_SYSTEM_PROCESS 32位与64位的结构

typedef ULONG KPRIORITY;


typedef enum _SYSTEM_INFORMATION_CLASS   
{   
 SystemBasicInformation,                 //  0 Y N   
 SystemProcessorInformation,             //  1 Y N   
 SystemPerformanceInformation,           //  2 Y N   
 SystemTimeOfDayInformation,             //  3 Y N   
 SystemNotImplemented1,                  //  4 Y N   
 SystemProcessesAndThreadsInformation,   //  5 Y N   
 SystemCallCounts,                       //  6 Y N   
 SystemConfigurationInformation,         //  7 Y N   
 SystemProcessorTimes,                   //  8 Y N   
 SystemGlobalFlag,                       //  9 Y Y   
 SystemNotImplemented2,                  // 10 Y N   
 SystemModuleInformation,                // 11 Y N   
 SystemLockInformation,                  // 12 Y N   
 SystemNotImplemented3,                  // 13 Y N   
 SystemNotImplemented4,                  // 14 Y N   
 SystemNotImplemented5,                  // 15 Y N   
 SystemHandleInformation,                // 16 Y N   
 SystemObjectInformation,                // 17 Y N   
 SystemPagefileInformation,              // 18 Y N   
 SystemInstructionEmulationCounts,       // 19 Y N   
 SystemInvalidInfoClass1,                // 20   
 SystemCacheInformation,                 // 21 Y Y   
 SystemPoolTagInformation,               // 22 Y N   
 SystemProcessorStatistics,              // 23 Y N   
 SystemDpcInformation,                   // 24 Y Y   
 SystemNotImplemented6,                  // 25 Y N   
 SystemLoadImage,                        // 26 N Y   
 SystemUnloadImage,                      // 27 N Y   
 SystemTimeAdjustment,                   // 28 Y Y   
 SystemNotImplemented7,                  // 29 Y N   
 SystemNotImplemented8,                  // 30 Y N   
 SystemNotImplemented9,                  // 31 Y N   
 SystemCrashDumpInformation,             // 32 Y N   
 SystemExceptionInformation,             // 33 Y N   
 SystemCrashDumpStateInformation,        // 34 Y Y/N   
 SystemKernelDebuggerInformation,        // 35 Y N   
 SystemContextSwitchInformation,         // 36 Y N   
 SystemRegistryQuotaInformation,         // 37 Y Y   
 SystemLoadAndCallImage,                 // 38 N Y   
 SystemPrioritySeparation,               // 39 N Y   
 SystemNotImplemented10,                 // 40 Y N   
 SystemNotImplemented11,                 // 41 Y N   
 SystemInvalidInfoClass2,                // 42   
 SystemInvalidInfoClass3,                // 43   
 SystemTimeZoneInformation,              // 44 Y N   
 SystemLookasideInformation,             // 45 Y N   
 SystemSetTimeSlipEvent,                 // 46 N Y   
 SystemCreateSession,                    // 47 N Y   
 SystemDeleteSession,                    // 48 N Y   
 SystemInvalidInfoClass4,                // 49   
 SystemRangeStartInformation,            // 50 Y N   
 SystemVerifierInformation,              // 51 Y Y   
 SystemAddVerifier,                      // 52 N Y   
 SystemSessionProcessesInformation       // 53 Y N  
} SYSTEM_INFORMATION_CLASS;


typedef struct _LSA_UNICODE_STRING   
{   
 USHORT Length;   
 USHORT MaximumLength;   
 PWSTR Buffer;  
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;


typedef struct _CLIENT_ID   
{   
 HANDLE UniqueProcess;   
 HANDLE UniqueThread;   
} CLIENT_ID;


typedef enum _THREAD_STATE   
{   
 StateInitialized,   
 StateReady,   
 StateRunning,   
 StateStandby,   
 StateTerminated,   
 StateWait,   
 StateTransition,   
 StateUnknown   
} THREAD_STATE; 


typedef enum _KWAIT_REASON   
{   
 Executive,   
 FreePage,   
 PageIn,   
 PoolAllocation,   
 DelayExecution,   
 Suspended,   
 UserRequest,   
 WrExecutive,   
 WrFreePage,   
 WrPageIn,   
 WrPoolAllocation,   
 WrDelayExecution,   
 WrSuspended,   
 WrUserRequest,   
 WrEventPair,   
 WrQueue,   
 WrLpcReceive,   
 WrLpcReply,   
 WrVirtualMemory,   
 WrPageOut,   
 WrRendezvous,   
 Spare2,   
 Spare3,   
 Spare4,   
 Spare5,   
 Spare6,   
 WrKernel   
} KWAIT_REASON; 


typedef struct _VM_COUNTERS   
{   
 ULONG PeakVirtualSize;       
 ULONG VirtualSize;                
 ULONG PageFaultCount;        
 ULONG PeakWorkingSetSize;    
 ULONG WorkingSetSize;           
 ULONG QuotaPeakPagedPoolUsage;      
 ULONG QuotaPagedPoolUsage;        
 ULONG QuotaPeakNonPagedPoolUsage;  
 ULONG QuotaNonPagedPoolUsage;      
 ULONG PagefileUsage;              
 ULONG PeakPagefileUsage;        
} VM_COUNTERS, *PVM_COUNTERS;


typedef struct _SYSTEM_THREADS_X86 
{   
 LARGE_INTEGER KernelTime;   
 LARGE_INTEGER UserTime;   
 LARGE_INTEGER CreateTime;   
 ULONG WaitTime;   
 PVOID StartAddress;   
 CLIENT_ID ClientId;   
 KPRIORITY Priority;   
 KPRIORITY BasePriority;   
 ULONG ContextSwitchCount;   
 THREAD_STATE State;   
 KWAIT_REASON WaitReason;  
} SYSTEM_THREADS_X86, *PSYSTEM_THREADS_X86;


typedef struct _SYSTEM_THREADS_X64
{   
 LARGE_INTEGER KernelTime;   
 LARGE_INTEGER UserTime;   
 LARGE_INTEGER CreateTime;   
 ULONG WaitTime;   
 PVOID StartAddress;   
 CLIENT_ID ClientId;   
 KPRIORITY Priority;   
 KPRIORITY BasePriority;   
 ULONG ContextSwitchCount;   
 THREAD_STATE ThreadState;   
 KWAIT_REASON WaitReason;   
 ULONG Reserved;
} SYSTEM_THREADS_X64, *PSYSTEM_THREADS_X64;


typedef struct _SYSTEM_PROCESSES_X86  
{   
 ULONG NextEntryDelta;   
 ULONG ThreadCount;   
 ULONG Reserved1[6];   
 LARGE_INTEGER CreateTime;   
 LARGE_INTEGER UserTime;   
 LARGE_INTEGER KernelTime;   
 UNICODE_STRING ProcessName;   
 KPRIORITY BasePriority;   
 ULONG ProcessId;   
 ULONG InheritedFromProcessId;   
 ULONG HandleCount;   
 ULONG Reserved2[2];   
 VM_COUNTERS  VmCounters;   
 IO_COUNTERS IoCounters;   
 SYSTEM_THREADS_X86 Threads[1];   
} SYSTEM_PROCESSES_X86 , *PSYSTEM_PROCESSES_X86;


typedef struct _SYSTEM_PROCESSES_X64
{
 ULONG NextEntryDelta; //构成结构序列的偏移量;
 ULONG ThreadCount; //线程数目;
 ULONG Reserved1[6];
 LARGE_INTEGER CreateTime; //创建时间;
 LARGE_INTEGER UserTime;//用户模式(Ring 3)的CPU时间;
 LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间;
 UNICODE_STRING ProcessName; //进程名称;
 KPRIORITY BasePriority;//进程优先权;
 HANDLE ProcessId; //进程标识符;
 HANDLE InheritedFromProcessId; //父进程的标识符;
 ULONG HandleCount; //句柄数目;
 ULONG Reserved2[2];
 ULONG_PTR PageDirectoryBase;
 VM_COUNTERS  VmCounters; //虚拟存储器的结构，见下;
 SIZE_T PrivatePageCount;
 IO_COUNTERS IoCounters; //IO计数结构，见下;
 struct _SYSTEM_THREADS_X64 Threads[1]; //进程相关线程的结构数组
}SYSTEM_PROCESSES_X64,*PSYSTEM_PROCESSES_X64;
 

对应上32位和64位的_SYSTEM_PROCESS结构后就可以用ZwQuerySystemInformation进行枚举了