NtQuerySystemInformation用法详解

元始天尊

花了好几天才弄出来这个东东，照着wrk源码弄得

ntdefs.h (29.86 KB, 下载次数: 27)

2015-7-19 01:13 上传

点击文件名下载附件

NtQuerySystemInforamtion.cpp (48.24 KB, 下载次数: 32)

2015-7-19 01:13 上传

点击文件名下载附件

0x01810

赞一个....

0xAA55

ntdefs.h

1. #include <basetsd.h>
   
2. 
   
3. #define IN
   
4. #define OUT
   
5. #define OPTIONAL
   
6. #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
   
7. #define MAX_STACK_DEPTH 32
   
8. #define MAXIMUM_NUMA_NODES 16
   
9. #define STATUS_SUCCESS                   ((NTSTATUS)0x00000000L)    // ntsubauth
   
10. 
    
11. typedef unsigned long ULONG;
    
12. typedef unsigned int DWORD;
    
13. typedef unsigned short WORD;
    
14. typedef unsigned char UCHAR;
    
15. typedef unsigned short USHORT;
    
16. typedef long LONG;
    
17. typedef LONG NTSTATUS;
    
18. typedef void *PVOID;
    
19. typedef ULONG *PULONG;
    
20. typedef ULONG_PTR KAFFINITY;
    
21. typedef char CCHAR;
    
22. typedef void * HANDLE;
    
23. typedef UCHAR *PUCHAR;
    
24. typedef unsigned int UINT;
    
25. typedef void *LPVOID;
    
26. typedef SIZE_T SYSINF_PAGE_COUNT;
    
27. typedef LONG KPRIORITY;
    
28. typedef wchar_t WCHAR;
    
29. typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;
    
30. typedef char CHAR;
    
31. typedef CHAR *PCHAR, *LPCH, *PCH;
    
32. typedef DWORD ACCESS_MASK;
    
33. 
    
34. typedef struct _UNICODE_STRING {
    
35.         USHORT Length;
    
36.         USHORT MaximumLength;
    
37. #ifdef MIDL_PASS
    
38.         [size_is(MaximumLength / 2), length_is((Length) / 2)] USHORT * Buffer;
    
39. #else // MIDL_PASS
    
40.         PWSTR  Buffer;
    
41. #endif // MIDL_PASS
    
42. } UNICODE_STRING;
    
43. typedef UNICODE_STRING *PUNICODE_STRING;
    
44. 
    
45. #if (!defined (_MAC) && (!defined(MIDL_PASS) || defined(__midl)) && (!defined(_M_IX86) || (defined(_INTEGRAL_MAX_BITS) && _INTEGRAL_MAX_BITS >= 64)))
    
46. typedef __int64 LONGLONG;
    
47. typedef unsigned __int64 ULONGLONG;
    
48. #define MAXLONGLONG                         (0x7fffffffffffffff)
    
49. #else
    
50. #if defined(_MAC) && defined(_MAC_INT_64)
    
51. typedef __int64 LONGLONG;
    
52. typedef unsigned __int64 ULONGLONG;
    
53. #define MAXLONGLONG                      (0x7fffffffffffffff)
    
54. #else
    
55. typedef double LONGLONG;
    
56. typedef double ULONGLONG;
    
57. #endif //_MAC and int64
    
58. #endif
    
59. 
    
60. #if defined(MIDL_PASS)
    
61. typedef struct _LARGE_INTEGER
    
62. {
    
63. #else // MIDL_PASS
    
64. typedef union _LARGE_INTEGER
    
65. {
    
66.         struct
    
67.         {
    
68.                 DWORD LowPart;
    
69.                 LONG HighPart;
    
70.         } DUMMYSTRUCTNAME;
    
71.         struct
    
72.         {
    
73.                 DWORD LowPart;
    
74.                 LONG HighPart;
    
75.         } u;
    
76. #endif //MIDL_PASS
    
77.         LONGLONG QuadPart;
    
78. } LARGE_INTEGER;
    
79. 
    
80. typedef unsigned char BYTE;
    
81. typedef BYTE BOOLEAN;
    
82. 
    
83. #define FLG_STOP_ON_EXCEPTION           0x00000001      // user and kernel mode
    
84. #define FLG_SHOW_LDR_SNAPS              0x00000002      // user and kernel mode
    
85. #define FLG_DEBUG_INITIAL_COMMAND       0x00000004      // kernel mode only up until WINLOGON started
    
86. #define FLG_STOP_ON_HUNG_GUI            0x00000008      // kernel mode only while running
    
87. 
    
88. #define FLG_HEAP_ENABLE_TAIL_CHECK      0x00000010      // user mode only
    
89. #define FLG_HEAP_ENABLE_FREE_CHECK      0x00000020      // user mode only
    
90. #define FLG_HEAP_VALIDATE_PARAMETERS    0x00000040      // user mode only
    
91. #define FLG_HEAP_VALIDATE_ALL           0x00000080      // user mode only
    
92. 
    
93. #define FLG_APPLICATION_VERIFIER        0x00000100      // user mode only
    
94. #define FLG_POOL_ENABLE_TAGGING         0x00000400      // kernel mode only
    
95. #define FLG_HEAP_ENABLE_TAGGING         0x00000800      // user mode only
    
96. 
    
97. #define FLG_USER_STACK_TRACE_DB         0x00001000      // x86 user mode only
    
98. #define FLG_KERNEL_STACK_TRACE_DB       0x00002000      // x86 kernel mode only at boot time
    
99. #define FLG_MAINTAIN_OBJECT_TYPELIST    0x00004000      // kernel mode only at boot time
    
100. #define FLG_HEAP_ENABLE_TAG_BY_DLL      0x00008000      // user mode only
     
101. 
     
102. #define FLG_DISABLE_STACK_EXTENSION     0x00010000      // user mode only
     
103. #define FLG_ENABLE_CSRDEBUG             0x00020000      // kernel mode only at boot time
     
104. #define FLG_ENABLE_KDEBUG_SYMBOL_LOAD   0x00040000      // kernel mode only
     
105. #define FLG_DISABLE_PAGE_KERNEL_STACKS  0x00080000      // kernel mode only at boot time
     
106. 
     
107. #define FLG_ENABLE_SYSTEM_CRIT_BREAKS   0x00100000      // user mode only
     
108. #define FLG_HEAP_DISABLE_COALESCING     0x00200000      // user mode only
     
109. #define FLG_ENABLE_CLOSE_EXCEPTIONS     0x00400000      // kernel mode only
     
110. #define FLG_ENABLE_EXCEPTION_LOGGING    0x00800000      // kernel mode only
     
111. 
     
112. #define FLG_ENABLE_HANDLE_TYPE_TAGGING  0x01000000      // kernel mode only
     
113. #define FLG_HEAP_PAGE_ALLOCS            0x02000000      // user mode only
     
114. #define FLG_DEBUG_INITIAL_COMMAND_EX    0x04000000      // kernel mode only up until WINLOGON started
     
115. #define FLG_DISABLE_DBGPRINT            0x08000000      // kernel mode only
     
116. 
     
117. #define FLG_CRITSEC_EVENT_CREATION      0x10000000      // user mode only, Force early creation of resource events
     
118. #define FLG_LDR_TOP_DOWN                0x20000000      // user mode only, win64 only
     
119. #define FLG_ENABLE_HANDLE_EXCEPTIONS    0x40000000      // kernel mode only
     
120. #define FLG_DISABLE_PROTDLLS            0x80000000      // user mode only (smss/winlogon)
     
121. 
     
122. #define PROCESSOR_ARCHITECTURE_INTEL            0
     
123. #define PROCESSOR_ARCHITECTURE_MIPS             1
     
124. #define PROCESSOR_ARCHITECTURE_ALPHA            2
     
125. #define PROCESSOR_ARCHITECTURE_PPC              3
     
126. #define PROCESSOR_ARCHITECTURE_SHX              4
     
127. #define PROCESSOR_ARCHITECTURE_ARM              5
     
128. #define PROCESSOR_ARCHITECTURE_IA64             6
     
129. #define PROCESSOR_ARCHITECTURE_ALPHA64          7
     
130. #define PROCESSOR_ARCHITECTURE_MSIL             8
     
131. #define PROCESSOR_ARCHITECTURE_AMD64            9
     
132. #define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64    10
     
133. 
     
134. #define STATUS_INFO_LENGTH_MISMATCH      ((NTSTATUS)0xC0000004L)
     
135. #define STATUS_INVALID_INFO_CLASS ((NTSTATUS)0xC0000003L)
     
136. #define STATUS_ACCESS_VIOLATION ((DWORD )0xC0000005L)
     
137. #define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009AL)
     
138. #define STATUS_WORKING_SET_QUOTA ((NTSTATUS)0xC00000A1L)
     
139. #define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002L)
     
140. 
     
141. typedef enum _SYSTEM_INFORMATION_CLASS
     
142. {
     
143.         SystemBasicInformation,
     
144.         SystemProcessorInformation,              // obsolete...delete
     
145.         SystemPerformanceInformation,
     
146.         SystemTimeOfDayInformation,
     
147.         SystemPathInformation,
     
148.         SystemProcessInformation,                //系统进程信息
     
149.         SystemCallCountInformation,
     
150.         SystemDeviceInformation,
     
151.         SystemProcessorPerformanceInformation,
     
152.         SystemFlagsInformation,
     
153.         SystemCallTimeInformation,
     
154.         SystemModuleInformation,     //系统模块
     
155.         SystemLocksInformation,
     
156.         SystemStackTraceInformation,
     
157.         SystemPagedPoolInformation,
     
158.         SystemNonPagedPoolInformation,
     
159.         SystemHandleInformation,
     
160.         SystemObjectInformation,
     
161.         SystemPageFileInformation,
     
162.         SystemVdmInstemulInformation,
     
163.         SystemVdmBopInformation,
     
164.         SystemFileCacheInformation,
     
165.         SystemPoolTagInformation,
     
166.         SystemInterruptInformation,
     
167.         SystemDpcBehaviorInformation,
     
168.         SystemFullMemoryInformation,
     
169.         SystemLoadGdiDriverInformation,
     
170.         SystemUnloadGdiDriverInformation,
     
171.         SystemTimeAdjustmentInformation,
     
172.         SystemSummaryMemoryInformation,
     
173.         SystemMirrorMemoryInformation,
     
174.         SystemPerformanceTraceInformation,
     
175.         SystemObsolete0,
     
176.         SystemExceptionInformation,
     
177.         SystemCrashDumpStateInformation,
     
178.         SystemKernelDebuggerInformation,
     
179.         SystemContextSwitchInformation,
     
180.         SystemRegistryQuotaInformation,
     
181.         SystemExtendServiceTableInformation,
     
182.         SystemPrioritySeperation,
     
183.         SystemVerifierAddDriverInformation,
     
184.         SystemVerifierRemoveDriverInformation,
     
185.         SystemProcessorIdleInformation,
     
186.         SystemLegacyDriverInformation,
     
187.         SystemCurrentTimeZoneInformation,
     
188.         SystemLookasideInformation,
     
189.         SystemTimeSlipNotification,
     
190.         SystemSessionCreate,
     
191.         SystemSessionDetach,
     
192.         SystemSessionInformation,
     
193.         SystemRangeStartInformation,
     
194.         SystemVerifierInformation,
     
195.         SystemVerifierThunkExtend,
     
196.         SystemSessionProcessInformation,
     
197.         SystemLoadGdiDriverInSystemSpace,
     
198.         SystemNumaProcessorMap,
     
199.         SystemPrefetcherInformation,
     
200.         SystemExtendedProcessInformation,
     
201.         SystemRecommendedSharedDataAlignment,
     
202.         SystemComPlusPackage,
     
203.         SystemNumaAvailableMemory,
     
204.         SystemProcessorPowerInformation,
     
205.         SystemEmulationBasicInformation,//=SystemBasicInformation
     
206.         SystemEmulationProcessorInformation,//=SystemProcessorInformation
     
207.         SystemExtendedHandleInformation,
     
208.         SystemLostDelayedWriteInformation,
     
209.         SystemBigPoolInformation,
     
210.         SystemSessionPoolTagInformation,
     
211.         SystemSessionMappedViewInformation,
     
212.         SystemHotpatchInformation,
     
213.         SystemObjectSecurityMode,
     
214.         SystemWatchdogTimerHandler,
     
215.         SystemWatchdogTimerInformation,
     
216.         SystemLogicalProcessorInformation,
     
217.         SystemWow64SharedInformation,
     
218.         SystemRegisterFirmwareTableInformationHandler,
     
219.         SystemFirmwareTableInformation,
     
220.         SystemModuleInformationEx,
     
221.         SystemVerifierTriageInformation,
     
222.         SystemSuperfetchInformation,
     
223.         SystemMemoryListInformation,
     
224.         SystemFileCacheInformationEx,
     
225. 
     
226.         //100?
     
227.         SystemPageMemoryInformation = 123,//自定义
     
228.         SystemPolicyInformation = 134,
     
229. 
     
230. } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
     
231. 
     
232. typedef struct _SYSTEM_BASIC_INFORMATION
     
233. {
     
234.         ULONG Reserved;
     
235.         ULONG TimerResolution;
     
236.         ULONG PageSize;
     
237.         SYSINF_PAGE_COUNT NumberOfPhysicalPages;
     
238.         SYSINF_PAGE_COUNT LowestPhysicalPageNumber;
     
239.         SYSINF_PAGE_COUNT HighestPhysicalPageNumber;
     
240.         ULONG AllocationGranularity;
     
241.         ULONG_PTR MinimumUserModeAddress;
     
242.         ULONG_PTR MaximumUserModeAddress;
     
243.         ULONG_PTR ActiveProcessorsAffinityMask;
     
244.         CCHAR NumberOfProcessors;
     
245. } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
     
246. 
     
247. typedef struct _SYSTEM_PROCESSOR_INFORMATION
     
248. {
     
249.         USHORT ProcessorArchitecture;
     
250.         USHORT ProcessorLevel;
     
251.         USHORT ProcessorRevision;
     
252.         USHORT Reserved;
     
253.         ULONG ProcessorFeatureBits;
     
254. } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION;
     
255. 
     
256. typedef struct _SYSTEM_PERFORMANCE_INFORMATION
     
257. {
     
258.         LARGE_INTEGER IdleProcessTime;
     
259.         LARGE_INTEGER IoReadTransferCount;
     
260.         LARGE_INTEGER IoWriteTransferCount;
     
261.         LARGE_INTEGER IoOtherTransferCount;
     
262.         ULONG IoReadOperationCount;
     
263.         ULONG IoWriteOperationCount;
     
264.         ULONG IoOtherOperationCount;
     
265.         ULONG AvailablePages;
     
266.         SYSINF_PAGE_COUNT CommittedPages;
     
267.         SYSINF_PAGE_COUNT CommitLimit;
     
268.         SYSINF_PAGE_COUNT PeakCommitment;
     
269.         ULONG PageFaultCount;
     
270.         ULONG CopyOnWriteCount;
     
271.         ULONG TransitionCount;
     
272.         ULONG CacheTransitionCount;
     
273.         ULONG DemandZeroCount;
     
274.         ULONG PageReadCount;
     
275.         ULONG PageReadIoCount;
     
276.         ULONG CacheReadCount;
     
277.         ULONG CacheIoCount;
     
278.         ULONG DirtyPagesWriteCount;
     
279.         ULONG DirtyWriteIoCount;
     
280.         ULONG MappedPagesWriteCount;
     
281.         ULONG MappedWriteIoCount;
     
282.         ULONG PagedPoolPages;
     
283.         ULONG NonPagedPoolPages;
     
284.         ULONG PagedPoolAllocs;
     
285.         ULONG PagedPoolFrees;
     
286.         ULONG NonPagedPoolAllocs;
     
287.         ULONG NonPagedPoolFrees;
     
288.         ULONG FreeSystemPtes;
     
289.         ULONG ResidentSystemCodePage;
     
290.         ULONG TotalSystemDriverPages;
     
291.         ULONG TotalSystemCodePages;
     
292.         ULONG NonPagedPoolLookasideHits;
     
293.         ULONG PagedPoolLookasideHits;
     
294.         ULONG AvailablePagedPoolPages;
     
295.         ULONG ResidentSystemCachePage;
     
296.         ULONG ResidentPagedPoolPage;
     
297.         ULONG ResidentSystemDriverPage;
     
298.         ULONG CcFastReadNoWait;
     
299.         ULONG CcFastReadWait;
     
300.         ULONG CcFastReadResourceMiss;
     
301.         ULONG CcFastReadNotPossible;
     
302.         ULONG CcFastMdlReadNoWait;
     
303.         ULONG CcFastMdlReadWait;
     
304.         ULONG CcFastMdlReadResourceMiss;
     
305.         ULONG CcFastMdlReadNotPossible;
     
306.         ULONG CcMapDataNoWait;
     
307.         ULONG CcMapDataWait;
     
308.         ULONG CcMapDataNoWaitMiss;
     
309.         ULONG CcMapDataWaitMiss;
     
310.         ULONG CcPinMappedDataCount;
     
311.         ULONG CcPinReadNoWait;
     
312.         ULONG CcPinReadWait;
     
313.         ULONG CcPinReadNoWaitMiss;
     
314.         ULONG CcPinReadWaitMiss;
     
315.         ULONG CcCopyReadNoWait;
     
316.         ULONG CcCopyReadWait;
     
317.         ULONG CcCopyReadNoWaitMiss;
     
318.         ULONG CcCopyReadWaitMiss;
     
319.         ULONG CcMdlReadNoWait;
     
320.         ULONG CcMdlReadWait;
     
321.         ULONG CcMdlReadNoWaitMiss;
     
322.         ULONG CcMdlReadWaitMiss;
     
323.         ULONG CcReadAheadIos;
     
324.         ULONG CcLazyWriteIos;
     
325.         ULONG CcLazyWritePages;
     
326.         ULONG CcDataFlushes;
     
327.         ULONG CcDataPages;
     
328.         ULONG ContextSwitches;
     
329.         ULONG FirstLevelTbFills;
     
330.         ULONG SecondLevelTbFills;
     
331.         ULONG SystemCalls;
     
332. } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
     
333. 
     
334. typedef struct _SYSTEM_TIMEOFDAY_INFORMATION
     
335. {
     
336.         LARGE_INTEGER BootTime;
     
337.         LARGE_INTEGER CurrentTime;
     
338.         LARGE_INTEGER TimeZoneBias;
     
339.         ULONG TimeZoneId;
     
340.         ULONG Reserved;
     
341.         ULONGLONG BootTimeBias;
     
342.         ULONGLONG SleepTimeBias;
     
343. } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION;
     
344. 
     
345. typedef struct _SYSTEM_PROCESS_INFORMATION
     
346. {
     
347.         ULONG NextEntryOffset;
     
348.         ULONG NumberOfThreads;
     
349.         LARGE_INTEGER SpareLi1;
     
350.         LARGE_INTEGER SpareLi2;
     
351.         LARGE_INTEGER SpareLi3;
     
352.         LARGE_INTEGER CreateTime;
     
353.         LARGE_INTEGER UserTime;
     
354.         LARGE_INTEGER KernelTime;
     
355.         UNICODE_STRING ImageName;
     
356.         KPRIORITY BasePriority;
     
357.         HANDLE UniqueProcessId;
     
358.         HANDLE InheritedFromUniqueProcessId;
     
359.         ULONG HandleCount;
     
360.         ULONG SessionId;
     
361.         ULONG_PTR PageDirectoryBase;
     
362.         SIZE_T PeakVirtualSize;
     
363.         SIZE_T VirtualSize;
     
364.         ULONG PageFaultCount;
     
365.         SIZE_T PeakWorkingSetSize;
     
366.         SIZE_T WorkingSetSize;
     
367.         SIZE_T QuotaPeakPagedPoolUsage;
     
368.         SIZE_T QuotaPagedPoolUsage;
     
369.         SIZE_T QuotaPeakNonPagedPoolUsage;
     
370.         SIZE_T QuotaNonPagedPoolUsage;
     
371.         SIZE_T PagefileUsage;
     
372.         SIZE_T PeakPagefileUsage;
     
373.         SIZE_T PrivatePageCount;
     
374.         LARGE_INTEGER ReadOperationCount;
     
375.         LARGE_INTEGER WriteOperationCount;
     
376.         LARGE_INTEGER OtherOperationCount;
     
377.         LARGE_INTEGER ReadTransferCount;
     
378.         LARGE_INTEGER WriteTransferCount;
     
379.         LARGE_INTEGER OtherTransferCount;
     
380. } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
     
381. 
     
382. typedef struct _SYSTEM_CALL_COUNT_INFORMATION
     
383. {
     
384.         ULONG Length;
     
385.         ULONG NumberOfTables;
     
386. } SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION;
     
387. 
     
388. typedef struct _SYSTEM_DEVICE_INFORMATION
     
389. {
     
390.         ULONG NumberOfDisks;
     
391.         ULONG NumberOfFloppies;
     
392.         ULONG NumberOfCdRoms;
     
393.         ULONG NumberOfTapes;
     
394.         ULONG NumberOfSerialPorts;
     
395.         ULONG NumberOfParallelPorts;
     
396. } SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION;
     
397. 
     
398. typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
     
399. {
     
400.         LARGE_INTEGER IdleTime;
     
401.         LARGE_INTEGER KernelTime;
     
402.         LARGE_INTEGER UserTime;
     
403.         LARGE_INTEGER DpcTime;          // DEVL only
     
404.         LARGE_INTEGER InterruptTime;    // DEVL only
     
405.         ULONG InterruptCount;
     
406. } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
     
407. 
     
408. typedef struct _SYSTEM_FLAGS_INFORMATION
     
409. {
     
410.         ULONG Flags;
     
411. } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION;
     
412. 
     
413. typedef struct _RTL_PROCESS_MODULE_INFORMATION
     
414. {
     
415.         HANDLE Section;                 // Not filled in
     
416.         PVOID MappedBase;
     
417.         PVOID ImageBase;
     
418.         ULONG ImageSize;
     
419.         ULONG Flags;
     
420.         USHORT LoadOrderIndex;
     
421.         USHORT InitOrderIndex;
     
422.         USHORT LoadCount;
     
423.         USHORT OffsetToFileName;
     
424.         UCHAR  FullPathName[256];
     
425. } RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
     
426. 
     
427. typedef struct _RTL_PROCESS_MODULES
     
428. {
     
429.         ULONG NumberOfModules;
     
430.         RTL_PROCESS_MODULE_INFORMATION Modules[1];
     
431. } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
     
432. 
     
433. typedef struct _RTL_PROCESS_LOCK_INFORMATION
     
434. {
     
435.         PVOID Address;
     
436.         USHORT Type;
     
437.         USHORT CreatorBackTraceIndex;
     
438.         HANDLE OwningThread;        // from the thread's ClientId->UniqueThread
     
439.         LONG LockCount;
     
440.         ULONG ContentionCount;
     
441.         ULONG EntryCount;
     
442.         LONG RecursionCount;
     
443.         ULONG NumberOfWaitingShared;
     
444.         ULONG NumberOfWaitingExclusive;
     
445. } RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION;
     
446. 
     
447. typedef struct _RTL_PROCESS_LOCKS
     
448. {
     
449.         ULONG NumberOfLocks;
     
450.         RTL_PROCESS_LOCK_INFORMATION Locks[1];
     
451. } RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS;
     
452. 
     
453. 
     
454. typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION
     
455. {
     
456.         PCHAR SymbolicBackTrace;        // Not filled in
     
457.         ULONG TraceCount;
     
458.         USHORT Index;
     
459.         USHORT Depth;
     
460.         PVOID BackTrace[MAX_STACK_DEPTH];
     
461. } RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION;
     
462. 
     
463. typedef struct _RTL_PROCESS_BACKTRACES
     
464. {
     
465.         ULONG CommittedMemory;
     
466.         ULONG ReservedMemory;
     
467.         ULONG NumberOfBackTraceLookups;
     
468.         ULONG NumberOfBackTraces;
     
469.         RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[1];
     
470. } RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES;
     
471. 
     
472. typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
     
473. {
     
474.         USHORT UniqueProcessId;
     
475.         USHORT CreatorBackTraceIndex;
     
476.         UCHAR ObjectTypeIndex;
     
477.         UCHAR HandleAttributes;
     
478.         USHORT HandleValue;
     
479.         PVOID Object;
     
480.         ULONG GrantedAccess;
     
481. } SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
     
482. 
     
483. typedef struct _SYSTEM_HANDLE_INFORMATION
     
484. {
     
485.         ULONG NumberOfHandles;
     
486.         SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
     
487. } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
     
488. 
     
489. typedef struct _GENERIC_MAPPING
     
490. {
     
491.         ACCESS_MASK GenericRead;
     
492.         ACCESS_MASK GenericWrite;
     
493.         ACCESS_MASK GenericExecute;
     
494.         ACCESS_MASK GenericAll;
     
495. } GENERIC_MAPPING;
     
496. typedef GENERIC_MAPPING *PGENERIC_MAPPING;
     
497. 
     
498. typedef struct _SYSTEM_OBJECTTYPE_INFORMATION
     
499. {
     
500.         ULONG NextEntryOffset;
     
501.         ULONG NumberOfObjects;
     
502.         ULONG NumberOfHandles;
     
503.         ULONG TypeIndex;
     
504.         ULONG InvalidAttributes;
     
505.         GENERIC_MAPPING GenericMapping;
     
506.         ULONG ValidAccessMask;
     
507.         ULONG PoolType;
     
508.         BOOLEAN SecurityRequired;
     
509.         BOOLEAN WaitableObject;
     
510.         UNICODE_STRING TypeName;
     
511. } SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION;
     
512. 
     
513. typedef struct _OBJECT_NAME_INFORMATION
     
514. {
     
515.         UNICODE_STRING Name;
     
516. } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
     
517. 
     
518. typedef struct _SYSTEM_OBJECT_INFORMATION
     
519. {
     
520.         ULONG NextEntryOffset;
     
521.         PVOID Object;
     
522.         HANDLE CreatorUniqueProcess;
     
523.         USHORT CreatorBackTraceIndex;
     
524.         USHORT Flags;
     
525.         LONG PointerCount;
     
526.         LONG HandleCount;
     
527.         ULONG PagedPoolCharge;
     
528.         ULONG NonPagedPoolCharge;
     
529.         HANDLE ExclusiveProcessId;
     
530.         PVOID SecurityDescriptor;
     
531.         OBJECT_NAME_INFORMATION NameInfo;
     
532. } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION;
     
533. 
     
534. typedef struct _SYSTEM_PAGEFILE_INFORMATION
     
535. {
     
536.         ULONG NextEntryOffset;
     
537.         ULONG TotalSize;
     
538.         ULONG TotalInUse;
     
539.         ULONG PeakUsage;
     
540.         UNICODE_STRING PageFileName;
     
541. } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION;
     
542. 
     
543. typedef struct _SYSTEM_VDM_INSTEMUL_INFO
     
544. {
     
545.         ULONG SegmentNotPresent;
     
546.         ULONG VdmOpcode0F;
     
547.         ULONG OpcodeESPrefix;
     
548.         ULONG OpcodeCSPrefix;
     
549.         ULONG OpcodeSSPrefix;
     
550.         ULONG OpcodeDSPrefix;
     
551.         ULONG OpcodeFSPrefix;
     
552.         ULONG OpcodeGSPrefix;
     
553.         ULONG OpcodeOPER32Prefix;
     
554.         ULONG OpcodeADDR32Prefix;
     
555.         ULONG OpcodeINSB;
     
556.         ULONG OpcodeINSW;
     
557.         ULONG OpcodeOUTSB;
     
558.         ULONG OpcodeOUTSW;
     
559.         ULONG OpcodePUSHF;
     
560.         ULONG OpcodePOPF;
     
561.         ULONG OpcodeINTnn;
     
562.         ULONG OpcodeINTO;
     
563.         ULONG OpcodeIRET;
     
564.         ULONG OpcodeINBimm;
     
565.         ULONG OpcodeINWimm;
     
566.         ULONG OpcodeOUTBimm;
     
567.         ULONG OpcodeOUTWimm;
     
568.         ULONG OpcodeINB;
     
569.         ULONG OpcodeINW;
     
570.         ULONG OpcodeOUTB;
     
571.         ULONG OpcodeOUTW;
     
572.         ULONG OpcodeLOCKPrefix;
     
573.         ULONG OpcodeREPNEPrefix;
     
574.         ULONG OpcodeREPPrefix;
     
575.         ULONG OpcodeHLT;
     
576.         ULONG OpcodeCLI;
     
577.         ULONG OpcodeSTI;
     
578.         ULONG BopCount;
     
579. } SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO;
     
580. 
     
581. typedef struct _SYSTEM_FILECACHE_INFORMATION
     
582. {
     
583.         SIZE_T CurrentSize;
     
584.         SIZE_T PeakSize;
     
585.         ULONG PageFaultCount;
     
586.         SIZE_T MinimumWorkingSet;
     
587.         SIZE_T MaximumWorkingSet;
     
588.         SIZE_T CurrentSizeIncludingTransitionInPages;
     
589.         SIZE_T PeakSizeIncludingTransitionInPages;
     
590.         ULONG TransitionRePurposeCount;
     
591.         ULONG Flags;
     
592. } SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION;
     
593. 
     
594. typedef struct _SYSTEM_POOLTAG
     
595. {
     
596.         union
     
597.         {
     
598.                 UCHAR Tag[4];
     
599.                 ULONG TagUlong;
     
600.         };
     
601.         ULONG PagedAllocs;
     
602.         ULONG PagedFrees;
     
603.         SIZE_T PagedUsed;
     
604.         ULONG NonPagedAllocs;
     
605.         ULONG NonPagedFrees;
     
606.         SIZE_T NonPagedUsed;
     
607. } SYSTEM_POOLTAG, *PSYSTEM_POOLTAG;
     
608. 
     
609. typedef struct _SYSTEM_POOLTAG_INFORMATION
     
610. {
     
611.         ULONG Count;
     
612.         SYSTEM_POOLTAG TagInfo[1];
     
613. } SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION;
     
614. 
     
615. typedef struct _SYSTEM_INTERRUPT_INFORMATION
     
616. {
     
617.         ULONG ContextSwitches;
     
618.         ULONG DpcCount;
     
619.         ULONG DpcRate;
     
620.         ULONG TimeIncrement;
     
621.         ULONG DpcBypassCount;
     
622.         ULONG ApcBypassCount;
     
623. } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION;
     
624. 
     
625. typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION
     
626. {
     
627.         ULONG Spare;
     
628.         ULONG DpcQueueDepth;
     
629.         ULONG MinimumDpcRate;
     
630.         ULONG AdjustDpcThreshold;
     
631.         ULONG IdealDpcRate;
     
632. } SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION;
     
633. 
     
634. typedef struct _SYSTEM_MEMORY_INFO
     
635. {
     
636.         PUCHAR StringOffset;
     
637.         USHORT ValidCount;
     
638.         USHORT TransitionCount;
     
639.         USHORT ModifiedCount;
     
640.         USHORT PageTableCount;
     
641. } SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO;
     
642. 
     
643. typedef struct _SYSTEM_MEMORY_INFORMATION
     
644. {
     
645.         ULONG InfoSize;
     
646.         ULONG_PTR StringStart;
     
647.         SYSTEM_MEMORY_INFO Memory[1];
     
648. } SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION;
     
649. 
     
650. typedef struct _IMAGE_EXPORT_DIRECTORY
     
651. {
     
652.         DWORD   Characteristics;
     
653.         DWORD   TimeDateStamp;
     
654.         WORD    MajorVersion;
     
655.         WORD    MinorVersion;
     
656.         DWORD   Name;
     
657.         DWORD   Base;
     
658.         DWORD   NumberOfFunctions;
     
659.         DWORD   NumberOfNames;
     
660.         DWORD   AddressOfFunctions;     // RVA from base of image
     
661.         DWORD   AddressOfNames;         // RVA from base of image
     
662.         DWORD   AddressOfNameOrdinals;  // RVA from base of image
     
663. } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
     
664. 
     
665. typedef struct _SYSTEM_GDI_DRIVER_INFORMATION
     
666. {
     
667.         UNICODE_STRING DriverName;
     
668.         PVOID ImageAddress;
     
669.         PVOID SectionPointer;
     
670.         PVOID EntryPoint;
     
671.         PIMAGE_EXPORT_DIRECTORY ExportSectionPointer;
     
672.         ULONG ImageLength;
     
673. } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION;
     
674. 
     
675. typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION
     
676. {
     
677.         ULONG TimeAdjustment;
     
678.         BOOLEAN Enable;
     
679. } SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION;
     
680. 
     
681. 
     
682. 
     
683. 
     
684. 
     
685. 
     
686. 
     
687. 
     
688. 
     
689. 
     
690. typedef struct _KSERVICE_TABLE_DESCRIPTOR
     
691. {
     
692.         PULONG_PTR Base;
     
693.         PULONG Count;
     
694.         ULONG Limit;
     
695.         PUCHAR Number;
     
696. } KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;
     
697. 
     
698. typedef struct _CLIENT_ID
     
699. {
     
700.         HANDLE UniqueProcess;
     
701.         HANDLE UniqueThread;
     
702. } CLIENT_ID;
     
703. typedef CLIENT_ID *PCLIENT_ID;
     
704. 
     
705. typedef struct _SYSTEM_THREAD_INFORMATION
     
706. {
     
707.         LARGE_INTEGER KernelTime;
     
708.         LARGE_INTEGER UserTime;
     
709.         LARGE_INTEGER CreateTime;
     
710.         ULONG WaitTime;
     
711.         PVOID StartAddress;
     
712.         CLIENT_ID ClientId;
     
713.         KPRIORITY Priority;
     
714.         LONG BasePriority;
     
715.         ULONG ContextSwitches;
     
716.         ULONG ThreadState;
     
717.         ULONG WaitReason;
     
718. } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
     
719. 
     
720. typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION
     
721. {
     
722.         SYSTEM_THREAD_INFORMATION ThreadInfo;
     
723.         PVOID StackBase;
     
724.         PVOID StackLimit;
     
725.         PVOID Win32StartAddress;
     
726.         ULONG_PTR Reserved1;
     
727.         ULONG_PTR Reserved2;
     
728.         ULONG_PTR Reserved3;
     
729.         ULONG_PTR Reserved4;
     
730. } SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION;
     
731. 
     
732. typedef struct _SYSTEM_EXCEPTION_INFORMATION
     
733. {
     
734.         ULONG AlignmentFixupCount;
     
735.         ULONG ExceptionDispatchCount;
     
736.         ULONG FloatingEmulationCount;
     
737.         ULONG ByteWordEmulationCount;
     
738. } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION;
     
739. 
     
740. typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION
     
741. {
     
742.         BOOLEAN KernelDebuggerEnabled;
     
743.         BOOLEAN KernelDebuggerNotPresent;
     
744. } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION;
     
745. 
     
746. typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION
     
747. {
     
748.         ULONG ContextSwitches;
     
749.         ULONG FindAny;
     
750.         ULONG FindLast;
     
751.         ULONG FindIdeal;
     
752.         ULONG IdleAny;
     
753.         ULONG IdleCurrent;
     
754.         ULONG IdleLast;
     
755.         ULONG IdleIdeal;
     
756.         ULONG PreemptAny;
     
757.         ULONG PreemptCurrent;
     
758.         ULONG PreemptLast;
     
759.         ULONG SwitchToIdle;
     
760. } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION;
     
761. 
     
762. typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION
     
763. {
     
764.         ULONG  RegistryQuotaAllowed;
     
765.         ULONG  RegistryQuotaUsed;
     
766.         SIZE_T PagedPoolSize;
     
767. } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
     
768. 
     
769. typedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION
     
770. {
     
771.         ULONGLONG IdleTime;
     
772.         ULONGLONG C1Time;
     
773.         ULONGLONG C2Time;
     
774.         ULONGLONG C3Time;
     
775.         ULONG     C1Transitions;
     
776.         ULONG     C2Transitions;
     
777.         ULONG     C3Transitions;
     
778.         ULONG     Padding;
     
779. } SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION;
     
780. 
     
781. typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION
     
782. {
     
783.         ULONG VetoType;
     
784.         UNICODE_STRING VetoList;
     
785. } SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION;
     
786. 
     
787. typedef short CSHORT;
     
788. 
     
789. typedef struct _TIME_FIELDS
     
790. {
     
791.         CSHORT Year;        // range [1601...]
     
792.         CSHORT Month;       // range [1..12]
     
793.         CSHORT Day;         // range [1..31]
     
794.         CSHORT Hour;        // range [0..23]
     
795.         CSHORT Minute;      // range [0..59]
     
796.         CSHORT Second;      // range [0..59]
     
797.         CSHORT Milliseconds;// range [0..999]
     
798.         CSHORT Weekday;     // range [0..6] == [Sunday..Saturday]
     
799. } TIME_FIELDS;
     
800. 
     
801. typedef struct _RTL_TIME_ZONE_INFORMATION
     
802. {
     
803.         LONG Bias;
     
804.         WCHAR StandardName[32];
     
805.         TIME_FIELDS StandardStart;
     
806.         LONG StandardBias;
     
807.         WCHAR DaylightName[32];
     
808.         TIME_FIELDS DaylightStart;
     
809.         LONG DaylightBias;
     
810. } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION;
     
811. 
     
812. typedef struct _SYSTEM_LOOKASIDE_INFORMATION
     
813. {
     
814.         USHORT CurrentDepth;
     
815.         USHORT MaximumDepth;
     
816.         ULONG TotalAllocates;
     
817.         ULONG AllocateMisses;
     
818.         ULONG TotalFrees;
     
819.         ULONG FreeMisses;
     
820.         ULONG Type;
     
821.         ULONG Tag;
     
822.         ULONG Size;
     
823. } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION;
     
824. 
     
825. typedef struct _SYSTEM_VERIFIER_INFORMATION
     
826. {
     
827.         ULONG NextEntryOffset;
     
828.         ULONG Level;
     
829.         UNICODE_STRING DriverName;
     
830.         ULONG RaiseIrqls;
     
831.         ULONG AcquireSpinLocks;
     
832.         ULONG SynchronizeExecutions;
     
833.         ULONG AllocationsAttempted;
     
834.         ULONG AllocationsSucceeded;
     
835.         ULONG AllocationsSucceededSpecialPool;
     
836.         ULONG AllocationsWithNoTag;
     
837.         ULONG TrimRequests;
     
838.         ULONG Trims;
     
839.         ULONG AllocationsFailed;
     
840.         ULONG AllocationsFailedDeliberately;
     
841.         ULONG Loads;
     
842.         ULONG Unloads;
     
843.         ULONG UnTrackedPool;
     
844.         ULONG CurrentPagedPoolAllocations;
     
845.         ULONG CurrentNonPagedPoolAllocations;
     
846.         ULONG PeakPagedPoolAllocations;
     
847.         ULONG PeakNonPagedPoolAllocations;
     
848.         SIZE_T PagedPoolUsageInBytes;
     
849.         SIZE_T NonPagedPoolUsageInBytes;
     
850.         SIZE_T PeakPagedPoolUsageInBytes;
     
851.         SIZE_T PeakNonPagedPoolUsageInBytes;
     
852. } SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION;
     
853. 
     
854. typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION
     
855. {
     
856.         ULONG SessionId;
     
857.         ULONG SizeOfBuf;
     
858.         PVOID Buffer;
     
859. } SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION;
     
860. 
     
861. typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION
     
862. {
     
863.         SIZE_T NextEntryOffset;
     
864.         ULONG SessionId;
     
865.         ULONG Count;
     
866.         SYSTEM_POOLTAG TagInfo[1];
     
867. } SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION;
     
868. 
     
869. typedef struct _SYSTEM_NUMA_INFORMATION
     
870. {
     
871.         ULONG       HighestNodeNumber;
     
872.         ULONG       Reserved;
     
873.         union
     
874.         {
     
875.                 ULONGLONG   ActiveProcessorsAffinityMask[MAXIMUM_NUMA_NODES];
     
876.                 ULONGLONG   AvailableMemory[MAXIMUM_NUMA_NODES];
     
877.         };
     
878. } SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION;
     
879. 
     
880. typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION
     
881. {
     
882.         UCHAR       CurrentFrequency;
     
883.         UCHAR       ThermalLimitFrequency;
     
884.         UCHAR       ConstantThrottleFrequency;
     
885.         UCHAR       DegradedThrottleFrequency;
     
886.         UCHAR       LastBusyFrequency;
     
887.         UCHAR       LastC3Frequency;
     
888.         UCHAR       LastAdjustedBusyFrequency;
     
889.         UCHAR       ProcessorMinThrottle;
     
890.         UCHAR       ProcessorMaxThrottle;
     
891.         ULONG       NumberOfFrequencies;
     
892.         ULONG       PromotionCount;
     
893.         ULONG       DemotionCount;
     
894.         ULONG       ErrorCount;
     
895.         ULONG       RetryCount;
     
896.         ULONGLONG   CurrentFrequencyTime;
     
897.         ULONGLONG   CurrentProcessorTime;
     
898.         ULONGLONG   CurrentProcessorIdleTime;
     
899.         ULONGLONG   LastProcessorTime;
     
900.         ULONGLONG   LastProcessorIdleTime;
     
901. } SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION;
     
902. 
     
903. typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
     
904. {
     
905.         PVOID Object;
     
906.         ULONG_PTR UniqueProcessId;
     
907.         ULONG_PTR HandleValue;
     
908.         ULONG GrantedAccess;
     
909.         USHORT CreatorBackTraceIndex;
     
910.         USHORT ObjectTypeIndex;
     
911.         ULONG  HandleAttributes;
     
912.         ULONG  Reserved;
     
913. } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
     
914. 
     
915. typedef struct _SYSTEM_HANDLE_INFORMATION_EX
     
916. {
     
917.         ULONG_PTR NumberOfHandles;
     
918.         ULONG_PTR Reserved;
     
919.         SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
     
920. } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
     
921. 
     
922. typedef struct _SYSTEM_BIGPOOL_ENTRY
     
923. {
     
924.         union
     
925.         {
     
926.                 PVOID VirtualAddress;
     
927.                 ULONG_PTR NonPaged : 1;     // Set to 1 if entry is nonpaged.
     
928.         };
     
929.         SIZE_T SizeInBytes;
     
930.         union
     
931.         {
     
932.                 UCHAR Tag[4];
     
933.                 ULONG TagUlong;
     
934.         };
     
935. } SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY;
     
936. 
     
937. typedef struct _SYSTEM_BIGPOOL_INFORMATION
     
938. {
     
939.         ULONG Count;
     
940.         SYSTEM_BIGPOOL_ENTRY AllocatedInfo[1];
     
941. } SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION;
     
942. 
     
943. typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
     
944. {
     
945.         SIZE_T NextEntryOffset;
     
946.         ULONG SessionId;
     
947.         ULONG ViewFailures;
     
948.         SIZE_T NumberOfBytesAvailable;
     
949.         SIZE_T NumberOfBytesAvailableContiguous;
     
950. } SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION;
     
951. 
     
952. typedef enum _WATCHDOG_HANDLER_ACTION
     
953. {
     
954.         WdActionSetTimeoutValue,
     
955.         WdActionQueryTimeoutValue,
     
956.         WdActionResetTimer,
     
957.         WdActionStopTimer,
     
958.         WdActionStartTimer,
     
959.         WdActionSetTriggerAction,
     
960.         WdActionQueryTriggerAction,
     
961.         WdActionQueryState
     
962. } WATCHDOG_HANDLER_ACTION;
     
963. 
     
964. typedef enum _WATCHDOG_INFORMATION_CLASS
     
965. {
     
966.         WdInfoTimeoutValue,
     
967.         WdInfoResetTimer,
     
968.         WdInfoStopTimer,
     
969.         WdInfoStartTimer,
     
970.         WdInfoTriggerAction,
     
971.         WdInfoState
     
972. } WATCHDOG_INFORMATION_CLASS;
     
973. 
     
974. typedef NTSTATUS (*PWD_HANDLER)(IN WATCHDOG_HANDLER_ACTION Action, IN PVOID Context, IN OUT PULONG DataValue, IN BOOLEAN NoLocks);
     
975. 
     
976. typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION
     
977. {
     
978.         PWD_HANDLER WdHandler;
     
979.         PVOID       Context;
     
980. } SYSTEM_WATCHDOG_HANDLER_INFORMATION, *PSYSTEM_WATCHDOG_HANDLER_INFORMATION;
     
981. 
     
982. typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION
     
983. {
     
984.         WATCHDOG_INFORMATION_CLASS  WdInfoClass;
     
985.         ULONG                       DataValue;
     
986. } SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION;
     
987. 
     
988. typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP
     
989. {
     
990.         RelationProcessorCore,
     
991.         RelationNumaNode,
     
992.         RelationCache,
     
993.         RelationProcessorPackage,
     
994.         RelationGroup,
     
995.         RelationAll = 0xffff
     
996. } LOGICAL_PROCESSOR_RELATIONSHIP;
     
997. 
     
998. typedef enum _PROCESSOR_CACHE_TYPE
     
999. {
     
1000.         CacheUnified,
      
1001.         CacheInstruction,
      
1002.         CacheData,
      
1003.         CacheTrace
      
1004. } PROCESSOR_CACHE_TYPE;
      
1005. 
      
1006. typedef struct _CACHE_DESCRIPTOR
      
1007. {
      
1008.         BYTE   Level;
      
1009.         BYTE   Associativity;
      
1010.         WORD   LineSize;
      
1011.         DWORD  Size;
      
1012.         PROCESSOR_CACHE_TYPE Type;
      
1013. } CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR;
      
1014. 
      
1015. typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION
      
1016. {
      
1017.         ULONG_PTR   ProcessorMask;
      
1018.         LOGICAL_PROCESSOR_RELATIONSHIP Relationship;
      
1019.         union
      
1020.         {
      
1021.                 struct
      
1022.                 {
      
1023.                         BYTE  Flags;
      
1024.                 } ProcessorCore;
      
1025.                 struct
      
1026.                 {
      
1027.                         DWORD NodeNumber;
      
1028.                 } NumaNode;
      
1029.                 CACHE_DESCRIPTOR Cache;
      
1030.                 ULONGLONG  Reserved[2];
      
1031.         } DUMMYUNIONNAME;
      
1032. } SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION;
      
1033. 
      
1034. typedef enum _SYSTEM_FIRMWARE_TABLE_ACTION
      
1035. {
      
1036.         SystemFirmwareTable_Enumerate,
      
1037.         SystemFirmwareTable_Get
      
1038. } SYSTEM_FIRMWARE_TABLE_ACTION;
      
1039. 
      
1040. #ifndef ANYSIZE_ARRAY
      
1041. #define ANYSIZE_ARRAY 1       // winnt
      
1042. #endif
      
1043. 
      
1044. typedef struct _SYSTEM_FIRMWARE_TABLE_INFORMATION
      
1045. {
      
1046.         ULONG                           ProviderSignature;
      
1047.         SYSTEM_FIRMWARE_TABLE_ACTION    Action;
      
1048.         ULONG                           TableID;
      
1049.         ULONG                           TableBufferLength;
      
1050.         UCHAR                           TableBuffer[ANYSIZE_ARRAY];
      
1051. } SYSTEM_FIRMWARE_TABLE_INFORMATION, *PSYSTEM_FIRMWARE_TABLE_INFORMATION;
      
1052. 
      
1053. typedef NTSTATUS(__cdecl *PFNFTH)(PSYSTEM_FIRMWARE_TABLE_INFORMATION);
      
1054. 
      
1055. typedef struct _SYSTEM_FIRMWARE_TABLE_HANDLER
      
1056. {
      
1057.         ULONG       ProviderSignature;
      
1058.         BOOLEAN     Register;
      
1059.         PFNFTH      FirmwareTableHandler;
      
1060.         PVOID       DriverObject;
      
1061. } SYSTEM_FIRMWARE_TABLE_HANDLER, *PSYSTEM_FIRMWARE_TABLE_HANDLER;

复制代码

0xAA55

NtQuerySystemInforamtion.cpp:

1. #include "NtDefs.h"
   
2. #include <iostream>
   
3. #include <string>
   
4. 
   
5. #pragma comment(lib,"ntdll.lib")
   
6. using namespace std;
   
7. #define printseg(x) cout<<"\t"###x##":"<<x<<endl
   
8. 
   
9. typedef HANDLE HLOCAL;
   
10. 
    
11. extern "C"
    
12. {
    
13.         KSERVICE_TABLE_DESCRIPTOR* KeServiceDescriptorTableShadow;
    
14.         NTSTATUS __stdcall NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL);
    
15.         HLOCAL __stdcall LocalAlloc(IN UINT uFlags, SIZE_T uBytes);
    
16.         LPVOID __stdcall LocalLock(IN HLOCAL hMem);
    
17.         HLOCAL __stdcall LocalFree(IN HLOCAL hMem);
    
18. }
    
19. 
    
20. template<typename systeminfo>
    
21. void GetInformationTemplate(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,IN void (*GetCallBack)(systeminfo* si))
    
22. {
    
23.         ULONG retlen = 2;
    
24.         NTSTATUS status = STATUS_SUCCESS;
    
25.         HLOCAL hMem = NULL;
    
26. 
    
27.         status = NtQuerySystemInformation(SystemInformationClass, &status, sizeof(status), &retlen);
    
28.         switch (status)
    
29.         {
    
30.         case STATUS_INVALID_INFO_CLASS:
    
31.                 cout << "INVALID_INFO_CLASS" << endl;
    
32.                 return;
    
33.         case STATUS_ACCESS_VIOLATION:
    
34.                 cout << "ACCESS_VIOLATION" << endl;
    
35.                 return;
    
36.         case STATUS_INSUFFICIENT_RESOURCES:
    
37.                 cout << "INSUFFICIENT_RESOURCES" << endl;
    
38.                 return;
    
39.         case STATUS_WORKING_SET_QUOTA:
    
40.                 cout << "WORKING_SET_QUOTA" << endl;
    
41.                 return;
    
42.         case STATUS_NOT_IMPLEMENTED:
    
43.                 cout << "NOT_IMPLEMENTED" << endl;
    
44.                 return;
    
45.         case STATUS_INFO_LENGTH_MISMATCH:
    
46.                 do
    
47.                 {
    
48.                         hMem = LocalAlloc(0, retlen);
    
49.                         if (hMem)
    
50.                         {
    
51.                                 systeminfo* si = (systeminfo*)LocalLock(hMem);
    
52.                                 if (si)
    
53.                                 {
    
54.                                         memset(si, 0, retlen);
    
55.                                         status = NtQuerySystemInformation(SystemInformationClass, si, retlen, &retlen);
    
56.                                         if (NT_SUCCESS(status))
    
57.                                         {
    
58.                                                 GetCallBack(si);
    
59.                                         }
    
60.                                 }
    
61.                                 LocalFree(hMem);
    
62.                         }
    
63.                 } while (status == STATUS_INFO_LENGTH_MISMATCH);
    
64.                 return;
    
65.         case STATUS_SUCCESS:
    
66.                 break;
    
67.         default:
    
68.                 cout << "UNKNOWN ERROR" << endl;
    
69.                 return;
    
70.         }
    
71.        
    
72.         if (retlen < sizeof(systeminfo))
    
73.                 retlen = sizeof(systeminfo);
    
74.         cout << "structsize:" << sizeof(systeminfo) << " realsize:" << retlen << endl;
    
75.         hMem = LocalAlloc(0, retlen);
    
76.         if (hMem)
    
77.         {
    
78.                 systeminfo* si = (systeminfo*)LocalLock(hMem);
    
79.                 if (si)
    
80.                 {
    
81.                         memset(si, 0, retlen);
    
82.                         status = NtQuerySystemInformation(SystemInformationClass, si, retlen, &retlen);
    
83.                         if (NT_SUCCESS(status))
    
84.                         {
    
85.                                 GetCallBack(si);
    
86.                         }
    
87.                         else
    
88.                         {
    
89.                                 cout << "ERROR" << endl;
    
90.                         }
    
91.                 }
    
92.                 LocalFree(hMem);
    
93.         }
    
94. }
    
95. 
    
96. void GetSystemBasicInformation(SYSTEM_BASIC_INFORMATION* psbi)//0
    
97. {
    
98.         cout << "\t\t0 SystemBasicInformation" << endl;
    
99.         cout << "\t时间解析度ms:" << psbi->TimerResolution << endl;
    
100.         cout << "\t物理页大小:" << psbi->PageSize << endl;
     
101.         cout << "\t物理页个数:" << psbi->NumberOfPhysicalPages << endl;
     
102.         cout << "\t最小物理页个数:" << psbi->LowestPhysicalPageNumber << endl;
     
103.         cout << "\t最大物理页个数:" << psbi->HighestPhysicalPageNumber << endl;
     
104.         cout << "\t逻辑页大小:" << psbi->AllocationGranularity << endl;
     
105.         cout << "\t最小用户地址:" << psbi->MinimumUserModeAddress << endl;
     
106.         cout << "\t最大用户地址:" << psbi->MaximumUserModeAddress << endl;
     
107.         cout << "\t处理器个数:" << (int)psbi->NumberOfProcessors << endl;
     
108. }
     
109. 
     
110. void GetSystemProcessorInformation(SYSTEM_PROCESSOR_INFORMATION* pspri)//1
     
111. {        //                1 SystemProcessorInformation
     
112.         cout << "\t\t1 SystemProcessorInformation" << endl;
     
113.         switch (pspri->ProcessorArchitecture)
     
114.         {
     
115.         case PROCESSOR_ARCHITECTURE_INTEL:
     
116.                 cout << "\tINTEL ";
     
117.                 if (pspri->ProcessorLevel == 3)
     
118.                         cout << "386 ";
     
119.                 else if (pspri->ProcessorLevel == 4)
     
120.                         cout << "486 ";
     
121.                 else if (pspri->ProcessorLevel == 5)
     
122.                         cout << "586 or Pentium ";
     
123.                 break;
     
124.         case PROCESSOR_ARCHITECTURE_IA64:
     
125.                 cout << "\tIA64 ";
     
126.                 if (pspri->ProcessorLevel == 7)
     
127.                         cout << "Itanium ";
     
128.                 else if (pspri->ProcessorLevel == 31)
     
129.                         cout << "Itanium 2 ";
     
130.                 break;
     
131.         }
     
132.         cout << pspri->ProcessorRevision << " " << pspri->ProcessorFeatureBits<<endl;
     
133. }
     
134. 
     
135. void GetSystemPerformanceInformation(SYSTEM_PERFORMANCE_INFORMATION* pspei)//2
     
136. {
     
137.         cout << "\t\t2 SystemPerformanceInformation" << endl;
     
138.         cout << "\tIdle进程时间:" << pspei->IdleProcessTime.QuadPart << endl;
     
139.         cout << "\tIO读字节" << pspei->IoReadTransferCount.QuadPart << endl;
     
140.         cout << "\tIO写字节" << pspei->IoWriteTransferCount.QuadPart << endl;
     
141.         cout << "\tIO其他字节" << pspei->IoOtherTransferCount.QuadPart <<endl;
     
142.         cout << "\tIO读次数" << pspei->IoReadOperationCount << endl;
     
143.         cout << "\tIO写次数" << pspei->IoWriteOperationCount << endl;
     
144.         cout << "\tIO其他次数" << pspei->IoOtherOperationCount << endl;
     
145.         cout << "\t未用页" << pspei->AvailablePages << endl;
     
146.         cout << "\t已用页" << pspei->CommittedPages << endl;
     
147.         cout << "\t最多使用页" << pspei->CommitLimit << endl;
     
148.         cout << "\t已用页峰值" << pspei->PeakCommitment << endl;
     
149.         cout << "\t页错误数" << pspei->PageFaultCount << endl;
     
150.         cout << "\tCopyOnWrite数" << pspei->CopyOnWriteCount << endl;
     
151.         printseg(pspei->TransitionCount);
     
152.         printseg(pspei->CacheTransitionCount);
     
153.         printseg(pspei->DemandZeroCount);
     
154.         printseg(pspei->PageReadCount);
     
155.         printseg(pspei->PageReadIoCount);
     
156.         printseg(pspei->CacheReadCount);
     
157.         printseg(pspei->CacheIoCount);
     
158.         printseg(pspei->DirtyPagesWriteCount);
     
159.         printseg(pspei->DirtyWriteIoCount);
     
160.         printseg(pspei->MappedPagesWriteCount);
     
161.         printseg(pspei->MappedWriteIoCount);
     
162.         printseg(pspei->PagedPoolPages);
     
163.         printseg(pspei->NonPagedPoolPages);
     
164.         printseg(pspei->PagedPoolAllocs);
     
165.         printseg(pspei->PagedPoolFrees);
     
166.         printseg(pspei->NonPagedPoolAllocs);
     
167.         printseg(pspei->NonPagedPoolFrees);
     
168.         printseg(pspei->FreeSystemPtes);
     
169.         printseg(pspei->ResidentSystemCodePage);
     
170.         printseg(pspei->TotalSystemDriverPages);
     
171.         printseg(pspei->TotalSystemCodePages);
     
172.         printseg(pspei->NonPagedPoolLookasideHits);
     
173.         printseg(pspei->PagedPoolLookasideHits);
     
174.         printseg(pspei->AvailablePagedPoolPages);
     
175.         printseg(pspei->ResidentSystemCachePage);
     
176.         printseg(pspei->ResidentPagedPoolPage);
     
177.         printseg(pspei->ResidentSystemDriverPage);
     
178.         printseg(pspei->CcFastReadNoWait);
     
179.         printseg(pspei->CcFastReadWait);
     
180.         printseg(pspei->CcFastReadResourceMiss);
     
181.         printseg(pspei->CcFastReadNotPossible);
     
182.         printseg(pspei->CcFastMdlReadNoWait);
     
183.         printseg(pspei->CcFastMdlReadWait);
     
184.         printseg(pspei->CcFastMdlReadResourceMiss);
     
185.         printseg(pspei->CcFastMdlReadNotPossible);
     
186.         printseg(pspei->CcMapDataNoWait);
     
187.         printseg(pspei->CcMapDataWait);
     
188.         printseg(pspei->CcMapDataNoWaitMiss);
     
189.         printseg(pspei->CcMapDataWaitMiss);
     
190.         printseg(pspei->CcPinMappedDataCount);
     
191.         printseg(pspei->CcPinReadNoWait);
     
192.         printseg(pspei->CcPinReadWait);
     
193.         printseg(pspei->CcPinReadNoWaitMiss);
     
194.         printseg(pspei->CcPinReadWaitMiss);
     
195.         printseg(pspei->CcCopyReadNoWait);
     
196.         printseg(pspei->CcCopyReadWait);
     
197.         printseg(pspei->CcCopyReadNoWaitMiss);
     
198.         printseg(pspei->CcCopyReadWaitMiss);
     
199.         printseg(pspei->CcMdlReadNoWait);
     
200.         printseg(pspei->CcMdlReadWait);
     
201.         printseg(pspei->CcMdlReadNoWaitMiss);
     
202.         printseg(pspei->CcMdlReadWaitMiss);
     
203.         printseg(pspei->CcReadAheadIos);
     
204.         printseg(pspei->CcLazyWriteIos);
     
205.         printseg(pspei->CcLazyWritePages);
     
206.         printseg(pspei->CcDataFlushes);
     
207.         printseg(pspei->CcDataPages);
     
208.         printseg(pspei->ContextSwitches);
     
209.         printseg(pspei->FirstLevelTbFills);
     
210.         printseg(pspei->SecondLevelTbFills);
     
211.         printseg(pspei->SystemCalls);
     
212. }
     
213. 
     
214. void GetSystemTimeOfDayInformation(SYSTEM_TIMEOFDAY_INFORMATION* psti)//3
     
215. {
     
216.         cout << "\t\t3 SystemTimeOfDayInformation" << endl;
     
217.         cout << "\t启动时间:" << psti->BootTime.QuadPart << endl;
     
218.         cout << "\t当前时间:" << psti->CurrentTime.QuadPart << endl;
     
219.         printseg(psti->TimeZoneBias.QuadPart);
     
220.         printseg(psti->TimeZoneId);
     
221.         printseg(psti->BootTimeBias);
     
222.         printseg(psti->SleepTimeBias);
     
223. }
     
224. 
     
225. // void GetSystemPathInformation(SYSTEM_PATH_INFORMATION* pspi)//4
     
226. // {
     
227. // }
     
228. 
     
229. void GetSystemProcessInformation(SYSTEM_PROCESS_INFORMATION* pspri1)//5
     
230. {
     
231.         cout << "\t\t5 SystemProcessInformation" << endl;
     
232.         do
     
233.         {
     
234.                 if (pspri1->ImageName.Buffer)
     
235.                         wcout << "\tImageName:" << wstring((wchar_t*)pspri1->ImageName.Buffer) << endl;
     
236.                 else
     
237.                         wcout << "\tno name" << endl;
     
238.                 cout << "\t线程数:" << pspri1->NumberOfThreads << endl;
     
239.                 printseg(pspri1->SpareLi1.QuadPart);
     
240.                 printseg(pspri1->SpareLi2.QuadPart);
     
241.                 printseg(pspri1->SpareLi3.QuadPart);
     
242.                 cout << "\t创建时间:" << pspri1->CreateTime.QuadPart << endl;
     
243.                 cout << "\t用户态时间:" << pspri1->UserTime.QuadPart << endl;
     
244.                 cout << "\t内核态时间:" << pspri1->KernelTime.QuadPart << endl;
     
245.                 cout << "\t基础优先级:" << pspri1->BasePriority << endl;
     
246.                 cout << "\t进程Id:" << (int)pspri1->UniqueProcessId << endl;
     
247.                 cout << "\t父进程Id:" << (int)pspri1->InheritedFromUniqueProcessId << endl;
     
248.                 cout << "\t句柄数:" << pspri1->HandleCount << endl;
     
249.                 cout << "\t会话Id:" << pspri1->SessionId << endl;
     
250.                 cout << "\t页目录机制:" << pspri1->PageDirectoryBase << endl;
     
251.                 cout << "\t虚拟内存峰值:" << pspri1->PeakVirtualSize << endl;
     
252.                 cout << "\t虚拟内存大小:" << pspri1->VirtualSize << endl;
     
253.                 cout << "\t页错误数:" << pspri1->PageFaultCount << endl;
     
254.                 cout << "\t物理内存峰值:" << pspri1->PeakWorkingSetSize << endl;
     
255.                 cout << "\t物理内存大小:" << pspri1->WorkingSetSize << endl;
     
256.                 cout << "\t分页池配额峰值:" << pspri1->QuotaPeakPagedPoolUsage << endl;
     
257.                 cout << "\t分页池配额:" << pspri1->QuotaPagedPoolUsage << endl;
     
258.                 cout << "\t非分页池配额峰值:" << pspri1->QuotaPeakNonPagedPoolUsage << endl;
     
259.                 cout << "\t非分页池配额:" << pspri1->QuotaNonPagedPoolUsage << endl;
     
260.                 cout << "\t页面文件使用:" << pspri1->PagefileUsage << endl;
     
261.                 cout << "\t页面文件使用峰值:" << pspri1->PeakPagefileUsage << endl;
     
262.                 cout << "\t私有页面数:" << pspri1->PrivatePageCount << endl;
     
263.                 cout << "\t读操作数:" << pspri1->ReadOperationCount.QuadPart << endl;
     
264.                 cout << "\t写操作数:" << pspri1->WriteOperationCount.QuadPart << endl;
     
265.                 cout << "\t其他操作数:" << pspri1->OtherOperationCount.QuadPart << endl;
     
266.                 cout << "\t读字节数:" << pspri1->ReadTransferCount.QuadPart << endl;
     
267.                 cout << "\t写字节数:" << pspri1->WriteTransferCount.QuadPart << endl;
     
268.                 cout << "\t其他字节数:" << pspri1->OtherTransferCount.QuadPart << endl;
     
269.                 SYSTEM_PROCESS_INFORMATION* newpspri1 = (SYSTEM_PROCESS_INFORMATION*)((BYTE*)pspri1 + pspri1->NextEntryOffset);
     
270.                 SYSTEM_THREAD_INFORMATION* pesti = (SYSTEM_THREAD_INFORMATION*)(pspri1 + 1);
     
271.                 int threadindex = 0;
     
272.                 while ((LPVOID)pesti < (LPVOID)newpspri1)
     
273.                 {
     
274.                         ++threadindex;
     
275.                         cout << "\t内核态时间:" << pesti->KernelTime.QuadPart << endl;
     
276.                         cout << "\t用户态时间:" << pesti->UserTime.QuadPart << endl;
     
277.                         cout << "\t创建时间:" << pesti->CreateTime.QuadPart << endl;
     
278.                         cout << "\t等待时间:" << pesti->WaitTime << endl;
     
279.                         cout << "\t起始地址:" << hex << pesti->StartAddress << endl;
     
280.                         cout << "\tUniqueProcess:" << hex << pesti->ClientId.UniqueProcess << endl;
     
281.                         cout << "\tUniqueThread:" << hex << pesti->ClientId.UniqueThread << endl;
     
282.                         cout << dec;
     
283.                         cout << "\t优先级:" << pesti->Priority << endl;
     
284.                         cout << "\t基础优先级:" << pesti->BasePriority << endl;
     
285.                         cout << "\t模式切换次数:" << pesti->ContextSwitches << endl;
     
286.                         cout << "\t线程状态:" << pesti->ThreadState << endl;
     
287.                         cout << "\t等待原因:" << pesti->WaitReason << endl;
     
288.                         cout << dec;
     
289.                         pesti++;
     
290.                 }
     
291.                 pspri1 = newpspri1;
     
292.         } while (pspri1->NextEntryOffset);
     
293. }
     
294. 
     
295. void GetSystemCallCountInformation(SYSTEM_CALL_COUNT_INFORMATION* pscci)//6
     
296. {
     
297.         cout << "\t\t6 SystemCallCountInformation" << endl;
     
298.         printseg(pscci->Length);
     
299.         printseg(pscci->NumberOfTables);
     
300.         ULONG* limits = (ULONG*)((BYTE*)pscci + sizeof(SYSTEM_CALL_COUNT_INFORMATION));
     
301.         ULONG* tables = (ULONG*)((BYTE*)pscci + sizeof(SYSTEM_CALL_COUNT_INFORMATION)+pscci->NumberOfTables*sizeof(PULONG));
     
302.         int index = 0;
     
303.         for (int i = 0; i < pscci->NumberOfTables; i++)
     
304.         {
     
305.                 for (int j = 0; j < limits[i]; j++)
     
306.                 {
     
307.                         cout << "tablecount" << index << ":" << tables[index] << endl;
     
308.                         ++index;
     
309.                 }
     
310.         }
     
311. }
     
312. 
     
313. void GetSystemDeviceInformation(SYSTEM_DEVICE_INFORMATION* psdi)//7
     
314. {
     
315.         cout << "\t\t7 SystemDeviceInformation" << endl;
     
316.         cout << "\t磁盘数:" << psdi->NumberOfDisks << endl;
     
317.         cout << "\t软盘数:" << psdi->NumberOfFloppies << endl;
     
318.         cout << "\t光驱数:" << psdi->NumberOfCdRoms << endl;
     
319.         cout << "\t磁带数:" << psdi->NumberOfTapes << endl;
     
320.         cout << "\t串行端口数:" << psdi->NumberOfSerialPorts << endl;
     
321.         cout << "\t并行端口数:" << psdi->NumberOfParallelPorts << endl;
     
322. }
     
323. 
     
324. void GetSystemProcessorPerformanceInformation(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION* psppei)//8
     
325. {
     
326.         cout << "\t\t8 SystemProcessorPerformanceInformation" << endl;
     
327.         cout << "\t空闲时间:" << psppei->IdleTime.QuadPart << endl;
     
328.         cout << "\t内核态时间:" << psppei->KernelTime.QuadPart << endl;
     
329.         cout << "\t用户态时间:" << psppei->UserTime.QuadPart << endl;
     
330.         cout << "\tDPC时间:" << psppei->DpcTime.QuadPart << endl;
     
331.         cout << "\t中断时间:" << psppei->InterruptTime.QuadPart << endl;
     
332.         cout << "\t中断次数:" << psppei->InterruptCount << endl;
     
333. }
     
334. 
     
335. void GetSystemFlagsInformation(SYSTEM_FLAGS_INFORMATION* psfi)//9
     
336. {
     
337.                 cout << "\t\t9 SystemFlagsInformation" << endl;
     
338.                 if (psfi->Flags&FLG_STOP_ON_EXCEPTION)
     
339.                         cout << "FLG_STOP_ON_EXCEPTION" << endl;
     
340.                 if (psfi->Flags&FLG_SHOW_LDR_SNAPS)
     
341.                         cout << "FLG_SHOW_LDR_SNAPS" << endl;
     
342.                 if (psfi->Flags&FLG_DEBUG_INITIAL_COMMAND)
     
343.                         cout << "FLG_DEBUG_INITIAL_COMMAND" << endl;
     
344.                 if (psfi->Flags&FLG_STOP_ON_HUNG_GUI)
     
345.                         cout << "FLG_STOP_ON_HUNG_GUI" << endl;
     
346. 
     
347.                 if (psfi->Flags&FLG_HEAP_ENABLE_TAIL_CHECK)
     
348.                         cout << "FLG_HEAP_ENABLE_TAIL_CHECK" << endl;
     
349.                 if (psfi->Flags&FLG_HEAP_ENABLE_FREE_CHECK)
     
350.                         cout << "FLG_HEAP_ENABLE_FREE_CHECK" << endl;
     
351.                 if (psfi->Flags&FLG_HEAP_VALIDATE_PARAMETERS)
     
352.                         cout << "FLG_HEAP_VALIDATE_PARAMETERS" << endl;
     
353.                 if (psfi->Flags&FLG_HEAP_VALIDATE_ALL)
     
354.                         cout << "FLG_HEAP_VALIDATE_ALL" << endl;
     
355. 
     
356.                 if (psfi->Flags&FLG_APPLICATION_VERIFIER)
     
357.                         cout << "FLG_APPLICATION_VERIFIER" << endl;
     
358.                 if (psfi->Flags&FLG_POOL_ENABLE_TAGGING)
     
359.                         cout << "FLG_POOL_ENABLE_TAGGING" << endl;
     
360.                 if (psfi->Flags&FLG_HEAP_ENABLE_TAGGING)
     
361.                         cout << "FLG_HEAP_ENABLE_TAGGING" << endl;
     
362. 
     
363.                 if (psfi->Flags&FLG_USER_STACK_TRACE_DB)
     
364.                         cout << "FLG_USER_STACK_TRACE_DB" << endl;
     
365.                 if (psfi->Flags&FLG_KERNEL_STACK_TRACE_DB)
     
366.                         cout << "FLG_KERNEL_STACK_TRACE_DB" << endl;
     
367.                 if (psfi->Flags&FLG_MAINTAIN_OBJECT_TYPELIST)
     
368.                         cout << "FLG_MAINTAIN_OBJECT_TYPELIST" << endl;
     
369.                 if (psfi->Flags&FLG_HEAP_ENABLE_TAG_BY_DLL)
     
370.                         cout << "FLG_HEAP_ENABLE_TAG_BY_DLL" << endl;
     
371. 
     
372.                 if (psfi->Flags&FLG_DISABLE_STACK_EXTENSION)
     
373.                         cout << "FLG_DISABLE_STACK_EXTENSION" << endl;
     
374.                 if (psfi->Flags&FLG_ENABLE_CSRDEBUG)
     
375.                         cout << "FLG_ENABLE_CSRDEBUG" << endl;
     
376.                 if (psfi->Flags&FLG_ENABLE_KDEBUG_SYMBOL_LOAD)
     
377.                         cout << "FLG_ENABLE_KDEBUG_SYMBOL_LOAD" << endl;
     
378.                 if (psfi->Flags&FLG_DISABLE_PAGE_KERNEL_STACKS)
     
379.                         cout << "FLG_DISABLE_PAGE_KERNEL_STACKS" << endl;
     
380. 
     
381.                 if (psfi->Flags&FLG_ENABLE_SYSTEM_CRIT_BREAKS)
     
382.                         cout << "FLG_ENABLE_SYSTEM_CRIT_BREAKS" << endl;
     
383.                 if (psfi->Flags&FLG_HEAP_DISABLE_COALESCING)
     
384.                         cout << "FLG_HEAP_DISABLE_COALESCING" << endl;
     
385.                 if (psfi->Flags&FLG_ENABLE_CLOSE_EXCEPTIONS)
     
386.                         cout << "FLG_ENABLE_CLOSE_EXCEPTIONS" << endl;
     
387.                 if (psfi->Flags&FLG_ENABLE_EXCEPTION_LOGGING)
     
388.                         cout << "FLG_ENABLE_EXCEPTION_LOGGING" << endl;
     
389. 
     
390.                 if (psfi->Flags&FLG_ENABLE_HANDLE_TYPE_TAGGING)
     
391.                         cout << "FLG_ENABLE_HANDLE_TYPE_TAGGING" << endl;
     
392.                 if (psfi->Flags&FLG_HEAP_PAGE_ALLOCS)
     
393.                         cout << "FLG_HEAP_PAGE_ALLOCS" << endl;
     
394.                 if (psfi->Flags&FLG_DEBUG_INITIAL_COMMAND_EX)
     
395.                         cout << "FLG_DEBUG_INITIAL_COMMAND_EX" << endl;
     
396.                 if (psfi->Flags&FLG_DISABLE_DBGPRINT)
     
397.                         cout << "FLG_DISABLE_DBGPRINT" << endl;
     
398. 
     
399.                 if (psfi->Flags&FLG_CRITSEC_EVENT_CREATION)
     
400.                         cout << "FLG_CRITSEC_EVENT_CREATION" << endl;
     
401.                 if (psfi->Flags&FLG_LDR_TOP_DOWN)
     
402.                         cout << "FLG_LDR_TOP_DOWN" << endl;
     
403.                 if (psfi->Flags&FLG_ENABLE_HANDLE_EXCEPTIONS)
     
404.                         cout << "FLG_ENABLE_HANDLE_EXCEPTIONS" << endl;
     
405.                 if (psfi->Flags&FLG_DISABLE_PROTDLLS)
     
406.                         cout << "FLG_DISABLE_PROTDLLS" << endl;
     
407. }
     
408. 
     
409. // void GetSystemCallTimeInformation(SYSTEM_CALLTIME_INFORMATION* pscti)
     
410. // {
     
411. // }
     
412. 
     
413. void GetSystemModuleInformation(RTL_PROCESS_MODULES* prpm)//11
     
414. {
     
415.         cout << "\t\t11 SystemModuleInformation" << endl;
     
416.         for (int i = 0; i < prpm->NumberOfModules; i++)
     
417.         {
     
418.                 cout << "module" << i << " FullPathName:" << (char*)prpm->Modules[i].FullPathName << endl;
     
419.                 cout << "\tSection:" << hex << prpm->Modules[i].Section << endl;
     
420.                 cout << "\tMappedBase:" << hex << prpm->Modules[i].MappedBase << endl;
     
421.                 cout << "\tImageBase:" << hex << prpm->Modules[i].ImageBase << endl;
     
422.                 cout << "\tImageSize:" << hex << prpm->Modules[i].ImageSize << endl;
     
423.                 cout << "\tFlags:" << hex << prpm->Modules[i].Flags << endl;
     
424.                 cout << dec;
     
425.                 cout << "\tLoadOrderIndex:" << (int)prpm->Modules[i].LoadOrderIndex << endl;
     
426.                 cout << "\tInitOrderIndex:" << (int)prpm->Modules[i].InitOrderIndex << endl;
     
427.                 cout << "\tLoadCount:" << (int)prpm->Modules[i].LoadCount << endl;
     
428.                 cout << "\tOffsetToFile:" << prpm->Modules[i].OffsetToFileName << endl;//距离文件名偏移(取最后一个\之后的部分)       
     
429.         }
     
430. }
     
431. 
     
432. void GetSystemLocksInformation(RTL_PROCESS_LOCKS* prpl)//12
     
433. {
     
434.         cout << "\t\t12 SystemLocksInformation" << endl;
     
435.         for (int i = 0; i < prpl->NumberOfLocks; i++)
     
436.         {
     
437.                 cout << "\tlock" << i << ":" << endl;
     
438.                 cout << "\tAddress:" << hex << prpl->Locks[i].Address << endl;
     
439.                 cout << "\tOwningThread:" << hex << prpl->Locks[i].OwningThread << endl;
     
440.                 cout << dec;
     
441.                 cout << "\tType:" << (int)prpl->Locks[i].Type << endl;
     
442.                 cout << "\tCreatorBackTraceIndex:" << (int)prpl->Locks[i].CreatorBackTraceIndex << endl;
     
443.                 cout << "\tLockCount:" << prpl->Locks[i].LockCount << endl;
     
444.                 cout << "\tContentionCount:" << prpl->Locks[i].ContentionCount << endl;
     
445.                 cout << "\tEntryCount:" << prpl->Locks[i].EntryCount << endl;
     
446.                 cout << "\tRecursionCount:" << prpl->Locks[i].RecursionCount << endl;
     
447.                 cout << "\tNumberOfWaitingShared:" << prpl->Locks[i].NumberOfWaitingShared << endl;
     
448.                 cout << "\tNumberOfWaitingExclusive:" << prpl->Locks[i].NumberOfWaitingExclusive << endl;
     
449.         }
     
450. }
     
451. 
     
452. void GetSystemStackTraceInformation(RTL_PROCESS_BACKTRACES* prpb)//13
     
453. {
     
454.         cout << "\t\t13 SystemStackTraceInformation" << endl;
     
455.         cout << "\tCommittedMemory:" << prpb->CommittedMemory << endl;
     
456.         cout << "\tReservedMemory:" << prpb->ReservedMemory << endl;
     
457.         cout << "\tNumberOfBackTraceLookups:" << prpb->NumberOfBackTraceLookups << endl;
     
458.         for (int i = 0; i < prpb->NumberOfBackTraces; i++)
     
459.         {
     
460.                 cout << "\tTraceCount:" << prpb->BackTraces[i].TraceCount << endl;
     
461.                 cout << "\tIndex:" << prpb->BackTraces[i].Index << endl;
     
462.                 cout << "\tDepth:" << prpb->BackTraces[i].Depth << endl;
     
463.                 for (int j = 0; j < MAX_STACK_DEPTH; j++)
     
464.                 {
     
465.                         cout << "\t" << hex << prpb->BackTraces[i].BackTrace[i] << endl;
     
466.                 }
     
467.         }
     
468. }
     
469. 
     
470. // void GetSystemPagedPoolInformation(SYSTEM_POOL_INFORMATION* pspi)//14
     
471. // {
     
472. // }
     
473. 
     
474. // void GetSystemNonPagedPoolInformation(SYSTEM_POOL_INFORMATION* pspi)//15
     
475. // {
     
476. // }
     
477. 
     
478. void GetSystemHandleInformation(SYSTEM_HANDLE_INFORMATION* pshi)//16
     
479. {
     
480.         cout << "\t\t16 SystemHandleInformation" << endl;
     
481.         for (int i = 0; i < pshi->NumberOfHandles; i++)
     
482.         {
     
483.                 cout << "\t" << i + 1 << endl;
     
484.                 cout << "\tUniqueProcessId:" << (int)pshi->Handles[i].UniqueProcessId << endl;
     
485.                 cout << "\tCreatorBackTraceIndex:" << (int)pshi->Handles[i].CreatorBackTraceIndex << endl;
     
486.                 cout << "\tObjectTypeIndex:" << (int)pshi->Handles[i].ObjectTypeIndex << endl;
     
487.                 cout << "\tHandleAttributes:" << (int)pshi->Handles[i].HandleAttributes << endl;
     
488.                 cout << "\tHandleValue:" << (int)pshi->Handles[i].HandleValue << endl;
     
489.                 cout << "\tObject:" << hex << (int)pshi->Handles[i].Object << endl;
     
490.                 cout << "\tGrantedAccess:" << hex << (int)pshi->Handles[i].GrantedAccess << endl;
     
491.         }
     
492. }
     
493. 
     
494. void GetSystemObjectInformation(SYSTEM_OBJECTTYPE_INFORMATION* pstoi)//17
     
495. {
     
496.         cout << "\t\t17 SystemObjectInformation" << endl;
     
497.         int nextpos = pstoi->NextEntryOffset;
     
498.         SYSTEM_OBJECT_INFORMATION* curpsoi = NULL;
     
499.         do
     
500.         {
     
501.                 cout << "\tNumberOfObjects:" << pstoi->NumberOfObjects << endl;
     
502.                 cout << "\tNumberOfHandles:" << pstoi->NumberOfHandles << endl;
     
503.                 cout << "\tTypeIndex:" << pstoi->TypeIndex << endl;
     
504.                 cout << "\tInvalidAttributes:" << hex << pstoi->InvalidAttributes << endl;
     
505.                 cout << "\tValidAccessMask:" << hex << pstoi->ValidAccessMask << endl;
     
506.                 cout << dec;
     
507.                 cout << "\tPoolType:" << pstoi->PoolType << endl;
     
508.                 cout << "\tSecurityRequired:" << pstoi->SecurityRequired << endl;
     
509.                 cout << "\tWaitableObject:" << pstoi->WaitableObject << endl;
     
510.                 wcout << "\tTypeName:" << (wchar_t*)pstoi->TypeName.Buffer << endl;
     
511.                 curpsoi = (SYSTEM_OBJECT_INFORMATION*)((PWSTR)(pstoi + 1) + pstoi->TypeName.MaximumLength);
     
512.                 cout << "\tObject:" << hex << curpsoi->Object << endl;
     
513.                 cout << "\tCreatorUniqueProcess:" << hex << curpsoi->CreatorUniqueProcess << endl;
     
514.                 cout << "\tCreatorBackTraceIndex:" << hex << curpsoi->CreatorBackTraceIndex << endl;
     
515.                 cout << "\tFlags" << hex << curpsoi->Flags << endl;
     
516.                 cout << "\tExclusiveProcessId:" << hex << curpsoi->ExclusiveProcessId << endl;
     
517.                 cout << "\tSecurityDescriptor:" << hex << curpsoi->SecurityDescriptor << endl;
     
518.                 cout << dec;
     
519.                 cout << "\tPointerCount:" << curpsoi->PointerCount << endl;
     
520.                 cout << "\tHandleCount:" << curpsoi->HandleCount << endl;
     
521.                 cout << "\tPagedPoolCharge:" << curpsoi->PagedPoolCharge << endl;
     
522.                 cout << "\tNonPagedPoolCharge:" << curpsoi->NonPagedPoolCharge << endl;
     
523.                 wcout << "\tNameInfo:" << (wchar_t*)curpsoi->NameInfo.Name.Buffer << endl;
     
524.                 pstoi = (SYSTEM_OBJECTTYPE_INFORMATION*)((BYTE*)pstoi + pstoi->NextEntryOffset);
     
525.         } while (nextpos);
     
526. }
     
527. 
     
528. void GetSystemPageFileInformation(SYSTEM_PAGEFILE_INFORMATION* pspi)//18
     
529. {
     
530.         cout << "\t\t18 SystemPageFileInformation" << endl;
     
531.         ULONG nextoffset = 0;
     
532.         int index = 0;
     
533.         do
     
534.         {
     
535.                 cout << "PAGEFILE" << index + 1 << ":" << endl;
     
536.                 nextoffset = pspi->NextEntryOffset;
     
537.                 cout << "\tTotalSize:" << pspi->TotalSize << endl;
     
538.                 cout << "\tTotalInUse:" << pspi->TotalInUse << endl;
     
539.                 cout << "\tPeakUsage:" << pspi->PeakUsage << endl;
     
540.                 cout << "\tPageFileName:" << (wchar_t*)pspi->PageFileName.Buffer << endl;
     
541.                 pspi = (SYSTEM_PAGEFILE_INFORMATION*)((BYTE*)pspi + pspi->NextEntryOffset);
     
542.         } while (nextoffset);
     
543. }
     
544. 
     
545. void GetSystemVdmInstemulInformation(SYSTEM_VDM_INSTEMUL_INFO* psvii)//19
     
546. {
     
547.         cout << "\t\t19 SystemVdmInstemulInformation" << endl;
     
548.         printseg(psvii->SegmentNotPresent);
     
549.         printseg(psvii->VdmOpcode0F);
     
550.         printseg(psvii->OpcodeESPrefix);
     
551.         printseg(psvii->OpcodeCSPrefix);
     
552.         printseg(psvii->OpcodeSSPrefix);
     
553.         printseg(psvii->OpcodeDSPrefix);
     
554.         printseg(psvii->OpcodeFSPrefix);
     
555.         printseg(psvii->OpcodeGSPrefix);
     
556.         printseg(psvii->OpcodeOPER32Prefix);
     
557.         printseg(psvii->OpcodeADDR32Prefix);
     
558.         printseg(psvii->OpcodeINSB);
     
559.         printseg(psvii->OpcodeINSW);
     
560.         printseg(psvii->OpcodeOUTSB);
     
561.         printseg(psvii->OpcodeOUTSW);
     
562.         printseg(psvii->OpcodePUSHF);
     
563.         printseg(psvii->OpcodePOPF);
     
564.         printseg(psvii->OpcodeINTnn);
     
565.         printseg(psvii->OpcodeINTO);
     
566.         printseg(psvii->OpcodeIRET);
     
567.         printseg(psvii->OpcodeINBimm);
     
568.         printseg(psvii->OpcodeINWimm);
     
569.         printseg(psvii->OpcodeOUTBimm);
     
570.         printseg(psvii->OpcodeOUTWimm);
     
571.         printseg(psvii->OpcodeINB);
     
572.         printseg(psvii->OpcodeINW);
     
573.         printseg(psvii->OpcodeOUTB);
     
574.         printseg(psvii->OpcodeOUTW);
     
575.         printseg(psvii->OpcodeLOCKPrefix);
     
576.         printseg(psvii->OpcodeREPPrefix);
     
577.         printseg(psvii->OpcodeREPPrefix);
     
578.         printseg(psvii->OpcodeHLT);
     
579.         printseg(psvii->OpcodeCLI);
     
580.         printseg(psvii->OpcodeSTI);
     
581.         printseg(psvii->BopCount);
     
582. }
     
583. 
     
584. // void GetSystemVdmBopInformation(SYSTEM_VDM_BOP_INFO* psvbi)//20
     
585. // {
     
586. //
     
587. // }
     
588. 
     
589. void GetSystemFileCacheInformation(SYSTEM_FILECACHE_INFORMATION* psfci)//21
     
590. {
     
591.         cout << "\t\t21 SystemFileCacheInformation" << endl;
     
592.         printseg(psfci->CurrentSize);
     
593.         printseg(psfci->PeakSize);
     
594.         printseg(psfci->PageFaultCount);
     
595.         printseg(psfci->MinimumWorkingSet);
     
596.         printseg(psfci->MaximumWorkingSet);
     
597.         printseg(psfci->CurrentSizeIncludingTransitionInPages);
     
598.         printseg(psfci->PeakSizeIncludingTransitionInPages);
     
599.         printseg(psfci->TransitionRePurposeCount);
     
600.         printseg(psfci->Flags);
     
601. }
     
602. 
     
603. void GetSystemPoolTagInformation(SYSTEM_POOLTAG_INFORMATION* pspti)//22
     
604. {
     
605.         cout << "\t\t22 SystemPoolTagInformation" << endl;
     
606.         for (int i = 0; i < pspti->Count; i++)
     
607.         {
     
608.                 cout << pspti->TagInfo[i].TagUlong << endl;
     
609.                 cout << pspti->TagInfo[i].PagedAllocs << endl;
     
610.                 cout << pspti->TagInfo[i].PagedFrees << endl;
     
611.                 cout << pspti->TagInfo[i].PagedUsed << endl;
     
612.                 cout << pspti->TagInfo[i].NonPagedAllocs << endl;
     
613.                 cout << pspti->TagInfo[i].NonPagedFrees << endl;
     
614.                 cout << pspti->TagInfo[i].NonPagedUsed << endl;
     
615.         }
     
616. }
     
617. 
     
618. void GetSystemInterruptInformation(SYSTEM_INTERRUPT_INFORMATION* psii)//23
     
619. {
     
620.         cout << "\t\t23 SystemInterruptInformation" << endl;
     
621.         printseg(psii->ContextSwitches);
     
622.         printseg(psii->DpcCount);
     
623.         printseg(psii->DpcRate);
     
624.         printseg(psii->TimeIncrement);
     
625.         printseg(psii->DpcBypassCount);
     
626.         printseg(psii->ApcBypassCount);
     
627. }
     
628. 
     
629. void GetSystemDpcBehaviorInformation(SYSTEM_DPC_BEHAVIOR_INFORMATION* psdbi)//24
     
630. {
     
631.         cout << "\t\t24 SystemDpcBehaviorInformation" << endl;
     
632.         printseg(psdbi->Spare);
     
633.         printseg(psdbi->DpcQueueDepth);
     
634.         printseg(psdbi->MinimumDpcRate);
     
635.         printseg(psdbi->AdjustDpcThreshold);
     
636.         printseg(psdbi->IdealDpcRate);
     
637. }
     
638. 
     
639. void GetSystemFullMemoryInformation(SYSTEM_MEMORY_INFORMATION* psmi)//25
     
640. {
     
641.         cout << "\t\t25 SystemFullMemoryInformation" << endl;
     
642.         printseg(psmi->StringStart);
     
643.         for (int i = 0; i < psmi->InfoSize; i++)
     
644.         {
     
645.                 cout << (char*)psmi->Memory[i].StringOffset << endl;
     
646.                 printseg((int)psmi->Memory[i].ValidCount);
     
647.                 printseg((int)psmi->Memory[i].TransitionCount);
     
648.                 printseg((int)psmi->Memory[i].ModifiedCount);
     
649.                 printseg((int)psmi->Memory[i].PageTableCount);
     
650.         }
     
651. }
     
652. 
     
653. void GetSystemLoadGdiDriverInformation(SYSTEM_GDI_DRIVER_INFORMATION* psgdi)//26
     
654. {
     
655.         cout << "\t\t26 SystemLoadGdiDriverInformation" << endl;
     
656.         wcout << psgdi->DriverName.Buffer << endl;
     
657.         cout << "\tImageLength:" << psgdi->ImageLength << endl;
     
658.         cout << "\tImageAddress:" << hex << psgdi->ImageAddress << endl;
     
659.         cout << "\tSectionPointer:" << hex << psgdi->SectionPointer << endl;
     
660.         cout << "\tEntryPoint:" << hex << psgdi->EntryPoint << endl;
     
661. }
     
662. 
     
663. // void GetSystemUnloadGdiDriverInformation(SYSTEM_UNLOAD_GDIDRIVER_INFORMATION)//27
     
664. // {
     
665. //
     
666. // }
     
667. 
     
668. void GetSystemTimeAdjustmentInformation(SYSTEM_SET_TIME_ADJUST_INFORMATION* psstai)//28
     
669. {
     
670.         cout << "\t\t28 SystemTimeAdjustmentInformation" << endl;
     
671.         cout << "\tTimeAdjustment:" << psstai->TimeAdjustment << endl;
     
672.         cout << "\tEnable:" << psstai->Enable << endl;
     
673. }
     
674. 
     
675. void GetSystemSummaryMemoryInformation(SYSTEM_MEMORY_INFORMATION* psmi)//29
     
676. {
     
677.         cout << "\t\t29 SystemSummaryMemoryInformation" << endl;
     
678.         printseg(psmi->StringStart);
     
679.         for (int i = 0; i < psmi->InfoSize; i++)
     
680.         {
     
681.                 cout << (char*)psmi->Memory[i].StringOffset << endl;
     
682.                 printseg((int)psmi->Memory[i].ValidCount);
     
683.                 printseg((int)psmi->Memory[i].TransitionCount);
     
684.                 printseg((int)psmi->Memory[i].ModifiedCount);
     
685.                 printseg((int)psmi->Memory[i].PageTableCount);
     
686.         }
     
687. }
     
688. 
     
689. // void GetSystemMirrorMemoryInformation(SYSTEM_MEMORY_INFORMATION* psmi)//30
     
690. // {
     
691. // }
     
692. 
     
693. // void GetSystemPerformanceTraceInformation(SYSTEM_PERFORMANCE_TRANCE_INFORMATION* pspti)//31
     
694. // {
     
695. // }
     
696. 
     
697. void GetSystemExceptionInformation(SYSTEM_EXCEPTION_INFORMATION* psei)//32
     
698. {
     
699.         cout << "\t\t32 SystemExceptionInformation" << endl;
     
700.         printseg(psei->AlignmentFixupCount);
     
701.         printseg(psei->ExceptionDispatchCount);
     
702.         printseg(psei->FloatingEmulationCount);
     
703.         printseg(psei->ByteWordEmulationCount);
     
704. }
     
705. 
     
706. // void GetSystemCrashDumpStateInformation(SYSTEM_CRASHDUMP_STATE_INFORMATION* pscsi)//33
     
707. // {
     
708. // }
     
709. 
     
710. //SystemCrashDumpStateInformation 34
     
711. void GetSystemKernelDebuggerInformation(SYSTEM_KERNEL_DEBUGGER_INFORMATION* pskdi)//35
     
712. {
     
713.         cout << "\t\t35 SystemKernelDebuggerInformation" << endl;
     
714.         printseg(pskdi->KernelDebuggerEnabled);
     
715.         printseg(pskdi->KernelDebuggerNotPresent);
     
716. }
     
717. 
     
718. void GetSystemContextSwitchInformation(SYSTEM_CONTEXT_SWITCH_INFORMATION* pscsi)//36
     
719. {
     
720.         cout << "\t\t36 SystemContextSwitchInformation" << endl;
     
721.         printseg(pscsi->ContextSwitches);
     
722.         printseg(pscsi->FindAny);
     
723.         printseg(pscsi->FindLast);
     
724.         printseg(pscsi->FindIdeal);
     
725.         printseg(pscsi->IdleAny);
     
726.         printseg(pscsi->IdleCurrent);
     
727.         printseg(pscsi->IdleLast);
     
728.         printseg(pscsi->IdleIdeal);
     
729.         printseg(pscsi->PreemptAny);
     
730.         printseg(pscsi->PreemptCurrent);
     
731.         printseg(pscsi->PreemptLast);
     
732.         printseg(pscsi->SwitchToIdle);
     
733. }

复制代码

0xAA55

1. void GetSystemRegistryQuotaInformation(SYSTEM_REGISTRY_QUOTA_INFORMATION* psrqi)//37
   
2. {
   
3.         cout << "\t\t37 SystemRegistryQuotaInformation" << endl;
   
4.         printseg(psrqi->RegistryQuotaAllowed);
   
5.         printseg(psrqi->RegistryQuotaUsed);
   
6.         printseg(psrqi->PagedPoolSize);
   
7. }
   
8. 
   
9. // void GetSystemExtendServiceTableInformation(SYSTEM_EXTEND_SERVICE_TABLE_INFORAMTION* psesti)//38
   
10. // {
    
11. // }
    
12. 
    
13. // void GetSystemPrioritySeperation(SYSTEM_PRIORITY_SEPERATION* psps)// 39
    
14. // {
    
15. // }
    
16. 
    
17. // void GetSystemVerifierAddDriverInformation(SYSTEM_VERIFIER_ADDDRIVER_INFORAMTION* psvai) //40
    
18. // {
    
19. // }
    
20. 
    
21. // void GetSystemVerifierRemoveDriverInformation(SYSTEM_VERIFIER_REMOVE_DRIVER_INFORMATION* psvrdi) //41
    
22. // {
    
23. // }
    
24. 
    
25. void GetSystemProcessorIdleInformation(SYSTEM_PROCESSOR_IDLE_INFORMATION* pspii)//42
    
26. {
    
27.         cout << "\t\t42 SystemProcessorIdleInformation" << endl;
    
28.         printseg(pspii->IdleTime);
    
29.         printseg(pspii->C1Time);
    
30.         printseg(pspii->C2Time);
    
31.         printseg(pspii->C3Time);
    
32.         printseg(pspii->C1Transitions);
    
33.         printseg(pspii->C2Transitions);
    
34.         printseg(pspii->C3Transitions);
    
35.         printseg(pspii->Padding);
    
36. }
    
37. 
    
38. void GetSystemLegacyDriverInformation(SYSTEM_LEGACY_DRIVER_INFORMATION* psldi)
    
39. {
    
40.         cout << "\t\t43 SystemLegacyDriverInformation" << endl;
    
41.         printseg(psldi->VetoType);
    
42.         cout << (wchar_t*)psldi->VetoList.Buffer << endl;
    
43. }
    
44. 
    
45. void GetSystemCurrentTimeZoneInformation(RTL_TIME_ZONE_INFORMATION* prtzi)
    
46. {
    
47.         cout << "\t\t44 SystemCurrentTimeZoneInformation" << endl;
    
48.         printseg(prtzi->Bias);
    
49.         cout << "Standard:" << endl;
    
50.         wcout << (wchar_t*)prtzi->StandardName << endl;
    
51.         cout << "\tYear:" << prtzi->StandardStart.Year << endl;
    
52.         cout << "\tMonth:" << prtzi->StandardStart.Month << endl;
    
53.         cout << "\tDay:" << prtzi->StandardStart.Day << endl;
    
54.         cout << "\tHour:" << prtzi->StandardStart.Hour << endl;
    
55.         cout << "\tMinute:" << prtzi->StandardStart.Minute << endl;
    
56.         cout << "\tSecond:" << prtzi->StandardStart.Second << endl;
    
57.         cout << "\tMilliseconds:" << prtzi->StandardStart.Milliseconds << endl;
    
58.         cout << "\tWeekday:" << prtzi->StandardStart.Weekday << endl;
    
59.         printseg(prtzi->StandardBias);
    
60. 
    
61.         cout << "Daylight:" << endl;
    
62.         wcout << (wchar_t*)prtzi->DaylightName << endl;
    
63.         cout << "\tYear:" << prtzi->DaylightStart.Year << endl;
    
64.         cout << "\tMonth:" << prtzi->DaylightStart.Month << endl;
    
65.         cout << "\tDay:" << prtzi->DaylightStart.Day << endl;
    
66.         cout << "\tHour:" << prtzi->DaylightStart.Hour << endl;
    
67.         cout << "\tMinute:" << prtzi->DaylightStart.Minute << endl;
    
68.         cout << "\tSecond:" << prtzi->DaylightStart.Second << endl;
    
69.         cout << "\tMilliseconds:" << prtzi->DaylightStart.Milliseconds << endl;
    
70.         cout << "\tWeekday:" << prtzi->DaylightStart.Weekday << endl;
    
71.         printseg(prtzi->DaylightBias);
    
72. }
    
73. 
    
74. void GetSystemLookasideInformation(SYSTEM_LOOKASIDE_INFORMATION* psli, int length)
    
75. {
    
76.         cout << "\t\t45 SystemLookasideInformation" << endl;
    
77.         int num = length / sizeof(SYSTEM_LOOKASIDE_INFORMATION);
    
78.         for (int i = 0; i < num;i++)
    
79.         {
    
80.                 printseg((int)psli->CurrentDepth);
    
81.                 printseg((int)psli->MaximumDepth);
    
82.                 printseg(psli->TotalAllocates);
    
83.                 printseg(psli->AllocateMisses);
    
84.                 printseg(psli->TotalFrees);
    
85.                 printseg(psli->FreeMisses);
    
86.                 printseg(psli->Type);
    
87.                 printseg(psli->Tag);
    
88.                 printseg(psli->Size);
    
89.         }
    
90. }
    
91. 
    
92. // void GetSystemTimeSlipNotification(SYSTEM_TIME_SLIP_NOTIFICATION* pstsn)// 46
    
93. // {
    
94. // }
    
95. 
    
96. void GetSystemSessionCreate(ULONG* SessionId)//SystemSessionCreate 47
    
97. {
    
98.         cout << "\t\t47 SystemSessionCreate" << endl;
    
99.         cout << "SessionId" << endl;
    
100. }
     
101. 
     
102. // void GetSystemSessionDetach(SYSTEM_SESSION_DETACH* pssd)// 48
     
103. // {
     
104. // }
     
105. 
     
106. //void GetSystemSessionInformation(SYSTEM_SESSION_INFORMATION* pssi)// 49
     
107. // {
     
108. // }
     
109. 
     
110. void GetSystemRangeStartInformation(ULONG_PTR* data)//50
     
111. {
     
112.         cout << "\t\t50 SystemRangeStartInformation" << endl;
     
113.         cout << hex << data << endl;
     
114.         cout << dec;
     
115. }
     
116. 
     
117. void GetSystemVerifierInformation(SYSTEM_VERIFIER_INFORMATION* psvi)// 51
     
118. {
     
119.         cout << "\t\t51 SystemVerifierInformation" << endl;
     
120.         ULONG offset = 0;
     
121.         int index = 0;
     
122.         do
     
123.         {
     
124.                 offset = psvi->NextEntryOffset;
     
125.                 cout << index + 1 << ":" << endl;
     
126.                 printseg(psvi->Level);
     
127.                 wcout << (wchar_t*)psvi->DriverName.Buffer << endl;
     
128.                 printseg(psvi->RaiseIrqls);
     
129.                 printseg(psvi->AcquireSpinLocks);
     
130.                 printseg(psvi->SynchronizeExecutions);
     
131.                 printseg(psvi->AllocationsAttempted);
     
132.                 printseg(psvi->AllocationsSucceeded);
     
133.                 printseg(psvi->AllocationsSucceededSpecialPool);
     
134.                 printseg(psvi->AllocationsWithNoTag);
     
135.                 printseg(psvi->TrimRequests);
     
136.                 printseg(psvi->Trims);
     
137.                 printseg(psvi->AllocationsFailed);
     
138.                 printseg(psvi->AllocationsFailedDeliberately);
     
139.                 printseg(psvi->Loads);
     
140.                 printseg(psvi->Unloads);
     
141.                 printseg(psvi->UnTrackedPool);
     
142.                 printseg(psvi->CurrentPagedPoolAllocations);
     
143.                 printseg(psvi->CurrentNonPagedPoolAllocations);
     
144.                 printseg(psvi->PeakPagedPoolAllocations);
     
145.                 printseg(psvi->PeakNonPagedPoolAllocations);
     
146.                 printseg(psvi->PagedPoolUsageInBytes);
     
147.                 printseg(psvi->NonPagedPoolUsageInBytes);
     
148.                 printseg(psvi->PeakPagedPoolUsageInBytes);
     
149.                 printseg(psvi->PeakNonPagedPoolUsageInBytes);
     
150.                 psvi = (SYSTEM_VERIFIER_INFORMATION*)((BYTE*)psvi + offset);
     
151.         } while (offset);
     
152. }
     
153. 
     
154. // void GetSystemVerifierThunkExtend(SYSTEM_VERIFIER_THUNK_EX* psvie)//52
     
155. // {
     
156. // }
     
157. 
     
158. void GetSystemSessionProcessInformation(SYSTEM_SESSION_PROCESS_INFORMATION* psspi)//53
     
159. {
     
160.         cout << "\t\t53 SystemSessionProcessInformation" << endl;
     
161.         printseg(psspi->SessionId);
     
162.         printseg(psspi->SizeOfBuf);
     
163. //        SYSTEM_SESSION_POOLTAG_INFORMATION* psspti = (SYSTEM_SESSION_POOLTAG_INFORMATION*)psspi->Buffer
     
164. }
     
165. 
     
166. //54 SystemLoadGdiDriverInSystemSpace
     
167. void GetSystemNumaProcessorMap(SYSTEM_NUMA_INFORMATION* psni)
     
168. {
     
169.         cout << "\t\t55 SystemLoadGdiDriverInSystemSpace" << endl;
     
170.         printseg(psni->HighestNodeNumber);
     
171.         for (int i = 0; i < MAXIMUM_NUMA_NODES; i++)
     
172.         {
     
173.                 cout << "\tActiveProcessorsAffinityMask" << i << psni->ActiveProcessorsAffinityMask [i] << endl;
     
174.                 cout << "\tAvailableMemory" << i << psni->AvailableMemory[i] << endl;
     
175.         }
     
176. }
     
177. 
     
178. //56 SystemPrefetcherInformation
     
179. 
     
180. void GetSystemExtendedProcessInformation(SYSTEM_PROCESS_INFORMATION* pspri1)//57
     
181. {
     
182.         cout << "\t\t57 SystemExtendedProcessInformation" << endl;
     
183.         do
     
184.         {
     
185.                 if (pspri1->ImageName.Buffer)
     
186.                         wcout << "\tImageName:" << wstring((wchar_t*)pspri1->ImageName.Buffer) << endl;
     
187.                 else
     
188.                         wcout << "no name" << endl;
     
189.                 cout << "\t线程数:" << pspri1->NumberOfThreads << endl;
     
190.                 printseg(pspri1->SpareLi1.QuadPart);
     
191.                 printseg(pspri1->SpareLi2.QuadPart);
     
192.                 printseg(pspri1->SpareLi3.QuadPart);
     
193.                 cout << "\t创建时间:" << pspri1->CreateTime.QuadPart << endl;
     
194.                 cout << "\t用户态时间:" << pspri1->UserTime.QuadPart << endl;
     
195.                 cout << "\t内核态时间:" << pspri1->KernelTime.QuadPart << endl;
     
196.                 cout << "\t基础优先级:" << pspri1->BasePriority << endl;
     
197.                 cout << "\t进程Id:" << (int)pspri1->UniqueProcessId << endl;
     
198.                 cout << "\t父进程Id:" << (int)pspri1->InheritedFromUniqueProcessId << endl;
     
199.                 cout << "\t句柄数:" << pspri1->HandleCount << endl;
     
200.                 cout << "\t会话Id:" << pspri1->SessionId << endl;
     
201.                 cout << "\t页目录机制:" << pspri1->PageDirectoryBase << endl;
     
202.                 cout << "\t虚拟内存峰值:" << pspri1->PeakVirtualSize << endl;
     
203.                 cout << "\t虚拟内存大小:" << pspri1->VirtualSize << endl;
     
204.                 cout << "\t页错误数:" << pspri1->PageFaultCount << endl;
     
205.                 cout << "\t物理内存峰值:" << pspri1->PeakWorkingSetSize << endl;
     
206.                 cout << "\t物理内存大小:" << pspri1->WorkingSetSize << endl;
     
207.                 cout << "\t分页池配额峰值:" << pspri1->QuotaPeakPagedPoolUsage << endl;
     
208.                 cout << "\t分页池配额:" << pspri1->QuotaPagedPoolUsage << endl;
     
209.                 cout << "\t非分页池配额峰值:" << pspri1->QuotaPeakNonPagedPoolUsage << endl;
     
210.                 cout << "\t非分页池配额:" << pspri1->QuotaNonPagedPoolUsage << endl;
     
211.                 cout << "\t页面文件使用:" << pspri1->PagefileUsage << endl;
     
212.                 cout << "\t页面文件使用峰值:" << pspri1->PeakPagefileUsage << endl;
     
213.                 cout << "\t私有页面数:" << pspri1->PrivatePageCount << endl;
     
214.                 cout << "\t读操作数:" << pspri1->ReadOperationCount.QuadPart << endl;
     
215.                 cout << "\t写操作数:" << pspri1->WriteOperationCount.QuadPart << endl;
     
216.                 cout << "\t其他操作数:" << pspri1->OtherOperationCount.QuadPart << endl;
     
217.                 cout << "\t读字节数:" << pspri1->ReadTransferCount.QuadPart << endl;
     
218.                 cout << "\t写字节数:" << pspri1->WriteTransferCount.QuadPart << endl;
     
219.                 cout << "\t其他字节数:" << pspri1->OtherTransferCount.QuadPart << endl;
     
220.                 SYSTEM_PROCESS_INFORMATION* newpspri1 = (SYSTEM_PROCESS_INFORMATION*)((BYTE*)pspri1 + pspri1->NextEntryOffset);
     
221.                 SYSTEM_EXTENDED_THREAD_INFORMATION* pesti = (SYSTEM_EXTENDED_THREAD_INFORMATION*)(pspri1 + 1);
     
222.                 int threadindex = 0;
     
223.                 while ((LPVOID)pesti < (LPVOID)newpspri1)
     
224.                 {
     
225.                         ++threadindex;
     
226.                         cout << "\t内核态时间:" << pesti->ThreadInfo.KernelTime.QuadPart << endl;
     
227.                         cout << "\t用户态时间:" << pesti->ThreadInfo.UserTime.QuadPart << endl;
     
228.                         cout << "\t创建时间:" << pesti->ThreadInfo.CreateTime.QuadPart << endl;
     
229.                         cout << "\t等待时间:" << pesti->ThreadInfo.WaitTime << endl;
     
230.                         cout << "\t起始地址:" << hex << pesti->ThreadInfo.StartAddress << endl;
     
231.                         cout << "\tUniqueProcess:" << hex << pesti->ThreadInfo.ClientId.UniqueProcess << endl;
     
232.                         cout << "\tUniqueThread:" << hex << pesti->ThreadInfo.ClientId.UniqueThread << endl;
     
233.                         cout << dec;
     
234.                         cout << "\t优先级:" << pesti->ThreadInfo.Priority << endl;
     
235.                         cout << "\t基础优先级:" << pesti->ThreadInfo.BasePriority << endl;
     
236.                         cout << "\t模式切换次数:" << pesti->ThreadInfo.ContextSwitches << endl;
     
237.                         cout << "\t线程状态:" << pesti->ThreadInfo.ThreadState << endl;
     
238.                         cout << "\t等待原因:" << pesti->ThreadInfo.WaitReason << endl;
     
239.                         cout << "\t栈基址:" << hex << pesti->StackBase << endl;
     
240.                         cout << "\t栈范围:" << hex << pesti->StackLimit << endl;
     
241.                         cout << "\tWin32StartAddress" << hex << pesti->Win32StartAddress << endl;
     
242.                         cout << dec;
     
243.                         pesti++;
     
244.                 }
     
245.                 pspri1 = newpspri1;
     
246.         } while (pspri1->NextEntryOffset);
     
247. }
     
248. 
     
249. void GetSystemRecommendedSharedDataAlignment(ULONG* data)//58
     
250. {
     
251.         cout << "\t\t`58 SystemRecommendedSharedDataAlignment" << endl;
     
252.         cout << *data << endl;
     
253. }
     
254. 
     
255. void GetSystemComPlusPackage(ULONG* data)//59
     
256. {
     
257.         cout << "\t\t 59 SystemComPlusPackage" << endl;
     
258.         cout << *data << endl;
     
259. }
     
260. 
     
261. void GetSystemNumaAvailableMemory(SYSTEM_NUMA_INFORMATION* psni)//60
     
262. {
     
263.         cout << "\t\t60 SystemNumaAvailableMemory" << endl;
     
264.         printseg(psni->HighestNodeNumber);
     
265.         for (int i = 0; i < MAXIMUM_NUMA_NODES; i++)
     
266.         {
     
267.                 cout << "\tActiveProcessorsAffinityMask" << i << psni->ActiveProcessorsAffinityMask[i] << endl;
     
268.                 cout << "\tAvailableMemory" << i << psni->AvailableMemory[i] << endl;
     
269.         }
     
270. }
     
271. 
     
272. void GetSystemProcessorPowerInformation(SYSTEM_PROCESSOR_POWER_INFORMATION* psppi)//61
     
273. {
     
274.         cout << "\t\t61 SystemProcessorPowerInformation" << endl;
     
275.         printseg((int)psppi->CurrentFrequency);
     
276.         printseg((int)psppi->ThermalLimitFrequency);
     
277.         printseg((int)psppi->ConstantThrottleFrequency);
     
278.         printseg((int)psppi->DegradedThrottleFrequency);
     
279.         printseg((int)psppi->LastBusyFrequency);
     
280.         printseg((int)psppi->LastC3Frequency);
     
281.         printseg((int)psppi->LastAdjustedBusyFrequency);
     
282.         printseg((int)psppi->ProcessorMinThrottle);
     
283.         printseg((int)psppi->ProcessorMaxThrottle);
     
284.         printseg(psppi->NumberOfFrequencies);
     
285.         printseg(psppi->PromotionCount);
     
286.         printseg(psppi->DemotionCount);
     
287.         printseg(psppi->ErrorCount);
     
288.         printseg(psppi->RetryCount);
     
289.         printseg(psppi->CurrentFrequencyTime);
     
290.         printseg(psppi->CurrentProcessorTime);
     
291.         printseg(psppi->CurrentProcessorIdleTime);
     
292.         printseg(psppi->LastProcessorTime);
     
293.         printseg(psppi->LastProcessorIdleTime);
     
294. }
     
295. 
     
296. void GetSystemEmulationBasicInformation(SYSTEM_BASIC_INFORMATION* psbi)//62
     
297. {
     
298.         cout << "\t\t62 SystemEmulationBasicInformation" << endl;
     
299.         cout << "\t时间解析度ms:" << psbi->TimerResolution << endl;
     
300.         cout << "\t物理页大小:" << psbi->PageSize << endl;
     
301.         cout << "\t物理页个数:" << psbi->NumberOfPhysicalPages << endl;
     
302.         cout << "\t最小物理页个数:" << psbi->LowestPhysicalPageNumber << endl;
     
303.         cout << "\t最大物理页个数:" << psbi->HighestPhysicalPageNumber << endl;
     
304.         cout << "\t逻辑页大小:" << psbi->AllocationGranularity << endl;
     
305.         cout << "\t最小用户地址:" << psbi->MinimumUserModeAddress << endl;
     
306.         cout << "\t最大用户地址:" << psbi->MaximumUserModeAddress << endl;
     
307.         cout << "\t处理器个数:" << (int)psbi->NumberOfProcessors << endl;
     
308. }
     
309. 
     
310. void GetSystemEmulationProcessorInformation(SYSTEM_PROCESSOR_INFORMATION* pspri)//63
     
311. {
     
312.         cout << "\t\t63 SystemEmulationProcessorInformation" << endl;
     
313.         switch (pspri->ProcessorArchitecture)
     
314.         {
     
315.         case PROCESSOR_ARCHITECTURE_INTEL:
     
316.                 cout << "\tINTEL ";
     
317.                 if (pspri->ProcessorLevel == 3)
     
318.                         cout << "386 ";
     
319.                 else if (pspri->ProcessorLevel == 4)
     
320.                         cout << "486 ";
     
321.                 else if (pspri->ProcessorLevel == 5)
     
322.                         cout << "586 or Pentium ";
     
323.                 break;
     
324.         case PROCESSOR_ARCHITECTURE_IA64:
     
325.                 cout << "IA64 ";
     
326.                 if (pspri->ProcessorLevel == 7)
     
327.                         cout << "Itanium ";
     
328.                 else if (pspri->ProcessorLevel == 31)
     
329.                         cout << "Itanium 2 ";
     
330.                 break;
     
331.         }
     
332.         cout << pspri->ProcessorRevision << " " << pspri->ProcessorFeatureBits << endl;
     
333. }
     
334. 
     
335. //64 SystemExtendedHandleInformation
     
336. //65 SystemLostDelayedWriteInformation
     
337. void GetSystemBigPoolInformation(SYSTEM_BIGPOOL_INFORMATION* psbi)//66
     
338. {
     
339.         cout << "\t\t63 SystemEmulationProcessorInformation" << endl;
     
340.         for (int i = 0; i < psbi->Count; i++)
     
341.         {
     
342.                 cout << hex << "\tVirutalAddress:" << psbi->AllocatedInfo[i].VirtualAddress;
     
343.                 cout << dec;
     
344.                 cout << "\tSizeInBytes:" << psbi->AllocatedInfo[i].SizeInBytes;
     
345.                 cout << "\tTagUlong:" << psbi->AllocatedInfo[i].TagUlong << endl;
     
346.         }
     
347. }
     
348. 
     
349. void GetSystemSessionPoolTagInformation(SYSTEM_SESSION_PROCESS_INFORMATION* psspi)//67
     
350. {
     
351.         cout << "\t\t67 SystemSessionPoolTagInformation" << endl;
     
352.         printseg(psspi->SessionId);
     
353.         printseg(psspi->SizeOfBuf);
     
354. }
     
355. 
     
356. void GetSystemSessionMappedViewInformation(SYSTEM_SESSION_MAPPED_VIEW_INFORMATION* pssmvi)//68
     
357. {
     
358.         cout << "\t\t68 SystemSessionMappedViewInformation" << endl;
     
359.         SIZE_T nextoffset = 0;
     
360.         do
     
361.         {
     
362.                 pssmvi = (SYSTEM_SESSION_MAPPED_VIEW_INFORMATION*)((BYTE*)pssmvi + (pssmvi->NextEntryOffset));
     
363.         } while (nextoffset);
     
364. }
     
365. 
     
366. //69 SystemHotpatchInformation
     
367. 
     
368. void GetSystemObjectSecurityMode(ULONG* data)//70
     
369. {
     
370.         cout << "\t\t69 SystemObjectSecurityMode" << endl;
     
371.         cout << *data << endl;
     
372. }
     
373. 
     
374. void GetSystemWatchdogTimerHandler(SYSTEM_WATCHDOG_HANDLER_INFORMATION* pswhi)//71
     
375. {
     
376. }
     
377. 
     
378. void GetSystemWatchdogTimerInformation(SYSTEM_WATCHDOG_TIMER_INFORMATION* pswti)//72
     
379. {
     
380. }
     
381. 
     
382. void GetSystemLogicalProcessorInformation(SYSTEM_LOGICAL_PROCESSOR_INFORMATION* pslpi)//73
     
383. {
     
384.         cout << "\t\t73 SystemLogicalProcessorInformation" << endl;
     
385. }
     
386. 
     
387. //74 SystemWow64SharedInformation
     
388. void GetSystemRegisterFirmwareTableInformationHandler(SYSTEM_FIRMWARE_TABLE_HANDLER* psfth)//75
     
389. {
     
390.         cout << "\t\t75 SystemRegisterFirmwareTableInformationHandler" << endl;
     
391. }
     
392. 
     
393. void GetSystemFirmwareTableInformation(SYSTEM_FIRMWARE_TABLE_HANDLER* psfth)//76
     
394. {
     
395.         cout << "\t\t76 SystemFirmwareTableInformation" << endl;
     
396. }
     
397. 
     
398. // void GetSystemExtendedHandleInformation(SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* pshteie)
     
399. // {
     
400. //         cout << "\t\t64 SystemExtendedHandleInformation" << endl;
     
401. //         for (int i = 0; i < pshteie->NumberOfHandles; i++)
     
402. //         {
     
403. //                 cout << "\t" << i + 1 << endl;
     
404. //                 cout << "\tUniqueProcessId:" << (int)pshteie->Handles[i].UniqueProcessId << endl;
     
405. //                 cout << "\tCreatorBackTraceIndex:" << (int)pshteie->Handles[i].CreatorBackTraceIndex << endl;
     
406. //                 cout << "\tObjectTypeIndex:" << (int)pshteie->Handles[i].ObjectTypeIndex << endl;
     
407. //                 cout << "\tHandleAttributes:" << (int)pshteie->Handles[i].HandleAttributes << endl;
     
408. //                 cout << "\tHandleValue:" << (int)pshteie->Handles[i].HandleValue << endl;
     
409. //                 cout << "\tObject:" << hex << (int)pshteie->Handles[i].Object << endl;
     
410. //                 cout << "\tGrantedAccess:" << hex << (int)pshteie->Handles[i].GrantedAccess << endl;
     
411. //         }
     
412. // }
     
413. 
     
414. //77 SystemModuleInformationEx
     
415. //78 SystemVerifierTriageInformation
     
416. //79 SystemSuperfetchInformation
     
417. //80 SystemMemoryListInformation
     
418. 
     
419. void GetSystemFileCacheInformationEx(SYSTEM_FILECACHE_INFORMATION* psfci)//81
     
420. {
     
421.         cout << "\t\t81 SystemFileCacheInformationEx" << endl;
     
422.         printseg(psfci->CurrentSize);
     
423.         printseg(psfci->PeakSize);
     
424.         printseg(psfci->PageFaultCount);
     
425.         printseg(psfci->MinimumWorkingSet);
     
426.         printseg(psfci->MaximumWorkingSet);
     
427.         printseg(psfci->CurrentSizeIncludingTransitionInPages);
     
428.         printseg(psfci->PeakSizeIncludingTransitionInPages);
     
429.         printseg(psfci->TransitionRePurposeCount);
     
430.         printseg(psfci->Flags);
     
431. }
     
432. 
     
433. #define do(x) GetInformationTemplate(x,Get##x)
     
434. 
     
435. void main()
     
436. {
     
437. //         do(SystemBasicInformation);//0
     
438. //         do(SystemProcessorInformation);//1
     
439. //         do(SystemPerformanceInformation);//2
     
440. //         do(SystemTimeOfDayInformation);//3
     
441. //        do(SystemPathInformation);//4
     
442. //         do(SystemProcessInformation);//5
     
443. //         do(SystemCallCountInformation);//6
     
444. //         do(SystemDeviceInformation);//7
     
445. //         do(SystemProcessorPerformanceInformation);//8
     
446. //         do(SystemFlagsInformation);//9
     
447. //        do(SystemCallTimeInformation);//10
     
448. //        do(SystemModuleInformation);//11
     
449. //        do(SystemLocksInformation);//12
     
450. //        do(SystemStackTraceInformation);//13
     
451. //        do(SystemPagedPoolInformation);//14
     
452. //        do(SystemNonPagedPoolInformation);//15
     
453. //        do(SystemHandleInformation);//16
     
454. //        do(SystemObjectInformation);//17
     
455. //        do(SystemPageFileInformation);//18
     
456. //        do(SystemVdmInstemulInformation);//19
     
457. //        do(SystemVdmBopInformation);//20
     
458. //        do(SystemFileCacheInformatio);//21
     
459. //         do(SystemPoolTagInformation);//22
     
460. //         do(SystemInterruptInformation);//23
     
461. //         do(SystemDpcBehaviorInformation);//24
     
462. //         do(SystemFullMemoryInformation);//25
     
463. //         do(SystemLoadGdiDriverInformation);//26
     
464. //        do(SystemUnloadGdiDriverInformation);//27
     
465. //        do(SystemTimeAdjustmentInformation);//28
     
466. //        do(SystemSummaryMemoryInformation);//29
     
467. //        do(SystemMirrorMemoryInformation);//30
     
468. //        do(SystemPerformanceTraceInformation);//31
     
469. //        do(SystemObsolete0);//32
     
470. //        do(SystemExceptionInformation);//33
     
471. //        do(SystemCrashDumpStateInformation);//34
     
472. //         do(SystemKernelDebuggerInformation);//35
     
473. //         do(SystemContextSwitchInformation);//36
     
474. //         do(SystemRegistryQuotaInformation);//37
     
475. //        do(SystemExtendServiceTableInformation);//38
     
476. //        do(SystemPrioritySeperation);//39
     
477. //        do(SystemVerifierAddDriverInformation);//40
     
478. //        do(SystemVerifierRemoveDriverInformation);//41
     
479. //        do(SystemProcessorIdleInformation);//42
     
480. //        do(SystemLegacyDriverInformation);//43
     
481. //        do(SystemCurrentTimeZoneInformation);//44
     
482. //        do(SystemLookasideInformation);//45
     
483. //        do(SystemTimeSlipNotification);//46
     
484. //        do(SystemSessionCreate);//47
     
485. //        do(SystemSessionDetach);//48
     
486. //        do(SystemSessionInformation);//49
     
487. //        do(SystemRangeStartInformation);//50
     
488. //        do(SystemVerifierInformation);//51
     
489. //        do(SystemVerifierThunkExtend);//52
     
490. //        do(SystemSessionProcessInformation);//53
     
491. //        do(SystemLoadGdiDriverInSystemSpace);//54
     
492. //        do(SystemNumaProcessorMap);//55
     
493. //        do(SystemPrefetcherInformation);//56
     
494. //        do(SystemExtendedProcessInformation);//57
     
495. //         do(SystemRecommendedSharedDataAlignment);//58
     
496. //         do(SystemComPlusPackage);//59
     
497. //         do(SystemNumaAvailableMemory);//60
     
498. //         do(SystemProcessorPowerInformation);//61
     
499. //         do(SystemEmulationBasicInformation);//62
     
500. //         do(SystemEmulationProcessorInformation);//63
     
501. //        do(SystemExtendedHandleInformation);//64
     
502. //        do(SystemLostDelayedWriteInformation);//65
     
503. //        do(SystemBigPoolInformation);//66
     
504. //        do(SystemSessionPoolTagInformation);//67
     
505. //        do(SystemSessionMappedViewInformation);//68
     
506. //        do(SystemHotpatchInformation);//69
     
507. //         do(SystemObjectSecurityMode);//70
     
508. //         do(SystemWatchdogTimerHandler);//71
     
509. //         do(SystemWatchdogTimerInformation);//72
     
510. //         do(SystemLogicalProcessorInformation);//73
     
511. //        do(SystemWow64SharedInformation);//74
     
512. //        do(SystemRegisterFirmwareTableInformationHandler);//75
     
513. //        do(SystemFirmwareTableInformation);//76
     
514. //        do(SystemModuleInformationEx);//77
     
515. //        do(SystemBigPoolInformation);//78
     
516. //        do(SystemSessionPoolTagInformation);//79
     
517. //        do(SystemSessionMappedViewInformation);//80
     
518. //        do(SystemHotpatchInformation);//81
     
519. //         do(SystemObjectSecurityMode);//82
     
520. //         do(SystemWatchdogTimerHandler);//82
     
521. //         do(SystemWatchdogTimerInformation);//83
     
522.         do(SystemLogicalProcessorInformation);//84
     
523. //        do(SystemWow64SharedInformation);//85
     
524. //         do(SystemRegisterFirmwareTableInformationHandler);//86
     
525. //         do(SystemFirmwareTableInformation);//87
     
526. //        do(SystemModuleInformationEx);//88
     
527. //        do(SystemVerifierTriageInformation);//89
     
528. //        do(SystemSuperfetchInformation);//90
     
529. //        do(SystemMemoryListInformation);//91
     
530. //        do(SystemFileCacheInformationEx);//92
     
531. }

复制代码

icqw

下载了 赞一个