
	HMODULE            hNtDll = NULL;
	LPVOID             lpSystemInfo = NULL;
	DWORD              dwNumberBytes = MAX_INFO_BUF_LEN;
	DWORD              dwTotalProcess = 0;
	DWORD              dwReturnLength;
	NTSTATUS           Status;
	LONGLONG           llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");

		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
		Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO, lpSystemInfo, dwNumberBytes, &dwReturnLength);

		if (Status == STATUS_INFO_LENGTH_MISMATCH)
		{
			printf("STATUS_INFO_LENGTH_MISMATCH\n");
			__leave;
		}
		else if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n", "ProcessName", "PID", "PPID", "WsSize", "Prio.", "Thread", "Handle", "CPU Time");
		printf("--------------------------------------------------------------------------\n");
		pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;

		while (pSystemProc->NextEntryDelta != 0)
		{
			if (pSystemProc->ProcessId != 0)
			{
				wprintf(L"%-20s", pSystemProc->ProcessName.Buffer);
			}
			else
			{
				wprintf(L"%-20s", L"System Idle Process");
			}
			printf("%6d", pSystemProc->ProcessId);
			printf("%7d", pSystemProc->InheritedFromProcessId);
			printf("%7dK", pSystemProc->VmCounters.WorkingSetSize / 1024);
			printf("%6d", pSystemProc->BasePriority);
			printf("%7d", pSystemProc->ThreadCount);
			printf("%7d", pSystemProc->HandleCount);
			llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart;
			llTempTime /= 10000;
			printf("%3d:", llTempTime / (60 * 60 * 1000));
			llTempTime %= 60 * 60 * 1000;
			printf("%.2d:", llTempTime / (60 * 1000));
			llTempTime %= 60 * 1000;
			printf("%.2d.", llTempTime / 1000);
			llTempTime %= 1000;
			printf("%.3d", llTempTime);

			printf("\n");
			dwTotalProcess++;
			pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
		}

		printf("--------------------------------------------------------------------------\n");
		printf("\nTotal %d Process(es) !\n\n", dwTotalProcess);
		printf("PID\t ==> Process Identification\n");
		printf("PPID\t ==> Parent Process Identification\n");
		printf("WsSize\t ==> Working Set Size\n");
		printf("Prio.\t ==> Base Priority\n");
		printf("Thread\t ==> Thread Count\n");
		printf("Handle\t ==> Handle Count\n");
		printf("CPU Time ==> Processor Time\n");
	}
	__finally
	{
		if (lpSystemInfo != NULL)
		{
			free(lpSystemInfo);
		}
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD SpeciProcess(DWORD dwPID)
{
	PSYSTEM_PROCESSES  pSystemProc = NULL;
	PSYSTEM_THREADS    pSystemThre = NULL;
	HMODULE            hNtDll = NULL;
	LPVOID             lpSystemInfo = NULL;
	DWORD              dwNumberBytes = MAX_INFO_BUF_LEN;
	DWORD              dwTotalProcess = 0;
	DWORD              dwReturnLength;
	NTSTATUS           Status;
	LONGLONG           llTempTime;
	ULONG              ulIndex;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
		Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO, lpSystemInfo, dwNumberBytes, &dwReturnLength);

		if (Status == STATUS_INFO_LENGTH_MISMATCH)
		{
			printf("STATUS_INFO_LENGTH_MISMATCH\n");
			__leave;
		}
		else if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
		while (pSystemProc->NextEntryDelta != 0)
		{
			if (pSystemProc->ProcessId == dwPID)
			{
				printf("ProcessName:\t\t ");
				if (pSystemProc->ProcessId != 0)
				{
					wprintf(L"%-20s\n", pSystemProc->ProcessName.Buffer);
				}
				else
				{
					wprintf(L"%-20s\n", L"System Idle Process");
				}
				printf("ProcessID:\t\t %d\t\t", pSystemProc->ProcessId);
				printf("ParentProcessID:\t%d\n", pSystemProc->InheritedFromProcessId);
				printf("KernelTime:\t\t ");
				llTempTime = pSystemProc->KernelTime.QuadPart;
				llTempTime /= 10000;
				printf("%d:", llTempTime / (60 * 60 * 1000));
				llTempTime %= 60 * 60 * 1000;
				printf("%.2d:", llTempTime / (60 * 1000));
				llTempTime %= 60 * 1000;
				printf("%.2d.", llTempTime / 1000);
				llTempTime %= 1000;
				printf("%.3d\t", llTempTime);
				printf("UserTime:\t\t");
				llTempTime = pSystemProc->UserTime.QuadPart;
				llTempTime /= 10000;
				printf("%d:", llTempTime / (60 * 60 * 1000));
				llTempTime %= 60 * 60 * 1000;
				printf("%.2d:", llTempTime / (60 * 1000));
				llTempTime %= 60 * 1000;
				printf("%.2d.", llTempTime / 1000);
				llTempTime %= 1000;
				printf("%.3d\n", llTempTime);
				printf("Privilege:\t\t %d%%\t\t", (pSystemProc->KernelTime.QuadPart * 100) / (pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
				printf("User:\t\t\t%d%%\n", (pSystemProc->UserTime.QuadPart * 100) / (pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

				printf("ThreadCount:\t\t %d\t\t", pSystemProc->ThreadCount);
				printf("HandleCount:\t\t%d\n", pSystemProc->HandleCount);

				printf("BasePriority:\t\t %-2d\t\t", pSystemProc->BasePriority);
				printf("PageFaultCount:\t\t%d\n\n", pSystemProc->VmCounters.PageFaultCount);

				printf("PeakWorkingSetSize(K):\t %-8d\t", pSystemProc->VmCounters.PeakWorkingSetSize / 1024);
				printf("WorkingSetSize(K):\t%-8d\n", pSystemProc->VmCounters.WorkingSetSize / 1024);


				printf("PeakPagedPool(K):\t %-8d\t", pSystemProc->VmCounters.QuotaPeakPagedPoolUsage / 1024);
				printf("PagedPool(K):\t\t%-8d\n", pSystemProc->VmCounters.QuotaPagedPoolUsage / 1024);
				printf("PeakNonPagedPook(K):\t %-8d\t", pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage / 1024); printf("NonePagedPook(K):\t%-8d\n", pSystemProc->VmCounters.QuotaNonPagedPoolUsage / 1024);
				printf("PeakPagefile(K):\t %-8d\t", pSystemProc->VmCounters.PeakPagefileUsage / 1024);
				printf("Pagefile(K):\t\t%-8d\n", pSystemProc->VmCounters.PagefileUsage / 1024);

				printf("PeakVirtualSize(K):\t %-8d\t", pSystemProc->VmCounters.PeakVirtualSize / 1024);
				printf("VirtualSize(K):\t\t%-8d\n\n", pSystemProc->VmCounters.VirtualSize / 1024);

				printf("ReadTransfer:\t\t %-8d\t", pSystemProc->IoCounters.ReadTransferCount);
				printf("ReadOperationCount:\t%-8d\n", pSystemProc->IoCounters.ReadOperationCount);

				printf("WriteTransfer:\t\t %-8d\t", pSystemProc->IoCounters.WriteTransferCount);
				printf("WriteOperationCount:\t%-8d\n", pSystemProc->IoCounters.WriteOperationCount);

				printf("OtherTransfer:\t\t %-8d\t", pSystemProc->IoCounters.OtherTransferCount);
				printf("OtherOperationCount:\t%-8d\n\n", pSystemProc->IoCounters.OtherOperationCount);

				printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n", "TID", "Pri", "BPr", "Priv", "User", "KernelTime", "UserTime", "StartAddr", "CSwitC", "State", "WtReason");
				printf("-------------------------------------------------------------------------------\n");

				for (ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
				{
					pSystemThre = &pSystemProc->Threads[ulIndex];
					printf("%-5d", pSystemProc->Threads[ulIndex].ClientId.UniqueThread);

					printf("%3d", pSystemProc->Threads[ulIndex].Priority);
					printf("%4d", pSystemProc->Threads[ulIndex].BasePriority);

					printf("%4d%%", (pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 100) / (pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
					printf("%4d%%", (pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100) / (pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

					llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
					llTempTime /= 10000;
					printf("%2d:", llTempTime / (60 * 60 * 1000));
					llTempTime %= 60 * 60 * 1000;
					printf("%.2d.", llTempTime / (60 * 1000));
					llTempTime %= 60 * 1000;
					printf("%.2d.", llTempTime / 1000);
					llTempTime %= 100;
					printf("%.2d ", llTempTime);

					llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
					llTempTime /= 10000;
					printf("%2d:", llTempTime / (60 * 60 * 1000));
					llTempTime %= 60 * 60 * 1000;
					printf("%.2d.", llTempTime / (60 * 1000));
					llTempTime %= 60 * 1000;
					printf("%.2d.", llTempTime / 1000);
					llTempTime %= 100;
					printf("%.2d ", llTempTime);

					printf(" 0x%.8X", pSystemProc->Threads[ulIndex].StartAddress);
					printf("%7d", pSystemProc->Threads[ulIndex].ContextSwitchCount);

					switch (pSystemProc->Threads[ulIndex].State)
					{
					case StateInitialized:
						printf("%6s", "Init.");
						break;
					case StateReady:
						printf("%6s", "Ready");
						break;
					case StateRunning:
						printf("%6s", "Run");
						break;
					case StateStandby:
						printf("%6s", "StBy.");
						break;
					case StateTerminated:
						printf("%6s", "Term.");
						break;
					case StateWait:
						printf("%6s", "Wait");
						break;
					case StateTransition:
						printf("%6s", "Tran.");
						break;
					case StateUnknown:
						printf("%6s", "Unkn.");
						break;
					default:
						printf("%6s", "Unkn.");
						break;
					}

					switch (pSystemProc->Threads[ulIndex].WaitReason)
					{
					case Executive:
						printf(" %-8s", "Executi.");
						break;
					case FreePage:
						printf(" %-8s", "FreePag.");
						break;
					case PageIn:
						printf(" %-8s", "PageIn");
						break;
					case PoolAllocation:
						printf(" %-8s", "PoolAll.");
						break;
					case DelayExecution:
						printf(" %-8s", "DelayEx.");
						break;
					case Suspended:
						printf(" %-8s", "Suspend.");
						break;
					case UserRequest:
						printf(" %-8s", "UserReq.");
						break;
					case WrExecutive:
						printf(" %-8s", "WrExect.");
						break;
					case WrFreePage:
						printf(" %-8s", "WrFrePg.");
						break;
					case WrPageIn:
						printf(" %-8s", "WrPageIn");
						break;
					case WrPoolAllocation:
						printf(" %-8s", "WrPoolA.");
						break;
					case WrSuspended:
						printf(" %-8s", "WrSuspe.");
						break;
					case WrUserRequest:
						printf(" %-8s", "WrUsReq.");
						break;
					case WrEventPair:
						printf(" %-8s", "WrEvent.");
						break;
					case WrQueue:
						printf(" %-8s", "WrQueue");
						break;
					case WrLpcReceive:
						printf(" %-8s", "WrLpcRv.");
						break;
					case WrLpcReply:
						printf(" %-8s", "WrLpcRp.");
						break;
					case WrVertualMemory:
						printf(" %-8s", "WrVerMm.");
						break;
					case WrPageOut:
						printf(" %-8s", "WrPgOut.");
						break;
					case WrRendezvous:
						printf(" %-8s", "WrRende.");
						break;
					case WrKernel:
						printf(" %-8s", "WrKernel");
						break;
					default:
						printf(" %-8s", "Unknown");
						break;
					}
					printf("\n");
				}

				printf("-------------------------------------------------------------------------------\n\n");
				printf("Total %d Thread(s) !\n\n", ulIndex);

				dwTotalProcess++;
				break;
			}
			pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
		}
	}
	__finally
	{
		if (dwTotalProcess == 0)
		{
			printf("Could not found the %d Process !\n", dwPID);
		}
		else
		{
			printf("TID:\t\t====>\tThread Identification\n");
			printf("Pri:\t\t====>\tPriority\n");
			printf("BPr:\t\t====>\tBase Priority\n");
			printf("Priv:\t\t====>\tPrivilege\n");
			printf("StartAddr:\t====>\tThread Start Address\n");
			printf("CSwitC:\t\t====>\tContext Switch Count\n");
			printf("WtReason:\t====>\tWait Reason\n");
		}
		if (lpSystemInfo != NULL)
		{
			free(lpSystemInfo);
		}
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

VOID Start()
{
	printf("T-PMList, by TOo2y\n");
	printf("E-mail: TOo2y@safechina.net\n");
	printf("HomePage: www.safechina.net\n");
	printf("Date: 05-10-2003\n\n");
	return;
}

VOID Usage()
{
	printf("Usage:\tT-PMList  [-e] | [-s PID]\n");
	printf("  -e\t  Enumerate All Processes\n");
	printf("  -s PID  Show Special Process Information with PID\n\n");
	return;
}

DWORD PerfInfo()
{
	SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
	HMODULE         hNtDll = NULL;
	DWORD           dwNumberBytes;
	DWORD           dwReturnLength;
	NTSTATUS        Status;
	LONGLONG        llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
		Status = NtQuerySystemInformation(SYSTEM_PERF_INFO, &SystemPerfInfo, dwNumberBytes, &dwReturnLength);
		if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation for Performance Error: %d\n", GetLastError());
			__leave;
		}

		printf("IdleTime:\t\t");
		llTempTime = SystemPerfInfo.IdleTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("ReadOperationCount:\t%-10d\t", SystemPerfInfo.ReadOperationCount);
		printf("ReadTransferCount:\t%d\n", SystemPerfInfo.ReadTransferCount);
		printf("WriteOperationCount:\t%-10d\t", SystemPerfInfo.WriteOperationCount);

		printf("WriteTransferCount:\t%d\n", SystemPerfInfo.WriteTransferCount);
		printf("OtherOperationCount:\t%-10d\t", SystemPerfInfo.OtherOperationCount);

		printf("OtherTransferCount:\t%d\n", SystemPerfInfo.OtherTransferCount);

		printf("AvailablePages:\t\t%-10d\t", SystemPerfInfo.AvailablePages);
		printf("TotalCommittedPage:\t%d\n", SystemPerfInfo.TotalCommittedPages);
		printf("CommitLimit:\t\t%-10d\t", SystemPerfInfo.TotalCommitLimit);
		printf("PeakCommitment:\t\t%d\n", SystemPerfInfo.PeakCommitment);

		printf("PageFault:\t\t%-10d\t", SystemPerfInfo.PageFaults);
		printf("WriteCopyFault:\t\t%d\n", SystemPerfInfo.WriteCopyFaults);
		printf("TransitionFault:\t%-10d\t", SystemPerfInfo.TransitionFaults);
		printf("DemandZeroFault:\t%d\n", SystemPerfInfo.DemandZeroFaults);

		printf("PagesRead:\t\t%-10d\t", SystemPerfInfo.PagesRead);
		printf("PageReadIos:\t\t%d\n", SystemPerfInfo.PageReadIos);
		printf("PagesWritten:\t\t%-10d\t", SystemPerfInfo.PagefilePagesWritten);
		printf("PageWriteIos:\t\t%d\n", SystemPerfInfo.PagefilePageWriteIos);
		printf("MappedFilePagesWritten:\t%-10d\t", SystemPerfInfo.MappedFilePagesWritten);
		printf("MappedFileWriteIos:\t%d\n", SystemPerfInfo.MappedFileWriteIos);

		printf("PagedPoolUsage:\t\t%-10d\t", SystemPerfInfo.PagedPoolUsage);
		printf("NonPagedPoolUsage:\t%d\n", SystemPerfInfo.NonPagedPoolUsage);
		printf("PagedPoolAllocs:\t%-10d\t", SystemPerfInfo.PagedPoolAllocs);
		printf("NonPagedPoolAllocs:\t%d\n", SystemPerfInfo.NonPagedPoolAllocs);
		printf("PagedPoolFrees:\t\t%-10d\t", SystemPerfInfo.PagedPoolFrees);
		printf("NonPagedPoolFrees:\t%d\n", SystemPerfInfo.NonPagedPoolFress);

		printf("SystemCodePage:\t\t%-10d\t", SystemPerfInfo.SystemCodePage);
		printf("TotalSystemCodePage:\t%d\n", SystemPerfInfo.TotalSystemCodePages);
		printf("TotalFreeSysPTE:\t%-10d\t", SystemPerfInfo.TotalFreeSystemPtes);
		printf("TotalSystemDriverPages:\t%d\n", SystemPerfInfo.TotalSystemDriverPages);
		printf("PagedPoolPage:\t\t%-10d\t", SystemPerfInfo.PagedPoolPage);
		printf("SystemDriverPage:\t%d\n", SystemPerfInfo.SystemDriverPage);

		printf("FastReadWait:\t\t%-10d\t", SystemPerfInfo.FastReadWait);
		printf("FastReadNoWait:\t\t%d\n", SystemPerfInfo.FastReadNoWait);
		printf("FastReadNoPossible:\t%-10d\t", SystemPerfInfo.FastReadNotPossible);

		printf("FastReadResourceMiss:\t%d\n", SystemPerfInfo.FastReadResourceMiss);

		printf("FastMdlReadWait:\t%-10d\t", SystemPerfInfo.FastMdlReadWait);
		printf("FastMdlReadNoWait:\t%d\n", SystemPerfInfo.FastMdlReadNoWait);
		printf("FastMdlReadNotPossible:\t%-10d\t", SystemPerfInfo.FastMdlReadNotPossible);
		printf("FastMdlReadResourceMiss:%d\n", SystemPerfInfo.FastMdlReadResourceMiss);

		printf("MapDataWait:\t\t%-10d\t", SystemPerfInfo.MapDataWait);
		printf("MapDataNoWait:\t\t%d\n", SystemPerfInfo.MapDataNoWait);
		printf("MapDataWaitMiss:\t%-10d\t", SystemPerfInfo.MapDataWaitMiss);
		printf("MapDataNoWaitMiss:\t%d\n", SystemPerfInfo.MapDataNoWaitMiss);

		printf("ReadAheadIos:\t\t%-10d\t", SystemPerfInfo.ReadAheadIos);
		printf("PinMappedDataCount:\t%d\n", SystemPerfInfo.PinMappedDataCount);
		printf("PinReadWait:\t\t%-10d\t", SystemPerfInfo.PinReadWait);
		printf("PinReadNoWait:\t\t%d\n", SystemPerfInfo.PinReadNoWait);
		printf("PinReadWaitMiss:\t%-10d\t", SystemPerfInfo.PinReadWaitMiss);
		printf("PinReadNoWaitMiss:\t%d\n", SystemPerfInfo.PinReadNoWaitMiss);

		printf("CopyReadWait:\t\t%-10d\t", SystemPerfInfo.CopyReadWait);
		printf("CopyReadNoWait:\t\t%d\n", SystemPerfInfo.CopyReadNoWait);
		printf("CopyReadWaitMiss:\t%-10d\t", SystemPerfInfo.CopyReadWaitMiss);
		printf("CopyReadNoWaitMiss:\t%-10d\n", SystemPerfInfo.CopyReadNoWaitMiss);
		printf("MdlReadWait:\t\t%-10d\t", SystemPerfInfo.MdlReadWait);
		printf("MdlReadNoWait:\t\t%d\n", SystemPerfInfo.MdlReadNoWait);
		printf("MdlReadWaitMiss:\t%-10d\t", SystemPerfInfo.MdlReadWaitMiss);
		printf("MdlReadNoWaitMiss:\t%d\n", SystemPerfInfo.MdlReadNoWaitMiss);

		printf("LazyWriteIos:\t\t%-10d\t", SystemPerfInfo.LazyWriteIos);
		printf("LazyWritePages:\t\t%d\n", SystemPerfInfo.LazyWritePages);
		printf("DataPages:\t\t%-10d\t", SystemPerfInfo.DataPages);
		printf("DataFlushes:\t\t%d\n", SystemPerfInfo.DataFlushes);
		printf("FirstLevelTbFills:\t%-10d\t", SystemPerfInfo.FirstLevelTbFills);
		printf("SecondLevelTbFills:\t%d\n", SystemPerfInfo.SecondLevelTbFills);
		printf("ContextSwitches:\t%-10d\t", SystemPerfInfo.ContextSwitches);
		printf("SytemCall:\t\t%d\n", SystemPerfInfo.SystemCall);

		printf("MemorySystemCachePage:\t\t\t%d\n", SystemPerfInfo.MmSystemCachePage);

		printf("SmallPagedLookasideListAllocateHits:\t%d\n", SystemPerfInfo.SmallPagedLookasideListAllocateHits);
		printf("SmallNonPagedLookasideListAllocateHits:\t%d\n", SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);
	}
	__finally
	{
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD ProcTime()
{
	SYSTEM_PROCESSOR_TIMES  SystemProcTime;
	HMODULE                 hNtDll = NULL;
	DWORD                   dwNumberBytes;
	DWORD                   dwReturnLength;
	NTSTATUS                Status;
	LONGLONG                llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress Error: %d\n", GetLastError());
			__leave;
		}

		Status = NtQuerySystemInformation(SYSTEM_PROC_TIME, &SystemProcTime, dwNumberBytes, &dwReturnLength);
		if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation for Processor Time Error: %d\n", GetLastError());
			__leave;
		}

		printf("IdleTime:\t\t");
		llTempTime = SystemProcTime.IdleTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("KernelTime:\t\t");
		llTempTime = SystemProcTime.KernelTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("UserTime:\t\t");
		llTempTime = SystemProcTime.UserTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("DpcTime:\t\t");
		llTempTime = SystemProcTime.DpcTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("InterruptTime:\t\t");
		llTempTime = SystemProcTime.InterruptTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:", llTempTime / (60 * 60 * 1000));
		llTempTime %= 60 * 60 * 1000;
		printf("%.2d:", llTempTime / (60 * 1000));
		llTempTime %= 60 * 1000;
		printf("%.2d.", llTempTime / 1000);
		llTempTime %= 1000;
		printf("%.3d\n", llTempTime);

		printf("InterruptCount:\t\t%d\n", SystemProcTime.InterruptCount);
	}
	__finally
	{
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD PagefileInfo()
{
	PSYSTEM_PAGEFILE_INFORMATION   pSystemPagefileInfo;
	PVOID                          pBuffer=NULL;
	HMODULE                        hNtDll = NULL;
	DWORD                          dwNumberBytes;
	DWORD                          dwReturnLength;
	NTSTATUS                       Status;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		dwNumberBytes = MAX_INFO_BUF_LEN;
		pBuffer = (LPVOID)malloc(dwNumberBytes);
		Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO, pBuffer, dwNumberBytes, &dwReturnLength);
		if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation for Pagefile Error: %d\n", GetLastError());
			__leave;
		}

		pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
		do
		{
			printf("CurrentPagefileSize:\t%d\n", pSystemPagefileInfo->CurrentSize);
			printf("TotalPagefileUsed:\t%d\n", pSystemPagefileInfo->TotalUsed);
			printf("PeakPagefileUsed:\t%d\n", pSystemPagefileInfo->PeakUsed);
			wprintf(L"PagefileFileName:\t%s\n", pSystemPagefileInfo->FileName.Buffer);

			pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSystemPagefileInfo->NetxEntryOffset);
		} while (pSystemPagefileInfo->NetxEntryOffset != 0);
	}
	__finally
	{
		if (pBuffer != NULL)
		{
			free(pBuffer);
		}
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD CacheInfo()
{
	SYSTEM_CACHE_INFORMATION       SystemCacheInfo;
	HMODULE                        hNtDll = NULL;
	DWORD                          dwNumberBytes;
	DWORD                          dwReturnLength;
	NTSTATUS                       Status;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
		if (hNtDll == NULL)
		{
			printf("LoadLibrary Error: %d\n", GetLastError());
			__leave;
		}

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
		if (NtQuerySystemInformation == NULL)
		{
			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n", GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
		Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO, &SystemCacheInfo, dwNumberBytes, &dwReturnLength);
		if (Status != STATUS_SUCCESS)
		{
			printf("NtQuerySystemInformation for Cache Error: %d\n", GetLastError());
			__leave;
		}

		printf("CacheWorkingSetSize:\t\t%d(KB)\n", SystemCacheInfo.SystemCacheWsSize / 1024);
		printf("CacheWorkingSetPeakSize:\t%d(KB)\n", SystemCacheInfo.SystemCacheWsPeakSize / 1024);
		printf("CacheWorkingSetFaults:\t\t%d\n", SystemCacheInfo.SystemCacheWsFaults);
		printf("CacheWorkingSetMinimum:\t\t%d\n", SystemCacheInfo.SystemCacheWsMinimum);
		printf("CacheWorkingSetMaximum:\t\t%d\n", SystemCacheInfo.SystemCacheWsMaximum);
		printf("TransitionSharedPages:\t\t%d\n", SystemCacheInfo.TransitionSharedPages);
		printf("TransitionSharedPagesPeak:\t%d\n", SystemCacheInfo.TransitionSharedPagesPeak);

	}
	__finally
	{
		if (hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

int main()
{
	EnumProcess();
	SpeciProcess(3416);  //自己找个进程ID
	PerfInfo();
	ProcTime();
	PagefileInfo();
	CacheInfo();

	Sleep(1000000);
  //  return 0;
}

Farmwang
关注
专栏目录
NtQuerySystemInformation 系统信息
06-17
Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服务。平常我们总是调用MS为我们提供的公用的Win32 API函数来实现来实现我们系统的功能。今天我们要谈的是如何通过本机系统服务(Native API）来探测本机系统信息。当然，微软没有为我们提供关于本机系统服务的文档 (Undocumented)，也就是不会为对它的使用提供任何的保证，所以我们不提倡使用Native API来开发软件。不过在特殊情况下，本机系统服务却为我们提供了通向“秘密”的捷径,本文详细介绍了NtQuerySystemInformation的技术秘密
NtQuerySystemInformation的使用
乐朝夕与之共
12-19 8493
今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包 括对某些信息的控制和设置。以下是这个函数的原型：  typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)     (IN      S
NtQuerySystemInformation获得某进程某时刻占用的CPU、内存、虚拟内存、句柄数等信息.zip
03-19
NtQuerySystemInformation获得某进程某时刻占用的CPU、内存、虚拟内存、句柄数等信息.zip
ring3-kit:使用NT API挂钩从任务管理器隐藏进程（NtQuerySystemInformation）
05-27
使用NT挂钩（NtQuerySystemInformation）从任务管理器中隐藏进程。 一个简单的Ring-3（用户模式）rootkit。 如何 将API函数NtQuerySystemInformation（）与我们自己的函数挂钩，该函数对任务管理器隐藏进程 挂钩...
易语言-用NtQuerySystemInformation函数暴力枚举驱动
06-29
易代码出于本人之手,另附VB代码注释,VB代码非原创,2年前从看雪某个角落瞄出来翻译的[因为我个人非常喜欢把各种语言互相转换- -],一直把这个功能集成在自己的私人模块里,今天拿出来与大家分享. 因为原代码申请内存...
用NtQuerySystemInformation函数暴力枚举驱动
06-01
资源介绍：。易代码出于本人之手,另附VB代码注释,VB代码非原创,2年前从看雪某个角落瞄出来翻译的[因为我个人非常喜欢把各种语言互相转换- -],一直把这个功能集成在自己的私人模块里,今天拿出来与大家分享....
NtQuerySystemInformation判断线程是否被挂起/判断线程状态
03-20
NtQuerySystemInformation判断线程是否被挂起/判断线程状态
NtQuerySystemInformation用法
04-29 1654
借助wrk代码分析出该函数用法： #include #define IN #define OUT #define OPTIONAL #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) #define MAX_STACK_DEPTH 32 #define MAXIMUM_NUMA_NODES 16 #define STATU
NtQuerySystemInformation函数
zhymxt的专栏
08-29 961
转自：http://hi.baidu.com/bsbgong/blog/item/675648265f4a920b8b82a1b7.htmlhttp://hi.baidu.com/bsbgong/blog/item/675648265f4a920b8b82a1b7.html Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服
获取进程CPU占用率 -- NtQuerySystemInformation
jiangqin115的专栏
07-28 4785
今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包 括对某些信息的控制和设置。 以下是这个函数的原型： typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION) (IN
NtQuerySystemInformation 获取系统信息
欲穷千里目，更上一层楼
12-06 5600
Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服务。平常我们总是调用MS为我们提供的公用的Win32 API函数来实现来实现 我们系统的功能。今天我们要谈的是如何通过本机系统服务(Native API)来探测本机系统信息。当然，微软没有为我们提供关于本机系统服务的文档 (Undocumented)，也就是不会为对它的使用提供任何的保证，所以我们不提倡使用N
转自“看雪论坛”--NtQuerySystemInformation
lyclowlevel的专栏
09-27 2534
ProcessExplorer原理分析之句柄处理 by sucsor/RCT 1,如何获得各进程的句柄   使用NtQuerySystemInformation函数的SystemHandleInformation=16号功能.   其相关结构定义如下:   typedef
C# 利用WINAPI函数 NtQuerySystemInformation 获取CPUload利用率
liulilittle的博客
11-05 499
【代码】C# 利用WINAPI函数 NtQuerySystemInformation 获取CPUload利用率。
使用 NtQuerySystemInformation 遍历进程信息
最新发布
溡漪幽博客
02-07 1364
通过遍历系统进程信息，我们可以了解系统中运行的各种进程的详细信息，从而更好地进行系统管理和性能优化。本文介绍了一种通过调用 Windows 系统API来获取并遍历系统进程信息的技术，并提供了一段示例代码以帮助读者理解该技术的实现方法。
NtQuerySystemInformation 枚举进程
10-08 729
函数原型:NTSTATUS WINAPI NtQuerySystemInformation( _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _Inout_ PVOID SystemInformation, _In_ ULONG...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

Farmwang

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值