(轉)SystemProcessesAndThreadsInformation

http://hi.baidu.com/hanjdud8606/item/7a970408a95acc843d42e27f

NTSTATUS NTAPI ZwQuerySystemInformation(ULONG SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength,PULONG ReturnLength
);

　　第一個參數是一個枚舉類型，傳入的是你需要查詢的信息的類型，如果你要查詢進程的相關信息，則你需要傳入SystemProcessesAndThreadsInformation，以下是這個enmu類型的定義。

typedef enum _SYSTEM_INFORMATION_CLASS {SystemBasicInformation, // 0 Y NSystemProcessorInformation, // 1 Y NSystemPerformanceInformation, // 2 Y NSystemTimeOfDayInformation, // 3 Y NSystemNotImplemented1, // 4 Y NSystemProcessesAndThreadsInformation, // 5 Y NSystemCallCounts, // 6 Y NSystemConfigurationInformation, // 7 Y NSystemProcessorTimes, // 8 Y NSystemGlobalFlag, // 9 Y YSystemNotImplemented2, // 10 Y NSystemModuleInformation, // 11 Y NSystemLockInformation, // 12 Y NSystemNotImplemented3, // 13 Y NSystemNotImplemented4, // 14 Y NSystemNotImplemented5, // 15 Y NSystemHandleInformation, // 16 Y NSystemObjectInformation, // 17 Y NSystemPagefileInformation, // 18 Y NSystemInstructionEmulationCounts, // 19 Y NSystemInvalidInfoClass1, // 20SystemCacheInformation, // 21 Y YSystemPoolTagInformation, // 22 Y NSystemProcessorStatistics, // 23 Y NSystemDpcInformation, // 24 Y YSystemNotImplemented6, // 25 Y NSystemLoadImage, // 26 N YSystemUnloadImage, // 27 N YSystemTimeAdjustment, // 28 Y YSystemNotImplemented7, // 29 Y NSystemNotImplemented8, // 30 Y NSystemNotImplemented9, // 31 Y NSystemCrashDumpInformation, // 32 Y NSystemExceptionInformation, // 33 Y NSystemCrashDumpStateInformation, // 34 Y Y/NSystemKernelDebuggerInformation, // 35 Y NSystemContextSwitchInformation, // 36 Y NSystemRegistryQuotaInformation, // 37 Y YSystemLoadAndCallImage, // 38 N YSystemPrioritySeparation, // 39 N YSystemNotImplemented10, // 40 Y NSystemNotImplemented11, // 41 Y NSystemInvalidInfoClass2, // 42SystemInvalidInfoClass3, // 43SystemTimeZoneInformation, // 44 Y NSystemLookasideInformation, // 45 Y NSystemSetTimeSlipEvent, // 46 N YSystemCreateSession, // 47 N YSystemDeleteSession, // 48 N YSystemInvalidInfoClass4, // 49SystemRangeStartInformation, // 50 Y NSystemVerifierInformation, // 51 Y YSystemAddVerifier, // 52 N YSystemSessionProcessesInformation // 53 Y N
}SYSTEM_INFORMATION_CLASS;

　　當我們第一個參數傳入的是SystemProcessesAndThreadsInformation則返回的一片內存空間一個PSYSTEM_PROCESSES的結構。

typedef struct _SYSTEM_PROCESSES
{ULONG NextEntryDelta; //構成結構序列的偏移量;ULONG ThreadCount; //線程數目;ULONG Reserved1[6];LARGE_INTEGER CreateTime; //創建時間;LARGE_INTEGER UserTime;//用戶模式(Ring 3)的CPU時間;LARGE_INTEGER KernelTime; //內核模式(Ring 0)的CPU時間;UNICODE_STRING ProcessName; //進程名稱;KPRIORITY BasePriority;//進程優先權;ULONG ProcessId; //進程標識符;ULONG InheritedFromProcessId; //父進程的標識符;ULONG HandleCount; //句柄數目;ULONG Reserved2[2];VM_COUNTERS  VmCounters; //虛擬存儲器的結構，見下;IO_COUNTERS IoCounters; //IO計數結構，見下;SYSTEM_THREADS Threads[1]; //進程相關線程的結構數組
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

　　如果要遍歷系統中的進程，我們只需要使用NextEntryDelta這個指針即可。

　　獲取進程示例代碼#include <windows.#include <ntsecapi.h>

#include "stdio.h"typedef DWORD (WINAPI *ZWQUERYSYSTEMINFORMATION)(DWORD, PVOID, DWORD, PDWORD);typedef struct _SYSTEM_PROCESS_INFORMATION {DWORD   NextEntryDelta;DWORD   ThreadCount;DWORD   Reserved1[6];FILETIME  ftCreateTime;   FILETIME  ftUserTime;   FILETIME  ftKernelTime;   UNICODE_STRING ProcessName;      // 進程名.
    DWORD   BasePriority;  DWORD   ProcessId;DWORD   InheritedFromProcessId;DWORD   HandleCount;DWORD   Reserved2[2];DWORD   VmCounters;  DWORD   dCommitCharge;  PVOID   ThreadInfos[1]; 
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;#define SystemProcessesAndThreadsInformation 5void main()
{HMODULE hNtDLL = GetModuleHandle( "ntdll.dll" );if (!hNtDLL )return;ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDLL,"ZwQuerySystemInformation");ULONG cbBuffer = 0x20000;   // 設置緩沖大小,與系統有關.LPVOID pBuffer = NULL;pBuffer = malloc(cbBuffer);

 　　if (pBuffer == NULL)
　　　　　　return;ZwQuerySystemInformation(SystemProcessesAndThreadsInformation, pBuffer, cbBuffer, NULL);PSYSTEM_PROCESS_INFORMATION pInfo =  (PSYSTEM_PROCESS_INFORMATION)pBuffer;for (;;){printf("ProcessID: %d (%ls)\n", pInfo->ProcessId, pInfo->ProcessName.Buffer);if (pInfo->NextEntryDelta == 0)break;// 查找下一個進程的結構地址.pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo) + pInfo->NextEntryDelta);}

    free(pBuffer);getchar();  //暫停.
}

?

?