SystemBigPoolInformation 大内存池枚举

ThatAllOver

已于 2022-08-10 17:13:03 修改

阅读量329

点赞数

分类专栏： C++ 文章标签： c++ 算法开发语言

于 2022-08-10 17:11:51 首次发布

本文链接：https://blog.csdn.net/zzy1448331580/article/details/126270455

版权

C++ 专栏收录该内容

67 篇文章 3 订阅

订阅专栏

#include <windows.h>
#include <winternl.h>
#include <stdio.h>

#include <memory>

#define SystemBigPoolInformation 66

typedef NTSTATUS(WINAPI* FNtQuerySystemInformation)(
	SYSTEM_INFORMATION_CLASS SystemInformationClass,
	PVOID SystemInformation,
	ULONG SystemInformationLength,
	PULONG ReturnLength);

typedef struct _SYSTEM_BIGPOOL_ENTRY
{
	union 
	{
		PVOID VirtualAddress;
		ULONG_PTR NonPaged : 1;
	};
	ULONG_PTR SizeInBytes;
	union 
	{
		UCHAR Tag[4];
		ULONG TagUlong;
	};
} SYSTEM_BIGPOOL_ENTRY, * PSYSTEM_BIGPOOL_ENTRY;

typedef struct _SYSTEM_BIGPOOL_INFORMATION 
{
	ULONG Count;
	SYSTEM_BIGPOOL_ENTRY AllocatedInfo[ANYSIZE_ARRAY];
} SYSTEM_BIGPOOL_INFORMATION, * PSYSTEM_BIGPOOL_INFORMATION;

int main(int argc, char* argv[])
{
	HMODULE m = GetModuleHandleW(L"ntdll.dll");
	if (!m) return 0;

	FNtQuerySystemInformation NtQuerySystemInformation = (FNtQuerySystemInformation)GetProcAddress(m, "NtQuerySystemInformation");
	if (!NtQuerySystemInformation) return 0;

	// 一定要确保内存空间够大
	ULONG SystemInformationLength = 800000 * 2;
	ULONG ReturnLength = 0;
	
	std::unique_ptr<char> buffer(new char[SystemInformationLength]);
	memset(buffer.get(), 0, SystemInformationLength);
	
	NTSTATUS status = NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)SystemBigPoolInformation, buffer.get(), SystemInformationLength, &ReturnLength);
	if (status) return 0;

	PSYSTEM_BIGPOOL_INFORMATION bigpools = (PSYSTEM_BIGPOOL_INFORMATION)buffer.get();
	for (ULONG i = 0; i < bigpools->Count; i++)
	{
		SYSTEM_BIGPOOL_ENTRY& entry = bigpools->AllocatedInfo[i];
#ifdef _WIN64
		printf("%lld Tag: %.*s, Address: 0x%llx, Size: 0x%x \n", i, 4, entry.Tag, entry.VirtualAddress, entry.SizeInBytes);
#else
		printf("%ld Tag: %.*s, Address: 0x%x, Size: 0x%x \n", i, 4, entry.Tag, entry.VirtualAddress, entry.SizeInBytes);
#endif
	}

	return 0;
}