_SYSTEM_PROCESS 32位与64位的结构

typedef ULONG KPRIORITY;

typedef enum _SYSTEM_INFORMATION_CLASS  
{  
 SystemBasicInformation,                 //  0 Y N  
 SystemProcessorInformation,             //  1 Y N  
 SystemPerformanceInformation,           //  2 Y N  
 SystemTimeOfDayInformation,             //  3 Y N  
 SystemNotImplemented1,                  //  4 Y N  
 SystemProcessesAndThreadsInformation,   //  5 Y N  
 SystemCallCounts,                       //  6 Y N  
 SystemConfigurationInformation,         //  7 Y N  
 SystemProcessorTimes,                   //  8 Y N  
 SystemGlobalFlag,                       //  9 Y Y  
 SystemNotImplemented2,                  // 10 Y N  
 SystemModuleInformation,                // 11 Y N  
 SystemLockInformation,                  // 12 Y N  
 SystemNotImplemented3,                  // 13 Y N  
 SystemNotImplemented4,                  // 14 Y N  
 SystemNotImplemented5,                  // 15 Y N  
 SystemHandleInformation,                // 16 Y N  
 SystemObjectInformation,                // 17 Y N  
 SystemPagefileInformation,              // 18 Y N  
 SystemInstructionEmulationCounts,       // 19 Y N  
 SystemInvalidInfoClass1,                // 20  
 SystemCacheInformation,                 // 21 Y Y  
 SystemPoolTagInformation,               // 22 Y N  
 SystemProcessorStatistics,              // 23 Y N  
 SystemDpcInformation,                   // 24 Y Y  
 SystemNotImplemented6,                  // 25 Y N  
 SystemLoadImage,                        // 26 N Y  
 SystemUnloadImage,                      // 27 N Y  
 SystemTimeAdjustment,                   // 28 Y Y  
 SystemNotImplemented7,                  // 29 Y N  
 SystemNotImplemented8,                  // 30 Y N  
 SystemNotImplemented9,                  // 31 Y N  
 SystemCrashDumpInformation,             // 32 Y N  
 SystemExceptionInformation,             // 33 Y N  
 SystemCrashDumpStateInformation,        // 34 Y Y/N  
 SystemKernelDebuggerInformation,        // 35 Y N  
 SystemContextSwitchInformation,         // 36 Y N  
 SystemRegistryQuotaInformation,         // 37 Y Y  
 SystemLoadAndCallImage,                 // 38 N Y  
 SystemPrioritySeparation,               // 39 N Y  
 SystemNotImplemented10,                 // 40 Y N  
 SystemNotImplemented11,                 // 41 Y N  
 SystemInvalidInfoClass2,                // 42  
 SystemInvalidInfoClass3,                // 43  
 SystemTimeZoneInformation,              // 44 Y N  
 SystemLookasideInformation,             // 45 Y N  
 SystemSetTimeSlipEvent,                 // 46 N Y  
 SystemCreateSession,                    // 47 N Y  
 SystemDeleteSession,                    // 48 N Y  
 SystemInvalidInfoClass4,                // 49  
 SystemRangeStartInformation,            // 50 Y N  
 SystemVerifierInformation,              // 51 Y Y  
 SystemAddVerifier,                      // 52 N Y  
 SystemSessionProcessesInformation       // 53 Y N  

} SYSTEM_INFORMATION_CLASS;

typedef struct _LSA_UNICODE_STRING  
{  
 USHORT Length;  
 USHORT MaximumLength;  
 PWSTR Buffer;  

} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

typedef struct _CLIENT_ID  
{  
 HANDLE UniqueProcess;  
 HANDLE UniqueThread;  
} CLIENT_ID;

typedef enum _THREAD_STATE  
{  
 StateInitialized,  
 StateReady,  
 StateRunning,  
 StateStandby,  
 StateTerminated,  
 StateWait,  
 StateTransition,  
 StateUnknown  
} THREAD_STATE; 

typedef enum _KWAIT_REASON  
{  
 Executive,  
 FreePage,  
 PageIn,  
 PoolAllocation,  
 DelayExecution,  
 Suspended,  
 UserRequest,  
 WrExecutive,  
 WrFreePage,  
 WrPageIn,  
 WrPoolAllocation,  
 WrDelayExecution,  
 WrSuspended,  
 WrUserRequest,  
 WrEventPair,  
 WrQueue,  
 WrLpcReceive,  
 WrLpcReply,  
 WrVirtualMemory,  
 WrPageOut,  
 WrRendezvous,  
 Spare2,  
 Spare3,  
 Spare4,  
 Spare5,  
 Spare6,  
 WrKernel  
} KWAIT_REASON;  

typedef struct _VM_COUNTERS  
{  
 ULONG PeakVirtualSize;       

 ULONG VirtualSize;                

 ULONG PageFaultCount;        

 ULONG PeakWorkingSetSize;    

 ULONG WorkingSetSize;           
 ULONG QuotaPeakPagedPoolUsage;      

 ULONG QuotaPagedPoolUsage;        

 ULONG QuotaPeakNonPagedPoolUsage;  

 ULONG QuotaNonPagedPoolUsage;      

 ULONG PagefileUsage;              

 ULONG PeakPagefileUsage;        

} VM_COUNTERS, *PVM_COUNTERS;

typedef struct _SYSTEM_THREADS_X86
{  
 LARGE_INTEGER KernelTime;  
 LARGE_INTEGER UserTime;  
 LARGE_INTEGER CreateTime;  
 ULONG WaitTime;  
 PVOID StartAddress;  
 CLIENT_ID ClientId;  
 KPRIORITY Priority;  
 KPRIORITY BasePriority;  
 ULONG ContextSwitchCount;  
 THREAD_STATE State;  
 KWAIT_REASON WaitReason;  

} SYSTEM_THREADS_X86, *PSYSTEM_THREADS_X86;

typedef struct _SYSTEM_THREADS_X64
{  
 LARGE_INTEGER KernelTime;  
 LARGE_INTEGER UserTime;  
 LARGE_INTEGER CreateTime;  
 ULONG WaitTime;  
 PVOID StartAddress;  
 CLIENT_ID ClientId;  
 KPRIORITY Priority;  
 KPRIORITY BasePriority;  
 ULONG ContextSwitchCount;  
 THREAD_STATE ThreadState;  
 KWAIT_REASON WaitReason;  
 ULONG Reserved;
} SYSTEM_THREADS_X64, *PSYSTEM_THREADS_X64;

typedef struct _SYSTEM_PROCESSES_X86 
{  
 ULONG NextEntryDelta;  
 ULONG ThreadCount;  
 ULONG Reserved1[6];  
 LARGE_INTEGER CreateTime;  
 LARGE_INTEGER UserTime;  
 LARGE_INTEGER KernelTime;  
 UNICODE_STRING ProcessName;  
 KPRIORITY BasePriority;  
 ULONG ProcessId;  
 ULONG InheritedFromProcessId;  
 ULONG HandleCount;  
 ULONG Reserved2[2];  
 VM_COUNTERS  VmCounters;  
 IO_COUNTERS IoCounters;  
 SYSTEM_THREADS_X86 Threads[1];  
} SYSTEM_PROCESSES_X86 , *PSYSTEM_PROCESSES_X86;

typedef struct _SYSTEM_PROCESSES_X64
{
 ULONG NextEntryDelta; //构成结构序列的偏移量;
 ULONG ThreadCount; //线程数目;
 ULONG Reserved1[6];
 LARGE_INTEGER CreateTime; //创建时间;
 LARGE_INTEGER UserTime;//用户模式(Ring 3)的CPU时间;
 LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间;
 UNICODE_STRING ProcessName; //进程名称;
 KPRIORITY BasePriority;//进程优先权;
 HANDLE ProcessId; //进程标识符;
 HANDLE InheritedFromProcessId; //父进程的标识符;
 ULONG HandleCount; //句柄数目;
 ULONG Reserved2[2];
 ULONG_PTR PageDirectoryBase;
 VM_COUNTERS  VmCounters; //虚拟存储器的结构，见下;
 SIZE_T PrivatePageCount;
 IO_COUNTERS IoCounters; //IO计数结构，见下;
 struct _SYSTEM_THREADS_X64 Threads[1]; //进程相关线程的结构数组
}SYSTEM_PROCESSES_X64,*PSYSTEM_PROCESSES_X64;

 

对应上32位和64位的_SYSTEM_PROCESS结构后就可以用ZwQuerySystemInformation进行枚举了