Chinaunix首页 | 论坛 | 博客

爱飞的鱼henry.blog.chinaunix.net

首页　| 　博文目录　| 　关于我

leibniz_zsu

  • 博客访问： 1630662
  • 博文数量： 584
  • 博客积分： 13857
  • 博客等级： 上将
  • 技术积分： 11883
  • 用 户 组： 普通用户
  • 注册时间： 2009-12-16 09:34
文章分类

全部博文（584）

推荐博文
相关博文
ZwQuerySystemInformation 查看系统进程信息

分类： Windows平台

2013-05-17 14:29:32


点击(此处)折叠或打开

  1. #include <ntddk.h>
  2.       
  3.     typedef enum _SYSTEM_INFORMATION_CLASS {
  4.         SystemBasicInformation,
  5.         SystemProcessorInformation,
  6.         SystemPerformanceInformation,
  7.         SystemTimeOfDayInformation,
  8.         SystemPathInformation,
  9.         SystemProcessInformation, //5
  10.         SystemCallCountInformation,
  11.         SystemDeviceInformation,
  12.         SystemProcessorPerformanceInformation,
  13.         SystemFlagsInformation,
  14.         SystemCallTimeInformation,
  15.         SystemModuleInformation,
  16.         SystemLocksInformation,
  17.         SystemStackTraceInformation,
  18.         SystemPagedPoolInformation,
  19.         SystemNonPagedPoolInformation,
  20.         SystemHandleInformation,
  21.         SystemObjectInformation,
  22.         SystemPageFileInformation,
  23.         SystemVdmInstemulInformation,
  24.         SystemVdmBopInformation,
  25.         SystemFileCacheInformation,
  26.         SystemPoolTagInformation,
  27.         SystemInterruptInformation,
  28.         SystemDpcBehaviorInformation,
  29.         SystemFullMemoryInformation,
  30.         SystemLoadGdiDriverInformation,
  31.         SystemUnloadGdiDriverInformation,
  32.         SystemTimeAdjustmentInformation,
  33.         SystemSummaryMemoryInformation,
  34.         SystemNextEventIdInformation,
  35.         SystemEventIdsInformation,
  36.         SystemCrashDumpInformation,
  37.         SystemExceptionInformation,
  38.         SystemCrashDumpStateInformation,
  39.         SystemKernelDebuggerInformation,
  40.         SystemContextSwitchInformation,
  41.         SystemRegistryQuotaInformation,
  42.         SystemExtendServiceTableInformation,
  43.         SystemPrioritySeperation,
  44.         SystemPlugPlayBusInformation,
  45.         SystemDockInformation,
  46.         SystemPowerInformation2,
  47.         SystemProcessorSpeedInformation,
  48.         SystemCurrentTimeZoneInformation,
  49.         SystemLookasideInformation
  50.     } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;
  51.       
  52.     typedef struct _SYSTEM_THREAD_INFORMATION {
  53.         LARGE_INTEGER KernelTime;
  54.         LARGE_INTEGER UserTime;
  55.         LARGE_INTEGER CreateTime;
  56.         ULONG WaitTime;
  57.         PVOID StartAddress;
  58.         CLIENT_ID ClientId;
  59.         KPRIORITY Priority;
  60.         LONG BasePriority;
  61.         ULONG ContextSwitchCount;
  62.         ULONG State;
  63.         KWAIT_REASON WaitReason;
  64.     }SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
  65.       
  66.     typedef struct _SYSTEM_PROCESS_INFORMATION {
  67.         ULONG NextEntryOffset;
  68.         ULONG NumberOfThreads;
  69.         LARGE_INTEGER Reserved[3];
  70.         LARGE_INTEGER CreateTime;
  71.         LARGE_INTEGER UserTime;
  72.         LARGE_INTEGER KernelTime;
  73.         UNICODE_STRING ImageName;
  74.         KPRIORITY BasePriority;
  75.         HANDLE ProcessId;
  76.         HANDLE InheritedFromProcessId;
  77.         ULONG HandleCount;
  78.         ULONG Reserved2[2];
  79.         ULONG PrivatePageCount;
  80.         VM_COUNTERS VirtualMemoryCounters;
  81.         IO_COUNTERS IoCounters;
  82.         SYSTEM_THREAD_INFORMATION Threads[0];
  83.     } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
  84.       
  85.     //不加extern "C" 一直报link错误
  86.      extern "C" NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(
  87.         IN ULONG SystemInformationClass,
  88.         IN PVOID SystemInformation,
  89.         IN ULONG SystemInformationLength,
  90.         OUT PULONG ReturnLength);
  91.       
  92.     VOID Unload(
  93.         __in struct _DRIVER_OBJECT *DriverObject
  94.         )
  95.     {
  96.         KdPrint(("unload ....."));
  97.     }
  98.       
  99.     NTSTATUS Ring0EnumProcess()
  100.     {
  101.         ULONG cbBuffer = 0x8000; //32k
  102.         PVOID pSystemInfo;
  103.         NTSTATUS status;
  104.         PSYSTEM_PROCESS_INFORMATION pInfo;
  105.       
  106.         //为查找进程分配足够的空间
  107.         do
  108.         {
  109.             pSystemInfo = ExAllocatePool(NonPagedPool, cbBuffer);
  110.             if (pSystemInfo == NULL) //申请空间失败，返回
  111.             {
  112.                 return 1;
  113.             }
  114.             status = ZwQuerySystemInformation(SystemProcessInformation, pSystemInfo, cbBuffer, NULL );
  115.             if (status == STATUS_INFO_LENGTH_MISMATCH) //空间不足
  116.             {
  117.                 ExFreePool(pSystemInfo);
  118.                 cbBuffer *= 2;
  119.             }
  120.             else if(!NT_SUCCESS(status))
  121.             {
  122.                 ExFreePool(pSystemInfo);
  123.                 return 1;
  124.             }
  125.       
  126.         } while(status == STATUS_INFO_LENGTH_MISMATCH); //如果是空间不足，就一直循环
  127.       
  128.         pInfo = (PSYSTEM_PROCESS_INFORMATION)pSystemInfo; //把得到的信息放到pInfo中
  129.       
  130.         for (;;)
  131.         {
  132.             LPWSTR pszProcessName = pInfo->ImageName.Buffer;
  133.             if (pszProcessName == NULL)
  134.             {
  135.                 pszProcessName = L"NULL";
  136.             }
  137.             KdPrint(("PID:%d, process name:%Sn", pInfo->ProcessId, pszProcessName));
  138.             if (pInfo->NextEntryOffset == 0) //==0，说明到达进程链的尾部了
  139.             {
  140.                 break;
  141.             }
  142.             pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo) + pInfo->NextEntryOffset); //遍历
  143.       
  144.         }
  145.         return STATUS_SUCCESS;
  146.     }
  147.       
  148.     NTSTATUS DriverEntry(
  149.         __in PDRIVER_OBJECT DriverObject,
  150.         __in PUNICODE_STRING RegistryPath
  151.         )
  152.     {
  153.         DriverObject->DriverUnload = Unload;
  154.         Ring0EnumProcess();
  155.         return STATUS_SUCCESS;
  156.     }

阅读(3645) | 评论(0) | 转发(0) |
0

上一篇：VC/NSIS 设置环境变量

下一篇：锂电池在线充放电管理电路的设计

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6