NtQuerySystemInformation的不同参数的结构

于 2021-05-27 14:59:17 发布
阅读量1.1k 收藏 2
点赞数 1
分类专栏： C++ Window核心 文章标签： 内核
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zzy1448331580/article/details/117328937
版权

 

__kernel_entry NTSTATUS NtQuerySystemInformation(
  SYSTEM_INFORMATION_CLASS SystemInformationClass,
  PVOID                    SystemInformation,
  ULONG                    SystemInformationLength,
  PULONG                   ReturnLength
);

 

typedef enum _SYSTEM_INFORMATION_CLASS {  
   SystemBasicInformation,  
   SystemProcessorInformation,              // obsolete...delete  
   SystemPerformanceInformation,  
   SystemTimeOfDayInformation,  
   SystemPathInformation,  
   SystemProcessInformation,                //系统进程信息  
   SystemCallCountInformation,  
   SystemDeviceInformation,  
   SystemProcessorPerformanceInformation,  
   SystemFlagsInformation,  
   SystemCallTimeInformation,  
   SystemModuleInformation,     //系统模块  
   SystemLocksInformation,  
   SystemStackTraceInformation,  
   SystemPagedPoolInformation,  
   SystemNonPagedPoolInformation,  
   SystemHandleInformation,  
   SystemObjectInformation,  
   SystemPageFileInformation,  
   SystemVdmInstemulInformation,  
   SystemVdmBopInformation,  
   SystemFileCacheInformation,  
   SystemPoolTagInformation,  
   SystemInterruptInformation,  
   SystemDpcBehaviorInformation,  
   SystemFullMemoryInformation,  
   SystemLoadGdiDriverInformation,  
   SystemUnloadGdiDriverInformation,  
   SystemTimeAdjustmentInformation,  
   SystemSummaryMemoryInformation,  
   SystemMirrorMemoryInformation,  
   SystemPerformanceTraceInformation,  
   SystemObsolete0,  
   SystemExceptionInformation,  
   SystemCrashDumpStateInformation,  
   SystemKernelDebuggerInformation,  
   SystemContextSwitchInformation,  
   SystemRegistryQuotaInformation,  
   SystemExtendServiceTableInformation,  
   SystemPrioritySeperation,  
   SystemVerifierAddDriverInformation,  
   SystemVerifierRemoveDriverInformation,  
   SystemProcessorIdleInformation,  
   SystemLegacyDriverInformation,  
   SystemCurrentTimeZoneInformation,  
   SystemLookasideInformation,  
   SystemTimeSlipNotification,  
   SystemSessionCreate,  
   SystemSessionDetach,  
   SystemSessionInformation,  
   SystemRangeStartInformation,  
   SystemVerifierInformation,  
   SystemVerifierThunkExtend,  
   SystemSessionProcessInformation,  
   SystemLoadGdiDriverInSystemSpace,  
   SystemNumaProcessorMap,  
   SystemPrefetcherInformation,  
   SystemExtendedProcessInformation,  
   SystemRecommendedSharedDataAlignment,  
   SystemComPlusPackage,  
   SystemNumaAvailableMemory,  
   SystemProcessorPowerInformation,  
   SystemEmulationBasicInformation,  
   SystemEmulationProcessorInformation,  
   SystemExtendedHandleInformation,  
   SystemLostDelayedWriteInformation,  
   SystemBigPoolInformation,  
   SystemSessionPoolTagInformation,  
   SystemSessionMappedViewInformation,  
   SystemHotpatchInformation,  
   SystemObjectSecurityMode,  
   SystemWatchdogTimerHandler,  
   SystemWatchdogTimerInformation,  
   SystemLogicalProcessorInformation,  
   SystemWow64SharedInformation,  
   SystemRegisterFirmwareTableInformationHandler,  
   SystemFirmwareTableInformation,  
   SystemModuleInformationEx,  
   SystemVerifierTriageInformation,  
   SystemSuperfetchInformation,  
   SystemMemoryListInformation,  
   SystemFileCacheInformationEx,  
   MaxSystemInfoClass   // MaxSystemInfoClass should always be the last enum  
} SYSTEM_INFORMATION_CLASS;

 

头文件

#include <basetsd.h>

#define IN
#define OUT
#define OPTIONAL
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
#define MAX_STACK_DEPTH 32
#define MAXIMUM_NUMA_NODES 16
#define STATUS_SUCCESS                   ((NTSTATUS)0x00000000L)    // ntsubauth

typedef unsigned long ULONG;
typedef unsigned int DWORD;
typedef unsigned short WORD;
typedef unsigned char UCHAR;
typedef unsigned short USHORT;
typedef long LONG;
typedef LONG NTSTATUS;
typedef void *PVOID;
typedef ULONG *PULONG;
typedef ULONG_PTR KAFFINITY;
typedef char CCHAR;
typedef void * HANDLE;
typedef UCHAR *PUCHAR;
typedef unsigned int UINT;
typedef void *LPVOID;
typedef SIZE_T SYSINF_PAGE_COUNT;
typedef LONG KPRIORITY;
typedef wchar_t WCHAR;
typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;
typedef char CHAR;
typedef CHAR *PCHAR, *LPCH, *PCH;
typedef DWORD ACCESS_MASK;

typedef struct _UNICODE_STRING {
    USHORT Length;
    USHORT MaximumLength;
#ifdef MIDL_PASS
    [size_is(MaximumLength / 2), length_is((Length) / 2)] USHORT * Buffer;
#else // MIDL_PASS
    PWSTR  Buffer;
#endif // MIDL_PASS
} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;

#if (!defined (_MAC) && (!defined(MIDL_PASS) || defined(__midl)) && (!defined(_M_IX86) || (defined(_INTEGRAL_MAX_BITS) && _INTEGRAL_MAX_BITS >= 64)))
typedef __int64 LONGLONG;
typedef unsigned __int64 ULONGLONG;
#define MAXLONGLONG                         (0x7fffffffffffffff)
#else
#if defined(_MAC) && defined(_MAC_INT_64)
typedef __int64 LONGLONG;
typedef unsigned __int64 ULONGLONG;
#define MAXLONGLONG                      (0x7fffffffffffffff)
#else
typedef double LONGLONG;
typedef double ULONGLONG;
#endif //_MAC and int64
#endif

#if defined(MIDL_PASS)
typedef struct _LARGE_INTEGER
{
#else // MIDL_PASS
typedef union _LARGE_INTEGER
{
    struct
    {
        DWORD LowPart;
        LONG HighPart;
    } DUMMYSTRUCTNAME;
    struct
    {
        DWORD LowPart;
        LONG HighPart;
    } u;
#endif //MIDL_PASS
    LONGLONG QuadPart;
} LARGE_INTEGER;

typedef unsigned char BYTE;
typedef BYTE BOOLEAN;

#define FLG_STOP_ON_EXCEPTION           0x00000001      // user and kernel mode
#define FLG_SHOW_LDR_SNAPS              0x00000002      // user and kernel mode
#define FLG_DEBUG_INITIAL_COMMAND       0x00000004      // kernel mode only up until WINLOGON started
#define FLG_STOP_ON_HUNG_GUI            0x00000008      // kernel mode only while running

#define FLG_HEAP_ENABLE_TAIL_CHECK      0x00000010      // user mode only
#define FLG_HEAP_ENABLE_FREE_CHECK      0x00000020      // user mode only
#define FLG_HEAP_VALIDATE_PARAMETERS    0x00000040      // user mode only
#define FLG_HEAP_VALIDATE_ALL           0x00000080      // user mode only

#define FLG_APPLICATION_VERIFIER        0x00000100      // user mode only
#define FLG_POOL_ENABLE_TAGGING         0x00000400      // kernel mode only
#define FLG_HEAP_ENABLE_TAGGING         0x00000800      // user mode only

#define FLG_USER_STACK_TRACE_DB         0x00001000      // x86 user mode only
#define FLG_KERNEL_STACK_TRACE_DB       0x00002000      // x86 kernel mode only at boot time
#define FLG_MAINTAIN_OBJECT_TYPELIST    0x00004000      // kernel mode only at boot time
#define FLG_HEAP_ENABLE_TAG_BY_DLL      0x00008000      // user mode only

#define FLG_DISABLE_STACK_EXTENSION     0x00010000      // user mode only
#define FLG_ENABLE_CSRDEBUG             0x00020000      // kernel mode only at boot time
#define FLG_ENABLE_KDEBUG_SYMBOL_LOAD   0x00040000      // kernel mode only
#define FLG_DISABLE_PAGE_KERNEL_STACKS  0x00080000      // kernel mode only at boot time

#define FLG_ENABLE_SYSTEM_CRIT_BREAKS   0x00100000      // user mode only
#define FLG_HEAP_DISABLE_COALESCING     0x00200000      // user mode only
#define FLG_ENABLE_CLOSE_EXCEPTIONS     0x00400000      // kernel mode only
#define FLG_ENABLE_EXCEPTION_LOGGING    0x00800000      // kernel mode only

#define FLG_ENABLE_HANDLE_TYPE_TAGGING  0x01000000      // kernel mode only
#define FLG_HEAP_PAGE_ALLOCS            0x02000000      // user mode only
#define FLG_DEBUG_INITIAL_COMMAND_EX    0x04000000      // kernel mode only up until WINLOGON started
#define FLG_DISABLE_DBGPRINT            0x08000000      // kernel mode only

#define FLG_CRITSEC_EVENT_CREATION      0x10000000      // user mode only, Force early creation of resource events
#define FLG_LDR_TOP_DOWN                0x20000000      // user mode only, win64 only
#define FLG_ENABLE_HANDLE_EXCEPTIONS    0x40000000      // kernel mode only
#define FLG_DISABLE_PROTDLLS            0x80000000      // user mode only (smss/winlogon)

#define PROCESSOR_ARCHITECTURE_INTEL            0
#define PROCESSOR_ARCHITECTURE_MIPS             1
#define PROCESSOR_ARCHITECTURE_ALPHA            2
#define PROCESSOR_ARCHITECTURE_PPC              3
#define PROCESSOR_ARCHITECTURE_SHX              4
#define PROCESSOR_ARCHITECTURE_ARM              5
#define PROCESSOR_ARCHITECTURE_IA64             6
#define PROCESSOR_ARCHITECTURE_ALPHA64          7
#define PROCESSOR_ARCHITECTURE_MSIL             8
#define PROCESSOR_ARCHITECTURE_AMD64            9
#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64    10

#define STATUS_INFO_LENGTH_MISMATCH      ((NTSTATUS)0xC0000004L)
#define STATUS_INVALID_INFO_CLASS ((NTSTATUS)0xC0000003L) 
#define STATUS_ACCESS_VIOLATION ((DWORD )0xC0000005L)
#define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009AL) 
#define STATUS_WORKING_SET_QUOTA ((NTSTATUS)0xC00000A1L)
#define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002L)

typedef struct _SYSTEM_BIGPOOL_ENTRY
    {
        union
        {
            PVOID VirtualAddress;
            ULONG_PTR NonPaged : 1;
        };
        SIZE_T SizeInBytes;
        union
        {
            UCHAR Tag[4];
            ULONG TagUlong;
        };
} SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;

typedef struct _SYSTEM_BIGPOOL_INFORMATION
{
        ULONG Count;
        SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1];
} SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;

typedef struct _SYSTEM_POOL_ENTRY
{
        BOOLEAN Allocated;
        BOOLEAN Spare0;
        USHORT AllocatorBackTraceIndex;
        ULONG Size;
        union
        {
            UCHAR Tag[4];
            ULONG TagUlong;
            PVOID ProcessChargedQuota;
        };
} SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY;

typedef struct _SYSTEM_POOL_INFORMATION
{
        SIZE_T TotalSize;
        PVOID FirstEntry;
        USHORT EntryOverhead;
        BOOLEAN PoolTagPresent;
        BOOLEAN Spare0;
        ULONG NumberOfEntries;
        SYSTEM_POOL_ENTRY Entries[1];
} SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation,
    SystemProcessorInformation,              // obsolete...delete
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemPathInformation,
    SystemProcessInformation,                //系统进程信息
    SystemCallCountInformation,
    SystemDeviceInformation,
    SystemProcessorPerformanceInformation,
    SystemFlagsInformation,
    SystemCallTimeInformation,
    SystemModuleInformation,     //系统模块
    SystemLocksInformation,
    SystemStackTraceInformation,
    SystemPagedPoolInformation,
    SystemNonPagedPoolInformation,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPageFileInformation,
    SystemVdmInstemulInformation,
    SystemVdmBopInformation,
    SystemFileCacheInformation,
    SystemPoolTagInformation,
    SystemInterruptInformation,
    SystemDpcBehaviorInformation,
    SystemFullMemoryInformation,
    SystemLoadGdiDriverInformation,
    SystemUnloadGdiDriverInformation,
    SystemTimeAdjustmentInformation,
    SystemSummaryMemoryInformation,
    SystemMirrorMemoryInformation,
    SystemPerformanceTraceInformation,
    SystemObsolete0,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemExtendServiceTableInformation,
    SystemPrioritySeperation,
    SystemVerifierAddDriverInformation,
    SystemVerifierRemoveDriverInformation,
    SystemProcessorIdleInformation,
    SystemLegacyDriverInformation,
    SystemCurrentTimeZoneInformation,
    SystemLookasideInformation,
    SystemTimeSlipNotification,
    SystemSessionCreate,
    SystemSessionDetach,
    SystemSessionInformation,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemVerifierThunkExtend,
    SystemSessionProcessInformation,
    SystemLoadGdiDriverInSystemSpace,
    SystemNumaProcessorMap,
    SystemPrefetcherInformation,
    SystemExtendedProcessInformation,
    SystemRecommendedSharedDataAlignment,
    SystemComPlusPackage,
    SystemNumaAvailableMemory,
    SystemProcessorPowerInformation,
    SystemEmulationBasicInformation,//=SystemBasicInformation
    SystemEmulationProcessorInformation,//=SystemProcessorInformation
    SystemExtendedHandleInformation,
    SystemLostDelayedWriteInformation,
    SystemBigPoolInformation,
    SystemSessionPoolTagInformation,
    SystemSessionMappedViewInformation,
    SystemHotpatchInformation,
    SystemObjectSecurityMode,
    SystemWatchdogTimerHandler,
    SystemWatchdogTimerInformation,
    SystemLogicalProcessorInformation,
    SystemWow64SharedInformation,
    SystemRegisterFirmwareTableInformationHandler,
    SystemFirmwareTableInformation,
    SystemModuleInformationEx,
    SystemVerifierTriageInformation,
    SystemSuperfetchInformation,
    SystemMemoryListInformation,
    SystemFileCacheInformationEx,

    //100?
    SystemPageMemoryInformation = 123,//自定义
    SystemPolicyInformation = 134,

} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_BASIC_INFORMATION 
{
    ULONG Reserved;
    ULONG TimerResolution;
    ULONG PageSize;
    SYSINF_PAGE_COUNT NumberOfPhysicalPages;
    SYSINF_PAGE_COUNT LowestPhysicalPageNumber;
    SYSINF_PAGE_COUNT HighestPhysicalPageNumber;
    ULONG AllocationGranularity;
    ULONG_PTR MinimumUserModeAddress;
    ULONG_PTR MaximumUserModeAddress;
    ULONG_PTR ActiveProcessorsAffinityMask;
    CCHAR NumberOfProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_INFORMATION 
{
    USHORT ProcessorArchitecture;
    USHORT ProcessorLevel;
    USHORT ProcessorRevision;
    USHORT Reserved;
    ULONG ProcessorFeatureBits;
} SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION 
{
    LARGE_INTEGER IdleProcessTime;
    LARGE_INTEGER IoReadTransferCount;
    LARGE_INTEGER IoWriteTransferCount;
    LARGE_INTEGER IoOtherTransferCount;
    ULONG IoReadOperationCount;
    ULONG IoWriteOperationCount;
    ULONG IoOtherOperationCount;
    ULONG AvailablePages;
    SYSINF_PAGE_COUNT CommittedPages;
    SYSINF_PAGE_COUNT CommitLimit;
    SYSINF_PAGE_COUNT PeakCommitment;
    ULONG PageFaultCount;
    ULONG CopyOnWriteCount;
    ULONG TransitionCount;
    ULONG CacheTransitionCount;
    ULONG DemandZeroCount;
    ULONG PageReadCount;
    ULONG PageReadIoCount;
    ULONG CacheReadCount;
    ULONG CacheIoCount;
    ULONG DirtyPagesWriteCount;
    ULONG DirtyWriteIoCount;
    ULONG MappedPagesWriteCount;
    ULONG MappedWriteIoCount;
    ULONG PagedPoolPages;
    ULONG NonPagedPoolPages;
    ULONG PagedPoolAllocs;
    ULONG PagedPoolFrees;
    ULONG NonPagedPoolAllocs;
    ULONG NonPagedPoolFrees;
    ULONG FreeSystemPtes;
    ULONG ResidentSystemCodePage;
    ULONG TotalSystemDriverPages;
    ULONG TotalSystemCodePages;
    ULONG NonPagedPoolLookasideHits;
    ULONG PagedPoolLookasideHits;
    ULONG AvailablePagedPoolPages;
    ULONG ResidentSystemCachePage;
    ULONG ResidentPagedPoolPage;
    ULONG ResidentSystemDriverPage;
    ULONG CcFastReadNoWait;
    ULONG CcFastReadWait;
    ULONG CcFastReadResourceMiss;
    ULONG CcFastReadNotPossible;
    ULONG CcFastMdlReadNoWait;
    ULONG CcFastMdlReadWait;
    ULONG CcFastMdlReadResourceMiss;
    ULONG CcFastMdlReadNotPossible;
    ULONG CcMapDataNoWait;
    ULONG CcMapDataWait;
    ULONG CcMapDataNoWaitMiss;
    ULONG CcMapDataWaitMiss;
    ULONG CcPinMappedDataCount;
    ULONG CcPinReadNoWait;
    ULONG CcPinReadWait;
    ULONG CcPinReadNoWaitMiss;
    ULONG CcPinReadWaitMiss;
    ULONG CcCopyReadNoWait;
    ULONG CcCopyReadWait;
    ULONG CcCopyReadNoWaitMiss;
    ULONG CcCopyReadWaitMiss;
    ULONG CcMdlReadNoWait;
    ULONG CcMdlReadWait;
    ULONG CcMdlReadNoWaitMiss;
    ULONG CcMdlReadWaitMiss;
    ULONG CcReadAheadIos;
    ULONG CcLazyWriteIos;
    ULONG CcLazyWritePages;
    ULONG CcDataFlushes;
    ULONG CcDataPages;
    ULONG ContextSwitches;
    ULONG FirstLevelTbFills;
    ULONG SecondLevelTbFills;
    ULONG SystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct _SYSTEM_TIMEOFDAY_INFORMATION 
{
    LARGE_INTEGER BootTime;
    LARGE_INTEGER CurrentTime;
    LARGE_INTEGER TimeZoneBias;
    ULONG TimeZoneId;
    ULONG Reserved;
    ULONGLONG BootTimeBias;
    ULONGLONG SleepTimeBias;
} SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION 
{
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER SpareLi1;
    LARGE_INTEGER SpareLi2;
    LARGE_INTEGER SpareLi3;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SessionId;
    ULONG_PTR PageDirectoryBase;
    SIZE_T PeakVirtualSize;
    SIZE_T VirtualSize;
    ULONG PageFaultCount;
    SIZE_T PeakWorkingSetSize;
    SIZE_T WorkingSetSize;
    SIZE_T QuotaPeakPagedPoolUsage;
    SIZE_T QuotaPagedPoolUsage;
    SIZE_T QuotaPeakNonPagedPoolUsage;
    SIZE_T QuotaNonPagedPoolUsage;
    SIZE_T PagefileUsage;
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef struct _SYSTEM_CALL_COUNT_INFORMATION 
{
    ULONG Length;
    ULONG NumberOfTables;
} SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;

typedef struct _SYSTEM_DEVICE_INFORMATION 
{
    ULONG NumberOfDisks;
    ULONG NumberOfFloppies;
    ULONG NumberOfCdRoms;
    ULONG NumberOfTapes;
    ULONG NumberOfSerialPorts;
    ULONG NumberOfParallelPorts;
} SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;

typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION 
{
    LARGE_INTEGER IdleTime;
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER DpcTime;          // DEVL only
    LARGE_INTEGER InterruptTime;    // DEVL only
    ULONG InterruptCount;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;

typedef struct _SYSTEM_FLAGS_INFORMATION 
{
    ULONG Flags;
} SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
    HANDLE Section;                 // Not filled in
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    UCHAR  FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES
{
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

typedef struct _RTL_PROCESS_LOCK_INFORMATION
{
    PVOID Address;
    USHORT Type;
    USHORT CreatorBackTraceIndex;
    HANDLE OwningThread;        // from the thread's ClientId->UniqueThread
    LONG LockCount;
    ULONG ContentionCount;
    ULONG EntryCount;
    LONG RecursionCount;
    ULONG NumberOfWaitingShared;
    ULONG NumberOfWaitingExclusive;
} RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION;

typedef struct _RTL_PROCESS_LOCKS
{
    ULONG NumberOfLocks;
    RTL_PROCESS_LOCK_INFORMATI
最低0.47元/天 解锁文章
ThatAllOver
关注
专栏目录
Windows调试和利用第部分：NTQuerySystemInformation
EcmShell的博客
09-19 252
本文介绍了NTQuerySystemInformation函数的用法，并提供了获取进程列表的示例代码。然后，我们再次调用NtQuerySystemInformation函数来获取实际的系统进程信息。在Windows操作系统中，NTQuerySystemInformation函数是一个强大的调试和利用工具。本文将详细介绍NTQuerySystemInformation函数的用法，并提供相应的源代码示例。需要注意的是，NTQuerySystemInformation函数的使用需要管理员权限或系统调试权限。
反调试 - r3 使用 NtQuerySystemInformation 获取 KdKdDebuggerEnable 和 KdDebuggerNotPresent
墨鱼菜鸡
07-14 340
原理 NtQuerySystemInformation 被 ntdll.dll 导出，当第一个参数传入 0x23 (SystemInterruptInformation) 时，会返回一个 SYSTEM_KERNEL_DE...
SYSTEM_INFORMATION_CLASS枚举类型定义
zfs2008zfs的博客
04-13 4984
SYSTEM_INFORMATION_CLASS是一个未文档化的结构体，在很多未文档化的函数中使用，比如ZwQuerySystemInformation、ZwSetSystemInformation中被调用，
NtQuerySystemInformation的使用
乐朝夕与之共
12-19 8520
今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包 括对某些信息的控制和设置。以下是这个函数的原型：  typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)     (IN      S
ZwQuerySystemInformation 函数查看进程列表
热门推荐
ShadowAssassin的专栏
12-14 1万+
程序主要应用函数  ZwQuerySystemInformation  实现的，这也是window内核的一个很重要，结构很复杂的函数。 函数原型 如下： //声明ZqQueryAyatemInformation NTSTATUS ZwQuerySystemInformation( I
函数ZwQuerySystemInformation小结
06-05 397
该函数存在于NTDLL.DLL动态链接库中。NTDLL.DLL负责ring3与ring0之间的通信。当使用子系统方式进行系统调用的时候，ntdll.dll和SSDT会配合使用。关于SSDT技术以后会讲解到。 关于ZwQuerySystemInformation这个函数可以用来查询进程信息、内核信息、硬件信息（例如CPU数目）、句柄信息、时间信息等54个系统信息。 该函数的原型是 NTST
ZwQuerySystemInfoMation函数使用
weixin_30677475的博客
06-23 177
ZwQueryInfoMation函数很简单.就是4个参数. NTSTATUS WINAPI ZwQuerySystemInformation( _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass, _Inout_ PVOID SystemInformation, _In_ ...
NtQuerySystemInformation 系统信息
06-17
根据这个参数的不同，可以获取到50多种不同的系统信息，如进程信息、内存信息、硬件配置等。`SystemInformation`参数是一个指向缓冲区的指针，用于存储查询结果，而`SystemInformationLength`则表示该缓冲区的大小。...
NtQuerySystemInformation判断线程是否被挂起/判断线程状态
03-20
当`SystemInformationClass`设置为`SystemThreadInformation`时，`NtQuerySystemInformation`会返回一个`SYSTEM_THREAD_INFORMATION`结构的数组，每个结构代表系统中的一个线程。这个结构包含了线程ID、所属进程ID、...
用Delphi模仿任务管理器：解析NtQuerySystemInformation函数
为了避免这种情况，开发者可以考虑使用微软推荐的替代API，如Performance Data Helper (PDH)库，虽然它可能没有NtQuerySystemInformation那么直接和全面，但其优点在于它是官方支持的，并且在不同版本的Windows中...
GetSystemFirmwareTable获取系统BIOS等信息（visual 20）
04-10
利用window api函数，获取bios信息，解析 GetSystemFirmwareTable结构体。 开始获取SmBios信息： ---------------------------------------------- Type 00 - [BIOS] BIOS Vendor : HP BIOS Version: P02 Ver. 02.06 Release Date: 06/09/2017 EC version: 6.21 Type 01 - [System Information] Manufacturer: HP Product Name: HP ProDesk 600 G3 PCI MT Version: Serial Number: ******* SKU Number: *******#AB2 Family: 103C_53307F HP ProDesk Type 02 - [System Information] Manufacturer: HP Product: 82B3 Version: KBC Version 06.15 Serial Number: ******* Asset Tag: Location in Chassis: Type 03 - [System Enclosure or Chassis] Manufacturer: HP Type: Desktop Version: Serial Number: ******* Asset Tag Number:******* Version: Not Specified Type 04 - [Processor Information] Socket Designation: U3E1 Processor Manufacturer: Intel(R) Corporation Processor Version: Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz Voltage: 2 (Bit0 - 5v, Bit1 - 3.3v, Bit2 - 2.9v) External Clock: 100 MHz Max Speed: 3600 MHz Current Speed: 3600 MHz Serial Number: To Be Filled By O.E.M. Asset Tag: To Be Filled By O.E.M. Part Number: To Be Filled By O.E.M. Type 17 - [Memory] Total Width: 64 Data Width:64 Size: 8192 MB Speed: 2400MHz Bank Locator: ChannelB Manufacturer: Samsung Serial Number: ******* Asset Tag: Part Number: *******-CRC ----------------------------------------------
<转>内核层 进程列举 NtQuerySystemInformation
weixin_33721344的博客
11-29 154
/*--------- 1.c -----------*/ #include "1.h"   //---------列举进程---------   NTSTATUS EnumProcess()   {   int iCount = 1;    //进程计数   NTSTATUS status;   //返回值   PVOID pSi = NULL; /*指向SystemInformationCla...
SYSTEM_INFORMATION_CLASS
afsafs1231的博客
06-27 184
typedef enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation, // 0 Y N SystemProcessorInformation, // 1 Y N SystemPerformanceInformation,...
内核下枚举进程 （二）ZwQuerySystemInformation
10-09 879
说明： SYSTEM_INFORMATION_CLASS 的5号功能枚举进程信息。其是这个函数对应着ring3下的 NtQuerySystemInformation，但msdn上说win8以后ZwQuerySystemInformation函数已经不可用，本人也没有在win8下测试过。留给读者自己实验吧。顺便罗嗦一下，不像ring3下使用此函数是要先LoadLibrary，然后GetPr...
_SYSTEM_PROCESS 32位与64位的结构
whatday的专栏
09-10 3380
typedef ULONG KPRIORITY; typedef enum _SYSTEM_INFORMATION_CLASS    {     SystemBasicInformation,                 //  0 Y N     SystemProcessorInformation,             //  1 Y N     SystemPerfor
32位和64位系统内核函数调用从ZwProtectVirtualMemory到NtProtectVirtualMemory
weixin_30624825的博客
09-01 1030
0x01 前言 　　我们知道R3层中，Zw系列函数和Nt系列函数函数是一样的，但是在内核Zw系列函数调用了Nt系列函数，但是为什么要在内核设置一个Zw系列函数而不是直接调用Nt函数呢？Zw系列函数又是怎么调用Nt系列函数的呢？我们利用IDA分析NtosKrnl.exe文件。 0x02 ZwProtectVirtualMemory 　　我们先看看ZwProtectVirtualMemor...
(转) SYSTEM_HANDLE_INFORMATION中ObjectTypeIndex的定义
weixin_33862514的博客
05-13 308
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO{ USHORT UniqueProcessId; USHORT CreatorBackTraceIndex; UCHAR ObjectTypeIndex; UCHAR HandleAttributes; USHORT HandleValue; PVOID Object; ULONG Gr...
获得进程的EPROCESS
Kendiv's Box
01-31 5603
获得进程的EPROCESS发布日期：2004-06-02文摘内容： 文摘出处：http://www.xfocus.net/articles/200406/706.html创建时间：2004-06-01文章属性：原创文章提交：MustBE (zf35_at_citiz.net)By [I.T.S]SystEm32Welcome to our web site http://itaq.ynpc
SYSTEM_HANDLE_TABLE_ENTRY_INFO
weixin_30500473的博客
06-11 580
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO { USHORT UniqueProcessId; USHORT CreatorBackTraceIndex; UCHAR ObjectTypeIndex; UCHAR HandleAttributes; USHORT HandleValue; PVOID Object...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值