枚举进程信息

// test.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include<Windows.h>
#include <stdio.h>
#define STATUS_INFO_LENGTH_MISMATCH 0xc0000004

typedef struct _LSA_UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
	ULONG NextEntryOffset;
	ULONG NumberOfThreads;
	LARGE_INTEGER WorkingSetPrivateSize; // since VISTA
	ULONG HardFaultCount; // since WIN7
	ULONG NumberOfThreadsHighWatermark; // since WIN7
	ULONGLONG CycleTime; // since WIN7
	LARGE_INTEGER CreateTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER KernelTime;
	UNICODE_STRING ImageName;
	LONG BasePriority;
	HANDLE UniqueProcessId;
	HANDLE InheritedFromUniqueProcessId;
	ULONG HandleCount;
	ULONG SessionId;
	ULONG_PTR UniqueProcessKey; // since VISTA (requires SystemExtendedProcessInformation)
	SIZE_T PeakVirtualSize;
	SIZE_T VirtualSize;
	ULONG PageFaultCount;
	SIZE_T PeakWorkingSetSize;
	SIZE_T WorkingSetSize;
	SIZE_T QuotaPeakPagedPoolUsage;
	SIZE_T QuotaPagedPoolUsage;
	SIZE_T QuotaPeakNonPagedPoolUsage;
	SIZE_T QuotaNonPagedPoolUsage;
	SIZE_T PagefileUsage;
	SIZE_T PeakPagefileUsage;
	SIZE_T PrivatePageCount;
	LARGE_INTEGER ReadOperationCount;
	LARGE_INTEGER WriteOperationCount;
	LARGE_INTEGER OtherOperationCount;
	LARGE_INTEGER ReadTransferCount;
	LARGE_INTEGER WriteTransferCount;
	LARGE_INTEGER OtherTransferCount;
	//SYSTEM_THREAD_INFORMATION Threads[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef
NTSTATUS
(NTAPI *NTQUERYSYSTEMINFORMATION)(
	IN ULONG_PTR SystemInformationClass,
	IN OUT PVOID SystemInformation,
	IN ULONG_PTR SystemInformationLength,
	OUT PULONG ReturnLength
	);

BOOL  EnableDebugPriv()
{
	HANDLE hToken;
	LUID sedebugnameValue;
	TOKEN_PRIVILEGES tkp;

	if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
	{
		return FALSE;
	}

	if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
	{
		CloseHandle(hToken);
		return FALSE;
	}
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = sedebugnameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof tkp, NULL, NULL))
	{
		CloseHandle(hToken);
		return FALSE;
	}
	return TRUE;
}

static int process_query()
{
	SIZE_T ProcessInfoLength = 0;
	PVOID  BufferData = NULL;
	PSYSTEM_PROCESS_INFORMATION  SystemProcessInfo = NULL;
	NTSTATUS  Status = 0;
	ULONG ProcOffset = 0;//用来遍历进程

	//提权
	EnableDebugPriv();
	HMODULE ModuleHandle = LoadLibrary(L"ntdll.dll");
	if (!ModuleHandle)
	{
		return 1;
	}

	NTQUERYSYSTEMINFORMATION ZwQuerySystemInformation =
		(NTQUERYSYSTEMINFORMATION)GetProcAddress(ModuleHandle, "ZwQuerySystemInformation");
	if (ZwQuerySystemInformation == NULL)
	{
		CloseHandle(ModuleHandle);
		ModuleHandle = NULL;
		return 1;
	}
	for (;;)
	{
		ProcessInfoLength += 0x10000;
		BufferData = malloc(ProcessInfoLength);
		if (NULL == BufferData)
		{
			break;
		}
		memset(BufferData, 0, ProcessInfoLength);

		Status = ZwQuerySystemInformation(5,
			BufferData,
			ProcessInfoLength,
			NULL);
		if (Status == STATUS_INFO_LENGTH_MISMATCH)
		{
			free(BufferData);
			BufferData = NULL;
		}
		else
		{
			break;
		}
	}

	SystemProcessInfo = (PSYSTEM_PROCESS_INFORMATION)BufferData;;
	do
	{
		SystemProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)SystemProcessInfo + ProcOffset);
	
		//do something
		
		ProcOffset = SystemProcessInfo->NextEntryOffset;
	} while (ProcOffset != 0);

	if (BufferData)
	{
		free(BufferData);
		BufferData = NULL;
	}
	return 1;
}

int main()
{	
	process_query();
	getchar();
	return 0;
}