NtQuerySystemInformation函数，其中SystemBasicInformation(0号功能)返回的结果是一个SYSTEM_BASIC_INFORMATION结构，其中的域bKeNumberProcessors将返回系统CPU的个数。
下面是该函数的具体说明：
/×-------------------------------------------------------------
NtQuerySystemInformation is used to check some system informations
avaiable only in KernelMode (above 0x80000000).
All avaiable (or all known) information classes are described
in SYSTEM_INFORMATION_CLASS.
Requirements
Client: Requires Windows XP or Windows 2000 Professional.
Server: Requires Windows 2000 Server.
Header: Declared in Winternl.h.
DLL: Requires Ntdll.dll.
[NtQuerySystemInformation is available for use in Windows 2000 and
Windows XP. It may be altered or unavailable in subsequent versions.
Applications should use the alternate functions listed in this topic.]
*/
注：NtQuerySystemInformation底层使用中写为ZwQuerySystemInformation，两个函数完全相同，只是入口不同。
NTSYSAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
//SystemInformationClass
//[in] One of the values enumerated in SYSTEM_INFORMATION_CLASS,
//indicating the kind of system information to be retrieved.
IN SYSTEMINFOCLASS SystemInformationClass,
// SystemInformation
// [in, out] Points to a buffer where the requested information is
// to be returned. The size and structure of this information varies
// depending on the value of the SystemInformationClass parameter:
OUT PVOID pSystemInformation,
// SystemInformationLength
// [in] Size of the buffer pointed to by the SystemInformation parameter,
// in bytes.
IN ULONG uSystemInformationLength,
// ReturnLength
// [out, optional] Optional pointer to a location where the function
// writes the actual size of the information requested.
// If that size is less than or equal to the SystemInformationLength
// parameter, the function copies the information into the
// SystemInformation buffer; otherwise, it returns an NTSTATUS error code
// and returns in ReturnLength the size of buffer required to receive
// the requested information.
OUT PULONG puReturnLength OPTIONAL
);
// Return Values
// Returns an NTSTATUS success or error code.
// The forms and significance of NTSTATUS error codes are listed
// in the Ntstatus.h header file available in the Windows Device
// Driver Kit (DDK), and are described in the DDK documentation
// under Kernel-Mode Driver Architecture / Design Guide / Driver
// Programming Techniques / Logging Errors.
typedef enum _SYSTEMINFOCLASS
{
SystemBasicInformation, //0
SystemProcessorInformation, // 1
SystemPerformanceInformation, //2
SystemTimeOfDayInformation, //3
SystemPathInformation, //4 SystemNotImplemented1
SystemProcessInformation, //5 per process SystemProcessesAndThreadsInformation
SystemCallCountInformation, //6 SystemCallInformation
SystemConfigurationInformation, //7 SystemDeviceInformation
SystemProcessorPerformanceInformation, //8 per cpu SystemProcessorCounters
SystemGlobalFlag, //SystemFlagsInformation
SystemCallTimeInformation, //10
SystemModuleInformation, //11
SystemLockInformation, //12
SystemStackTraceInformation, //13 SystemNotImplemented2
SystemPagedPoolInformation, //14 checked build only
SystemNonPagedPoolInformation, //15 checked build only
SystemHandleInformation, //16
SystemObjectInformation, //17 SystemObjectTypeInformation
SystemPageFileInformation, //18 per page file
SystemVdmInstemulInformation, //19 SystemVdmInstemulInformation
SystemVdmBopInformation, //20
SystemFileCacheInformation, //21
SystemPoolTagInformation, //22
SystemInterruptInformation, //23
SystemDpcBehaviorInformation, //24
SystemFullMemoryInformation, //25 checked build only
SystemLoadGdiDriverInformation, //26 set mode only
SystemUnloadGdiDriverInformation, //27 set mode only
SystemTimeAdjustmentInformation, //28 writeable
SystemSummaryMemoryInformation, //29 checked build only
SystemNextEventIdInformation, //30 checked build only
SystemEventIdsInformation, //31 checked build only
SystemCrashDumpInformation, //32
SystemExceptionInformation, //33
SystemCrashDumpStateInformation, //34
SystemKernelDebuggerInformation, //35
SystemContextSwitchInformation, //36
SystemRegistryQuotaInformation, //37
SystemExtendServiceTableInformation, //38 set mode only SystemAddDriver
SystemPrioritySeperation, //39 set mode only SystemPrioritySeparationInformation
SystemPlugPlayBusInformation, //40 not implemented
SystemDockInformation, //41 not implemented
SystemPowerInformation, //42 XP only
SystemProcessorSpeedInformation, //43 XP only
SystemCurrentTimeZoneInformation, //44
SystemLookasideInformation, //45
SystemSetTimeSlipEvent, //46
SystemCreateSession, // set mode only
SystemDeleteSession, // set mode only
SystemInvalidInfoClass1, // invalid info class
SystemRangeStartInformation, // 0x0004 (fails if size != 4)
SystemVerifierInformation,
SystemAddVerifier,
SystemSessionProcessesInformation, // checked build only
MaxSystemInfoClass
} SYSTEMINFOCLASS, *PSYSTEMINFOCLASS;
typedef struct _SYSTEM_BASIC_INFORMATION
{
DWORD dwUnknown1; // 0
ULONG uKeMaximumIncrement; // x86: 0x0002625A or 0x00018730
ULONG uPageSize; // bytes
ULONG uMmNumberOfPhysicalPages;
ULONG uMmLowestPhysicalPage;
ULONG uMmHighestPhysicalPage;
ULONG uAllocationGranularity; // bytes
PVOID pLowestUserAddress;
PVOID pMmHighestUserAddress;
KAFFINITY uKeActiveProcessors;
BYTE bKeNumberProcessors;
BYTE bUnknown2;
WORD wUnknown3;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
DWORD InterruptCount;
DWORD dwUnknown1;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER liIdleTime;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG IoReadOperationCount;
ULONG IoWriteOperationCount;
ULONG IoOtherOperationCount;
ULONG AvailablePages;
ULONG CommittedPages;
ULONG CommitLimit;
ULONG PeakCommitment;
ULONG PageFaultCount;
ULONG CopyOnWriteCount;
ULONG TransitionCount;
ULONG CacheTransitionCount;
ULONG DemandZeroCount;
ULONG PageReadCount;
ULONG PageReadIoCount;
ULONG CacheReadCount;
ULONG CacheIoCount;
ULONG DirtyPagesWriteCount;
ULONG DirtyWriteIoCount;
ULONG MappedPagesWriteCount;
ULONG MappedWriteIoCount;
ULONG PagedPoolPages;
ULONG NonPagedPoolPages;
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFrees;
ULONG FreeSystemPtes;
ULONG ResidentSystemCodePage;
ULONG TotalSystemDriverPages;
ULONG TotalSystemCodePages;
ULONG NonPagedPoolLookasideHits;
ULONG PagedPoolLookasideHits;
ULONG Spare3Count;
ULONG ResidentSystemCachePage;
ULONG ResidentPagedPoolPage;
ULONG ResidentSystemDriverPage;
ULONG CcFastReadNoWait;
ULONG CcFastReadWait;
ULONG CcFastReadResourceMiss;
ULONG CcFastReadNotPossible;
ULONG CcFastMdlReadNoWait;
ULONG CcFastMdlReadWait;
ULONG CcFastMdlReadResourceMiss;
ULONG CcFastMdlReadNotPossible;
ULONG CcMapDataNoWait;
ULONG CcMapDataWait;
ULONG CcMapDataNoWaitMiss;
ULONG CcMapDataWaitMiss;
ULONG CcPinMappedDataCount;
ULONG CcPinReadNoWait;
ULONG CcPinReadWait;
ULONG CcPinReadNoWaitMiss;
ULONG CcPinReadWaitMiss;
ULONG CcCopyReadNoWait;
ULONG CcCopyReadWait;
ULONG CcCopyReadNoWaitMiss;
ULONG CcCopyReadWaitMiss;
ULONG CcMdlReadNoWait;
ULONG CcMdlReadWait;
ULONG CcMdlReadNoWaitMiss;
ULONG CcMdlReadWaitMiss;
ULONG CcReadAheadIos;
ULONG CcLazyWriteIos;
ULONG CcLazyWritePages;
ULONG CcDataFlushes;
ULONG CcDataPages;
ULONG ContextSwitches;
ULONG FirstLevelTbFills;
ULONG SecondLevelTbFills;
ULONG SystemCalls;
}
我们在任务管理器中所见到的所有信息只使用了下面5个调用：
0 SystemBasicInformation
2 SystemPerformanceInformation
5 SystemProcessInformation
8 SystemProcessorPerformanceInformation
21 SystemFileCacheInformation
初始化部分使用了其中的3个调用（0、2、8），这里给出的是任务管理器的初始化部分：
010058D6 InitPerfInfo proc near
010058D6
010058D6 SYSPROCPERFINFO= SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION ptr -76Ch
010058D6 SYSPERFINFO= SYSTEM_PERFORMANCE_INFORMATION ptr -16Ch
010058D6 SYSBASICINFO= SYSTEM_BASIC_INFORMATION ptr -34h
010058D6 pBuf= dword ptr -8
010058D6 i = dword ptr -4
010058D6
010058D6 push ebp
010058D7 mov ebp, esp
010058D9 sub esp, 76Ch
010058DF push ebx
010058E0 push esi
010058E1 xor ebx, ebx
010058E3 push edi
010058E4 push ebx ; puReturnLength
010058E5 lea eax, [ebp+SYSBASICINFO]
010058E8 push 2Ch ; SizeOf(SYSTEM_BASIC_INFORMATION)
010058EA push eax ; pSystemInformation
010058EB push ebx ; ebx = 0 SystemBasicInformation
010058EC call ds:NtQuerySystemInformation
010058F2 cmp eax, ebx
010058F4 jl Err_CpuNumAbove32
010058FA mov eax, [ebp+SYSBASICINFO.uPageSize]
010058FD mov g_PageSize, eax ; 页面大小
01005902 mov al, [ebp+SYSBASICINFO.bKeNumberProcessors]
01005905 cmp al, 32 ; 32位Windows操作系统最多允许系统有32个CPU
01005907 mov g_cProcessors, al ; CPU的个数
0100590C ja Err_CpuNumAbove32
01005912 mov esi, ds:LocalAlloc
01005918 mov edi, 1F40h
0100591D test al, al
0100591F jbe short CpuNumEquOne
01005921
01005921 Loop_for_AllocMem:
01005921 push edi
01005922 push LMEM_ZEROINIT
01005924 call esi ; LocalAlloc
01005926 test eax, eax
01005928 mov g_pCPUHistory[ebx*4], eax
0100592F jz Err_CpuNumAbove32
01005935 push edi
01005936 push LMEM_ZEROINIT
01005938 call esi ; LocalAlloc
0100593A test eax, eax
0100593C mov g_pKernelHistory[ebx*4], eax
01005943 jz Err_CpuNumAbove32
01005949 movzx eax, g_cProcessors
01005950 inc ebx
01005951 cmp ebx, eax
01005953 jl short Loop_for_AllocMem
01005955
01005955 CpuNumEquOne:
01005955 push edi
01005956 push LMEM_ZEROINIT
01005958 call esi ; LocalAlloc
0100595A test eax, eax
0100595C mov g_pMEMHistory, eax
01005961 jz Err_CpuNumAbove32
01005967 push 0 ; puReturnLength
01005969 lea eax, [ebp+SYSPROCPERFINFO]
0100596F push 600h ; 为32个CPU准备空间
0100596F ; SizeOf(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)*32
01005974 push eax ; pSystemInformation
01005975 push SystemProcessorPerformanceInformation ; SystemInformationClass
01005977 call ds:NtQuerySystemInformation
0100597D test eax, eax
0100597F jl Err_CpuNumAbove32
01005985 movzx eax, g_cProcessors
0100598C and [ebp+i], 0
01005990 test eax, eax
01005992 jle short CpuNumEquOne_1
01005994 lea eax, [ebp+SYSPROCPERFINFO.KernelTime]
0100599A mov [ebp+pBuf], offset PreviousCPUKernelTime
010059A1
010059A1 Loop_IniCpuAllTime:
010059A1 mov ecx, [ebp+i]
010059A4 mov edx, [eax-8] ; edx = IdleTime.LowPart
010059A7 mov edi, [eax+8] ; edi = UserTime.LowPart
010059AA mov esi, [eax+4] ; esi = KernelTime.HighPart
010059AD shl ecx, 3 ; ecx = i X 8
010059B0 mov ebx, [eax+0Ch] ; ebx = UserTime.HighPart
010059B3 mov dword ptr PreviousCPUIdleTime.LowPart[ecx], edx
010059B9 mov edx, [eax-4] ; edx = IdleTime.HighPart
010059BC mov PreviousCPUIdleTime.HighPart[ecx], edx
010059C2 mov edx, [eax] ; KernelTime.LowPart
010059C4 add edi, edx ; edi = UserTime.LowPart + KernelTime.LowPart
010059C6 adc ebx, esi ; 带进位加
010059C6 ; ebx = UserTime.HighPart + KernelTime.HighPart
010059C8 add edx, [eax-8] ; edx = KernelTime.LowPart + IdleTime.LowPart
010059CB mov dword ptr PreviousCPUTotalTime.LowPart[ecx], edi
010059D1 mov PreviousCPUTotalTime.HighPart[ecx], ebx
010059D7 mov ecx, [ebp+pBuf] ; PreviousCPUKernelTime的指针
010059DA adc esi, [eax-4] ; 带进位加
010059DA ; esi = KernelTime.HighPart + IdleTime.HighPart
010059DD add eax, 30h ; 取下一个CPU的相关数据
010059DD ; SizeOf(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)
010059E0 inc [ebp+i]
010059E3 mov [ecx], edx ; PreviousCPUTotalTime.LowPart = KernelTime.LowPart + IdleTime.LowPart
010059E5 mov [ecx+4], esi ; PreviousCPUTotalTime.HighPart = KernelTime.HighPart + IdleTime.HighPart
010059E8 add ecx, 8 ; 移动PreviousCPUKernelTime的指针
010059EB mov [ebp+pBuf], ecx ; 保存PreviousCPUKernelTime的指针
010059EE movzx ecx, g_cProcessors
010059F5 cmp [ebp+i], ecx ; 和Cpu的个数比较
010059F8 jl short Loop_IniCpuAllTime
010059FA
010059FA CpuNumEquOne_1: ; puReturnLength
010059FA push 0
010059FC lea eax, [ebp+SYSPERFINFO]
01005A02 push 138h ; SizeOf(SYSTEM_PERFORMANCE_INFORMATION)
01005A07 push eax ; pSystemInformation
01005A08 push SystemPerformanceInformation ; SystemInformationClass
01005A0A call ds:NtQuerySystemInformation
01005A10 test eax, eax
01005A12 jge short Init_Exit
01005A14
01005A14 Err_CpuNumAbove32: ; 如果出错返回 0
01005A14 xor al, al
01005A16 jmp short Exit
01005A18
01005A18 Init_Exit:
01005A18 mov eax, g_PageSize
01005A1D shr eax, 10
01005A20 imul eax, [ebp+SYSPERFINFO.CommitLimit]
01005A27 mov g_MEMMax, eax
01005A2C mov al, g_cProcessors ; 返回Cpu的个数
01005A31
01005A31 Exit:
01005A31 pop edi
01005A32 pop esi
01005A33 pop ebx
01005A34 leave
01005A35 retn
01005A35 InitPerfInfo endp
01005A35
NtQuerySystemInformation非常复杂，其中的结构随着Windows的版本变化会发生变化，这里给出的结构是2K系统的。
714
评论 2
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
查看更多评论
添加红包
