探测Windows2K/XP/2003本机系统信息

下载本文示例代码
Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服务。平常我们总是调用MS为我们提供的公用的Win32 API函数来实现来实现我们系统的功能。（PS：前不久，偶写了一个Windows任务管理器，支持对桌面，进程/线程，系统性能，磁盘，环境变量，事件日志，网络，设备驱动，Win32服务，共享，用户，系统及关机等信息的探测和控制，完全基于Win32 API，大家可以到我们的主页下载）。今天我们要谈的是如何通过本机系统服务(Native API）来探测本机系统信息。当然，微软没有为我们提供关于本机系统服务的文档(Undocumented)，也就是不会为对它的使用提供任何的保证，所以我们不提倡使用Native API来开发软件。不过在特殊情况下，本机系统服务却为我们提供了通向“秘密”的捷径。本文提到的信息仅在Windows2000/XP/2003上测试过。

今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包括对某些信息的控制和设置。以下是这个函数的原型：

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

                 (IN      SYSTEM_INFORMATION_CLASS SystemInformationClass,

		    IN OUT  PVOID                    SystemInformation,

		    IN      ULONG                    SystemInformationLength,

		    OUT     PULONG                   ReturnLength  OPTIONAL);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

从中可以看到，SystemInformationClass是一个类型信息，它大概提供了50余种信息，也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针，它为我们提供需要获得的信息，或是我们需要设置的系统信息。SystemInformationLength是SystemInformation的长度，它根据探测的信息类型来决定。至于ReturnLength则是系统返回的需要的长度，通常可以设置为空指针(NULL)。

首先，我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了，所以我就不在老生常谈了，呵呵。那么就提出这个结构类型的定义：

typedef struct _SYSTEM_PROCESSES

{

	ULONG          NextEntryDelta;          //构成结构序列的偏移量；

	ULONG          ThreadCount;             //线程数目；

	ULONG          Reserved1[6];           

	LARGE_INTEGER  CreateTime;              //创建时间；

	LARGE_INTEGER  UserTime;                //用户模式(Ring 3)的CPU时间；

	LARGE_INTEGER  KernelTime;              //内核模式(Ring 0)的CPU时间；

	UNICODE_STRING ProcessName;             //进程名称；

	KPRIORITY      BasePriority;            //进程优先权；

	ULONG          ProcessId;               //进程标识符；

	ULONG          InheritedFromProcessId;  //父进程的标识符；

	ULONG          HandleCount;             //句柄数目；

	ULONG          Reserved2[2];

	VM_COUNTERS    VmCounters;              //虚拟存储器的结构，见下；

	IO_COUNTERS    IoCounters;              //IO计数结构，见下；

	SYSTEM_THREADS Threads[1];              //进程相关线程的结构数组，见下；

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;




typedef struct _SYSTEM_THREADS

{

	LARGE_INTEGER KernelTime;               //CPU内核模式使用时间；

	LARGE_INTEGER UserTime;                 //CPU用户模式使用时间；

	LARGE_INTEGER CreateTime;               //线程创建时间；

	ULONG         WaitTime;                 //等待时间；

	PVOID         StartAddress;             //线程开始的虚拟地址；

	CLIENT_ID     ClientId;                 //线程标识符；

	KPRIORITY     Priority;                 //线程优先级；

	KPRIORITY     BasePriority;             //基本优先级；

	ULONG         ContextSwitchCount;       //环境切换数目；

	THREAD_STATE  State;                    //当前状态；

	KWAIT_REASON  WaitReason;               //等待原因；

}SYSTEM_THREADS,*PSYSTEM_THREADS;




typedef struct _VM_COUNTERS

{

	ULONG PeakVirtualSize;                  //虚拟存储峰值大小；

	ULONG VirtualSize;                      //虚拟存储大小；

	ULONG PageFaultCount;                   //页故障数目；

	ULONG PeakWorkingSetSize;               //工作集峰值大小；

	ULONG WorkingSetSize;                   //工作集大小；

	ULONG QuotaPeakPagedPoolUsage;          //分页池使用配额峰值；

	ULONG QuotaPagedPoolUsage;              //分页池使用配额；

	ULONG QuotaPeakNonPagedPoolUsage;       //非分页池使用配额峰值；

	ULONG QuotaNonPagedPoolUsage;           //非分页池使用配额；

	ULONG PagefileUsage;                    //页文件使用情况；

	ULONG PeakPagefileUsage;                //页文件使用峰值；

}VM_COUNTERS,*PVM_COUNTERS;



typedef struct _IO_COUNTERS

{

	LARGE_INTEGER ReadOperationCount;       //I/O读操作数目；

	LARGE_INTEGER WriteOperationCount;      //I/O写操作数目；

	LARGE_INTEGER OtherOperationCount;      //I/O其他操作数目；

	LARGE_INTEGER ReadTransferCount;        //I/O读数据数目；

	LARGE_INTEGER WriteTransferCount;       //I/O写数据数目；

	LARGE_INTEGER OtherTransferCount;       //I/O其他操作数据数目；

}IO_COUNTERS,*PIO_COUNTERS;

以上这些信息应该是比较全面的了，在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式，在Windows2K/XP/2003都支持它们。

现在，我们来看看系统的性能信息，性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70余种系统性能方面的信息，真是太丰富了，请慢慢体会~

typedef struct _SYSTEM_PERFORMANCE_INFORMATION

{

	LARGE_INTEGER  IdleTime;                    //CPU空闲时间；

	LARGE_INTEGER  ReadTransferCount;           //I/O读操作数目；

	LARGE_INTEGER  WriteTransferCount;          //I/O写操作数目；

	LARGE_INTEGER  OtherTransferCount;          //I/O其他操作数目；

	ULONG          ReadOperationCount;          //I/O读数据数目；

	ULONG          WriteOperationCount;         //I/O写数据数目；

	ULONG          OtherOperationCount;         //I/O其他操作数据数目；

	ULONG          AvailablePages;              //可获得的页数目；

	ULONG          TotalCommittedPages;         //总共提交页数目；

	ULONG          TotalCommitLimit;            //已提交页数目；

	ULONG          PeakCommitment;              //页提交峰值；

	ULONG          PageFaults;                  //页故障数目；

	ULONG          WriteCopyFaults;             //Copy-On-Write故障数目；

	ULONG          TransitionFaults;            //软页故障数目；

	ULONG          Reserved1;

	ULONG          DemandZeroFaults;            //需求0故障数；

	ULONG          PagesRead;                   //读页数目；

	ULONG          PageReadIos;                 //读页I/O操作数；

	ULONG          Reserved2[2];

	ULONG          PagefilePagesWritten;        //已写页文件页数；

	ULONG          PagefilePageWriteIos;        //已写页文件操作数；

	ULONG          MappedFilePagesWritten;      //已写映射文件页数；

	ULONG          MappedFileWriteIos;          //已写映射文件操作数；

	ULONG          PagedPoolUsage;              //分页池使用；

	ULONG          NonPagedPoolUsage;           //非分页池使用；

	ULONG          PagedPoolAllocs;             //分页池分配情况；

	ULONG          PagedPoolFrees;              //分页池释放情况；

	ULONG          NonPagedPoolAllocs;          //非分页池分配情况；

	ULONG          NonPagedPoolFress;           //非分页池释放情况；

	ULONG          TotalFreeSystemPtes;         //系统页表项释放总数；

	ULONG          SystemCodePage;              //操作系统代码页数；

	ULONG          TotalSystemDriverPages;      //可分页驱动程序页数；

	ULONG          TotalSystemCodePages;        //操作系统代码页总数；

	ULONG          SmallNonPagedLookasideListAllocateHits; //小非分页侧视列表分配次数；

	ULONG          SmallPagedLookasideListAllocateHits;    //小分页侧视列表分配次数；

	ULONG          Reserved3;                   

	ULONG          MmSystemCachePage;          //系统缓存页数；

	ULONG          PagedPoolPage;              //分页池页数；

	ULONG          SystemDriverPage;           //可分页驱动页数；

	ULONG          FastReadNoWait;             //异步快速读数目；

	ULONG          FastReadWait;               //同步快速读数目；

	ULONG          FastReadResourceMiss;       //快速读资源冲突数；

	ULONG          FastReadNotPossible;        //快速读失败数；

	ULONG          FastMdlReadNoWait;          //异步MDL快速读数目；

	ULONG          FastMdlReadWait;            //同步MDL快速读数目；

	ULONG          FastMdlReadResourceMiss;    //MDL读资源冲突数；

	ULONG          FastMdlReadNotPossible;     //MDL读失败数；

	ULONG          MapDataNoWait;              //异步映射数据次数；

	ULONG          MapDataWait;                //同步映射数据次数；

	ULONG          MapDataNoWaitMiss;          //异步映射数据冲突次数；

	ULONG          MapDataWaitMiss;            //同步映射数据冲突次数；

	ULONG          PinMappedDataCount;         //牵制映射数据数目；

	ULONG          PinReadNoWait;              //牵制异步读数目；

	ULONG          PinReadWait;                //牵制同步读数目；

	ULONG          PinReadNoWaitMiss;          //牵制异步读冲突数目；

	ULONG          PinReadWaitMiss;            //牵制同步读冲突数目；

	ULONG          CopyReadNoWait;             //异步拷贝读次数；

	ULONG          CopyReadWait;               //同步拷贝读次数；

	ULONG          CopyReadNoWaitMiss;         //异步拷贝读故障次数；

	ULONG          CopyReadWaitMiss;           //同步拷贝读故障次数；

	ULONG          MdlReadNoWait;              //异步MDL读次数；

	ULONG          MdlReadWait;                //同步MDL读次数；

	ULONG          MdlReadNoWaitMiss;          //异步MDL读故障次数；



	ULONG          MdlReadWaitMiss;            //同步MDL读故障次数；

	ULONG          ReadAheadIos;               //向前读操作数目；

	ULONG          LazyWriteIos;               //LAZY写操作数目；

	ULONG          LazyWritePages;             //LAZY写页文件数目；

	ULONG          DataFlushes;                //缓存刷新次数；

	ULONG          DataPages;                  //缓存刷新页数；

	ULONG          ContextSwitches;            //环境切换数目；

	ULONG          FirstLevelTbFills;          //第一层缓冲区填充次数；

	ULONG          SecondLevelTbFills;         //第二层缓冲区填充次数；

	ULONG          SystemCall;                 //系统调用次数；

}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

现在看到的是结构SYSTEM_PROCESSOR_TIMES提供的系统处理器的使用情况，包括各种情况下的使用时间及中断数目：

typedef struct __SYSTEM_PROCESSOR_TIMES

{

	LARGE_INTEGER IdleTime;               //空闲时间；

	LARGE_INTEGER KernelTime;             //内核模式时间；

	LARGE_INTEGER UserTime;               //用户模式时间；

	LARGE_INTEGER DpcTime;                //延迟过程调用时间；

	LARGE_INTEGER InterruptTime;          //中断时间；

	ULONG         InterruptCount;         //中断次数；

}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

页文件的使用情况，SYSTEM_PAGEFILE_INFORMATION提供了所需的相关信息：

typedef struct _SYSTEM_PAGEFILE_INFORMATION

{

	ULONG NetxEntryOffset;                //下一个结构的偏移量；

	ULONG CurrentSize;                    //当前页文件大小；

	ULONG TotalUsed;                      //当前使用的页文件数；

	ULONG PeakUsed;                       //当前使用的页文件峰值数；

	UNICODE_STRING FileName;              //页文件的文件名称；

}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

系统高速缓存的使用情况参见结构SYSTEM_CACHE_INFORMATION提供的信息：

typedef struct _SYSTEM_CACHE_INFORMATION

{

	ULONG SystemCacheWsSize;              //高速缓存大小；

	ULONG SystemCacheWsPeakSize;          //高速缓存峰值大小；

	ULONG SystemCacheWsFaults;            //高速缓存页故障数目；

	ULONG SystemCacheWsMinimum;           //高速缓存最小页大小；

	ULONG SystemCacheWsMaximum;           //高速缓存最大页大小；

	ULONG TransitionSharedPages;          //共享页数目；

	ULONG TransitionSharedPagesPeak;      //共享页峰值数目；

	ULONG Reserved[2];

}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

附录：(所有完整源代码，您可以到我们FZ5FZ的主页下载)。
1.T-PMList的头文件源代码：

#ifndef T_PMLIST_H

#define T_PMLIST_H



#include 

#include 



#define NT_PROCESSTHREAD_INFO        0x05

#define MAX_INFO_BUF_LEN             0x500000

#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)

#define STATUS_INFO_LENGTH_MISMATCH  ((NTSTATUS)0xC0000004L)



typedef LONG NTSTATUS;



typedef struct _LSA_UNICODE_STRING

{

	USHORT  Length;

	USHORT  MaximumLength;

	PWSTR   Buffer;

}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;

typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;



typedef struct _CLIENT_ID

{

	HANDLE UniqueProcess;

	HANDLE UniqueThread;

}CLIENT_ID;

typedef CLIENT_ID *PCLIENT_ID;



typedef LONG KPRIORITY;



typedef struct _VM_COUNTERS

{

	ULONG PeakVirtualSize;

	ULONG VirtualSize;

	ULONG PageFaultCount;

	ULONG PeakWorkingSetSize;

	ULONG WorkingSetSize;

	ULONG QuotaPeakPagedPoolUsage;

	ULONG QuotaPagedPoolUsage;

	ULONG QuotaPeakNonPagedPoolUsage;

	ULONG QuotaNonPagedPoolUsage;

	ULONG PagefileUsage;

	ULONG PeakPagefileUsage;

}VM_COUNTERS,*PVM_COUNTERS;



typedef struct _IO_COUNTERS

{

	LARGE_INTEGER ReadOperationCount;

	LARGE_INTEGER WriteOperationCount;

	LARGE_INTEGER OtherOperationCount;

	LARGE_INTEGER ReadTransferCount;

	LARGE_INTEGER WriteTransferCount;

	LARGE_INTEGER OtherTransferCount;

}IO_COUNTERS,*PIO_COUNTERS;



typedef enum _THREAD_STATE

{

	StateInitialized,

	StateReady,

	StateRunning,

	StateStandby,

	StateTerminated,

	StateWait,

	StateTransition,

	StateUnknown

}THREAD_STATE;



typedef enum _KWAIT_REASON

{

	Executive,

	FreePage,

	PageIn,

	PoolAllocation,

	DelayExecution,

	Suspended,

	UserRequest,

	WrExecutive,

	WrFreePage,

	WrPageIn,

	WrPoolAllocation,

	WrDelayExecution,

	WrSuspended,

	WrUserRequest,

	WrEventPair,

	WrQueue,

	WrLpcReceive,

	WrLpcReply,

	WrVertualMemory,

	WrPageOut,

	WrRendezvous,

	Spare2,

	Spare3,

	Spare4,

	Spare5,

	Spare6,

	WrKernel

}KWAIT_REASON;



typedef struct _SYSTEM_THREADS

{

	LARGE_INTEGER KernelTime;

	LARGE_INTEGER UserTime;

	LARGE_INTEGER CreateTime;

	ULONG         WaitTime;

	PVOID         StartAddress;

	CLIENT_ID     ClientId;

	KPRIORITY     Priority;

	KPRIORITY     BasePriority;

	ULONG         ContextSwitchCount;

	THREAD_STATE  State;

	KWAIT_REASON  WaitReason;

}SYSTEM_THREADS,*PSYSTEM_THREADS;



typedef struct _SYSTEM_PROCESSES

{

	ULONG          NextEntryDelta;

	ULONG          ThreadCount;

	ULONG          Reserved1[6];

	LARGE_INTEGER  CreateTime;

	LARGE_INTEGER  UserTime;

	LARGE_INTEGER  KernelTime;

	UNICODE_STRING ProcessName;

	KPRIORITY      BasePriority;

	ULONG          ProcessId;

	ULONG          InheritedFromProcessId;

	ULONG          HandleCount;

	ULONG          Reserved2[2];

	VM_COUNTERS    VmCounters;

	IO_COUNTERS    IoCounters;

	SYSTEM_THREADS Threads[1];

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;



typedef DWORD    SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

                 (IN     SYSTEM_INFORMATION_CLASS,

		    IN OUT PVOID,

		    IN     ULONG,

		    OUT    PULONG OPTIONAL);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;



DWORD EnumProcess()

{

       PSYSTEM_PROCESSES  pSystemProc;

	HMODULE            hNtDll         = NULL;

	LPVOID             lpSystemInfo   = NULL;

	DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;

	DWORD              dwTotalProcess = 0;

	DWORD              dwReturnLength;

	NTSTATUS           Status; 

	LONGLONG           llTempTime;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

           	if(hNtDll == NULL)

		{

            		printf("LoadLibrary Error: %d\n",GetLastError());

       		__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

          	if(NtQuerySystemInformation == NULL)

		{

       		printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

        		__leave;

		}



		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);

		Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,

			                           lpSystemInfo,

							dwNumberBytes,

							&dwReturnLength);

		if(Status == STATUS_INFO_LENGTH_MISMATCH)

		{

			printf("STATUS_INFO_LENGTH_MISMATCH\n");

			__leave;

		}

		else if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		printf("%-20s%6s%7s%8s%6s%7s%7ss\n","ProcessName","PID","PPID","WsSize","Prio.","Thread","Handle","CPU Time");

		printf("--------------------------------------------------------------------------\n");

		pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;

		while(pSystemProc->NextEntryDelta != 0)

		{

			if(pSystemProc->ProcessId != 0)

			{

				wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);

			}

			else

			{

				wprintf(L"%-20s",L"System Idle Process");

			}

			printf("m",pSystemProc->ProcessId);

			printf("}",pSystemProc->InheritedFromProcessId);

			printf("}K",pSystemProc->VmCounters.WorkingSetSize/1024);

			printf("m",pSystemProc->BasePriority);

			printf("}",pSystemProc->ThreadCount);

			printf("}",pSystemProc->HandleCount);

			llTempTime  = pSystemProc->KernelTime.QuadPart   pSystemProc->UserTime.QuadPart;

			llTempTime /= 10000;

			printf("=:",llTempTime/(60*60*1000));

			llTempTime %= 60*60*1000;

			printf("%.2d:",llTempTime/(60*1000));

			llTempTime %= 60*1000;

			printf("%.2d.",llTempTime/1000);

			llTempTime %= 1000;

			printf("%.3d",llTempTime);



			printf("\n");

			dwTotalProcess   ;

			pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc   pSystemProc->NextEntryDelta);

		}

		printf("--------------------------------------------------------------------------\n");

		printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);

		printf("PID\t ==> Process Identification\n");

		printf("PPID\t ==> Parent Process Identification\n");

		printf("WsSize\t ==> Working Set Size\n");

		printf("Prio.\t ==> Base Priority\n");

		printf("Thread\t ==> Thread Count\n");

		printf("Handle\t ==> Handle Count\n");

		printf("CPU Time ==> Processor Time\n");

	}

	__finally

	{

		if(lpSystemInfo != NULL)

		{

			free(lpSystemInfo);

		}

		if(hNtDll != NULL)

		{

       		FreeLibrary(hNtDll);

		}

	}



	return 0;

}



DWORD SpeciProcess(DWORD dwPID)

{

       PSYSTEM_PROCESSES  pSystemProc    = NULL;

	PSYSTEM_THREADS    pSystemThre    = NULL;  

	HMODULE            hNtDll         = NULL;

	LPVOID             lpSystemInfo   = NULL;

	DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;

	DWORD              dwTotalProcess = 0;

	DWORD              dwReturnLength;

	NTSTATUS           Status; 

	LONGLONG           llTempTime;

	ULONG              ulIndex;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

           	if(hNtDll == NULL)

		{

           		printf("LoadLibrary Error: %d\n",GetLastError());

      	       	__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

     	if(NtQuerySystemInformation == NULL)

		{

       		printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

    	       	__leave;

		}



		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);

		Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,

			                           lpSystemInfo,

							dwNumberBytes,

							&dwReturnLength);

		if(Status == STATUS_INFO_LENGTH_MISMATCH)

		{

			printf("STATUS_INFO_LENGTH_MISMATCH\n");

			__leave;

		}

		else if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;

		while(pSystemProc->NextEntryDelta != 0)

		{

			if(pSystemProc->ProcessId == dwPID)

			{

				printf("ProcessName:\t\t ");

				if(pSystemProc->ProcessId != 0)

				{

					wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);

				}

				else

				{

					wprintf(L"%-20s\n",L"System Idle Process");

				}

				printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);

				printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);



				printf("KernelTime:\t\t ");

				llTempTime  = pSystemProc->KernelTime.QuadPart;

				llTempTime /= 10000;

				printf("%d:",llTempTime/(60*60*1000));

				llTempTime %= 60*60*1000;

				printf("%.2d:",llTempTime/(60*1000));

				llTempTime %= 60*1000;

				printf("%.2d.",llTempTime/1000);

				llTempTime %= 1000;

				printf("%.3d\t",llTempTime);



				printf("UserTime:\t\t");

				llTempTime  = pSystemProc->UserTime.QuadPart;

				llTempTime /= 10000;

				printf("%d:",llTempTime/(60*60*1000));

				llTempTime %= 60*60*1000;

				printf("%.2d:",llTempTime/(60*1000));

				llTempTime %= 60*1000;

				printf("%.2d.",llTempTime/1000);

				llTempTime %= 1000;

				printf("%.3d\n",llTempTime);



				printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart   pSystemProc->UserTime.QuadPart));

				printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart   pSystemProc->UserTime.QuadPart));



				printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);

				printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);



				printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);

				printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount);



				printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorkingSetSize/1024);

				printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize/1024);



				printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPagedPoolUsage/1024);

				printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);



				printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage/1024);

				printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);



				printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsage/1024);

				printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);



				printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualSize/1024);

				printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);



				printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCount);

				printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperationCount);



				printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCount);

				printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);



				printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCount);

				printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);



				printf("%-5s%3s%4s%5s%5ssss%7s%6s%9s\n","TID","Pri","BPr","Priv","User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");

           		printf("-------------------------------------------------------------------------------\n");



				for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex  )

				{

					pSystemThre = &pSystemProc->Threads[ulIndex];

					printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);



				       printf("=",pSystemProc->Threads[ulIndex].Priority);

					printf("M",pSystemProc->Threads[ulIndex].BasePriority);



	    			printf("M%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart   pSystemProc->UserTime.QuadPart));

	     			printf("M%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart   pSystemProc->UserTime.QuadPart));



					llTempTime  = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;

					llTempTime /= 10000;

					printf("-:",llTempTime/(60*60*1000));

					llTempTime %= 60*60*1000;

					printf("%.2d.",llTempTime/(60*1000));

					llTempTime %= 60*1000;

					printf("%.2d.",llTempTime/1000);

					llTempTime %= 100;

					printf("%.2d ",llTempTime);



					llTempTime  = pSystemProc->Threads[ulIndex].UserTime.QuadPart;

					llTempTime /= 10000;

					printf("-:",llTempTime/(60*60*1000));

					llTempTime %= 60*60*1000;

					printf("%.2d.",llTempTime/(60*1000));

					llTempTime %= 60*1000;

					printf("%.2d.",llTempTime/1000);

					llTempTime %= 100;

					printf("%.2d ",llTempTime);



					printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);

					printf("}",pSystemProc->Threads[ulIndex].ContextSwitchCount);



					switch(pSystemProc->Threads[ulIndex].State)

					{

					case StateInitialized:

						printf("%6s","Init.");

						break;

					case StateReady:

						printf("%6s","Ready");

						break;

					case StateRunning:

						printf("%6s","Run");

						break;

					case StateStandby:

						printf("%6s","StBy.");

						break;

					case StateTerminated:

						printf("%6s","Term.");

						break;

					case StateWait:

						printf("%6s","Wait");

						break;

					case StateTransition:

						printf("%6s","Tran.");

						break;

					case StateUnknown:

						printf("%6s","Unkn.");

						break;

					default:

						printf("%6s","Unkn.");

						break;

					}



					switch(pSystemProc->Threads[ulIndex].WaitReason)

					{

					case Executive:

						printf(" %-8s","Executi.");

						break;

					case FreePage:

						printf(" %-8s","FreePag.");

						break;

					case PageIn:

						printf(" %-8s","PageIn");

						break;

					case PoolAllocation:

						printf(" %-8s","PoolAll.");

						break;

					case DelayExecution:

						printf(" %-8s","DelayEx.");

						break;

					case Suspended:

						printf(" %-8s","Suspend.");

						break;

					case UserRequest:

						printf(" %-8s","UserReq.");

						break;

					case WrExecutive:

						printf(" %-8s","WrExect.");

						break;

					case WrFreePage:

						printf(" %-8s","WrFrePg.");

						break;

					case WrPageIn:

						printf(" %-8s","WrPageIn");

						break;

					case WrPoolAllocation:

						printf(" %-8s","WrPoolA.");

						break;

					case WrSuspended:

						printf(" %-8s","WrSuspe.");

						break;

					case WrUserRequest:

						printf(" %-8s","WrUsReq.");

						break;

					case WrEventPair:

						printf(" %-8s","WrEvent.");

						break;

					case WrQueue:

						printf(" %-8s","WrQueue");

						break;

					case WrLpcReceive:

						printf(" %-8s","WrLpcRv.");

						break;

					case WrLpcReply:

						printf(" %-8s","WrLpcRp.");

						break;

					case WrVertualMemory:

						printf(" %-8s","WrVerMm.");

						break;

					case WrPageOut:

						printf(" %-8s","WrPgOut.");

						break;

					case WrRendezvous:

						printf(" %-8s","WrRende.");

						break;

					case WrKernel:

						printf(" %-8s","WrKernel");

						break;

					default:

						printf(" %-8s","Unknown");

						break;

					}

        		       	printf("\n");

				}

        	        	printf("-------------------------------------------------------------------------------\n\n");

        	          	printf("Total %d Thread(s) !\n\n",ulIndex);



				dwTotalProcess   ;

				break;

			}

			pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc   pSystemProc->NextEntryDelta);

		}

	}

	__finally

	{

		if(dwTotalProcess == 0)

		{

			printf("Could not found the %d Process !\n",dwPID);

		}

		else

		{

			printf("TID:\t\t====>\tThread Identification\n");

			printf("Pri:\t\t====>\tPriority\n");

			printf("BPr:\t\t====>\tBase Priority\n");

			printf("Priv:\t\t====>\tPrivilege\n");

			printf("StartAddr:\t====>\tThread Start Address\n");

			printf("CSwitC:\t\t====>\tContext Switch Count\n");

			printf("WtReason:\t====>\tWait Reason\n");

		}

		if(lpSystemInfo != NULL)

		{

			free(lpSystemInfo);

		}

		if(hNtDll != NULL)

		{

       		FreeLibrary(hNtDll);

		}

	}



	return 0;

}



VOID Start()

{

	printf("T-PMList, by TOo2y\n");

	printf("E-mail: [e-mail]\n");

	printf("HomePage: \n");

	printf("Date: 05-10-2003\n\n");

	return ;

}



VOID Usage()

{

	printf("Usage:\tT-PMList  [-e] | [-s PID]\n"); 

	printf("  -e\t  Enumerate All Processes\n");

	printf("  -s PID  Show Special Process Information with PID\n\n");

	return ;

}



#endif



2.T-PMPerf的头文件源代码：



#ifndef T_PMPERF_H

#define T_PMPERF_H



#include "windows.h"

#include "stdio.h"



#define SYSTEM_PERF_INFO             0x02

#define SYSTEM_PROC_TIME             0x08

#define SYSTEM_PAGE_INFO             0x12

#define SYSTEM_CACHE_INFO            0x15

#define MAX_INFO_BUF_LEN             0x500000

#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)



typedef LONG  NTSTATUS;

typedef DWORD SYSTEM_INFORMATION_CLASS;



typedef struct _LSA_UNICODE_STRING

{

	USHORT  Length;

	USHORT  MaximumLength;

	PWSTR   Buffer;

}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;

typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;



typedef struct _SYSTEM_PERFORMANCE_INFORMATION

{

	LARGE_INTEGER  IdleTime;

	LARGE_INTEGER  ReadTransferCount;

	LARGE_INTEGER  WriteTransferCount;

	LARGE_INTEGER  OtherTransferCount;

	ULONG          ReadOperationCount;

	ULONG          WriteOperationCount;

	ULONG          OtherOperationCount;

	ULONG          AvailablePages;

	ULONG          TotalCommittedPages;

	ULONG          TotalCommitLimit;

	ULONG          PeakCommitment;

	ULONG          PageFaults;

	ULONG          WriteCopyFaults;

	ULONG          TransitionFaults;

	ULONG          Reserved1;

	ULONG          DemandZeroFaults;

	ULONG          PagesRead;

	ULONG          PageReadIos;

	ULONG          Reserved2[2];

	ULONG          PagefilePagesWritten;

	ULONG          PagefilePageWriteIos;

	ULONG          MappedFilePagesWritten;

	ULONG          MappedFileWriteIos;

	ULONG          PagedPoolUsage;

	ULONG          NonPagedPoolUsage;

	ULONG          PagedPoolAllocs;

	ULONG          PagedPoolFrees;

	ULONG          NonPagedPoolAllocs;

	ULONG          NonPagedPoolFress;

	ULONG          TotalFreeSystemPtes;

	ULONG          SystemCodePage;

	ULONG          TotalSystemDriverPages;

	ULONG          TotalSystemCodePages;

	ULONG          SmallNonPagedLookasideListAllocateHits;

	ULONG          SmallPagedLookasideListAllocateHits;

	ULONG          Reserved3;

	ULONG          MmSystemCachePage;

	ULONG          PagedPoolPage;

	ULONG          SystemDriverPage;

	ULONG          FastReadNoWait;

	ULONG          FastReadWait;

	ULONG          FastReadResourceMiss;

	ULONG          FastReadNotPossible;

	ULONG          FastMdlReadNoWait;

	ULONG          FastMdlReadWait;

	ULONG          FastMdlReadResourceMiss;

	ULONG          FastMdlReadNotPossible;

	ULONG          MapDataNoWait;

	ULONG          MapDataWait;

	ULONG          MapDataNoWaitMiss;

	ULONG          MapDataWaitMiss;

	ULONG          PinMappedDataCount;

	ULONG          PinReadNoWait;

	ULONG          PinReadWait;

	ULONG          PinReadNoWaitMiss;

	ULONG          PinReadWaitMiss;

	ULONG          CopyReadNoWait;

	ULONG          CopyReadWait;

	ULONG          CopyReadNoWaitMiss;

	ULONG          CopyReadWaitMiss;

	ULONG          MdlReadNoWait;

	ULONG          MdlReadWait;

	ULONG          MdlReadNoWaitMiss;

	ULONG          MdlReadWaitMiss;

	ULONG          ReadAheadIos;

	ULONG          LazyWriteIos;

	ULONG          LazyWritePages;

	ULONG          DataFlushes;

	ULONG          DataPages;

	ULONG          ContextSwitches;

	ULONG          FirstLevelTbFills;

	ULONG          SecondLevelTbFills;

	ULONG          SystemCall;

}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;



typedef struct __SYSTEM_PROCESSOR_TIMES

{

	LARGE_INTEGER IdleTime;

	LARGE_INTEGER KernelTime;

	LARGE_INTEGER UserTime;

	LARGE_INTEGER DpcTime;

	LARGE_INTEGER InterruptTime;

	ULONG         InterruptCount;

}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;



typedef struct _SYSTEM_PAGEFILE_INFORMATION

{

	ULONG NetxEntryOffset;

	ULONG CurrentSize;

	ULONG TotalUsed;

	ULONG PeakUsed;

	UNICODE_STRING FileName;

}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;



typedef struct _SYSTEM_CACHE_INFORMATION

{

	ULONG SystemCacheWsSize;

	ULONG SystemCacheWsPeakSize;

	ULONG SystemCacheWsFaults;

	ULONG SystemCacheWsMinimum;

	ULONG SystemCacheWsMaximum;

	ULONG TransitionSharedPages;

	ULONG TransitionSharedPagesPeak;

	ULONG Reserved[2];

}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;



typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)

                 (IN     SYSTEM_INFORMATION_CLASS,

		    IN OUT PVOID,

		    INT    ULONG,

	           OUT    PULONG OPTION);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;



DWORD PerfInfo()

{

	SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;

	HMODULE         hNtDll = NULL;

	DWORD           dwNumberBytes;

	DWORD           dwReturnLength;

	NTSTATUS        Status;

	LONGLONG        llTempTime;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

	       if(hNtDll == NULL)

		{

	           	printf("LoadLibrary Error: %d\n",GetLastError());

	          	__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

		if(NtQuerySystemInformation == NULL)

		{

			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);

		Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,

			                           &SystemPerfInfo,

							dwNumberBytes,

							&dwReturnLength);

		if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError());

			__leave;

		}



		printf("IdleTime:\t\t");

		llTempTime  = SystemPerfInfo.IdleTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);

		printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);

		printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);

		printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);

		printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);

		printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);



		printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);

		printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);

		printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);

		printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);



		printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);

		printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);

		printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);

		printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);



		printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);

		printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);

		printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);

		printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);

		printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWritten);

		printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);



		printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);

		printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);

		printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);

		printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);

		printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);

		printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);



		printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);

		printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);

		printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);

		printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages);

		printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);

		printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);



		printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);

		printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);

		printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);

		printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);

		printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);

		printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);

		printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossible);

		printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss);





		printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);

		printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);

		printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);

		printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);



		printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);

		printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);

		printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);

		printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);

		printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);

		printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);



		printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);

		printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);

		printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);

		printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);

		printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);

		printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);

		printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);

		printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);



		printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);

		printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);

		printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);

		printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);

		printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);

		printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);

		printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);

		printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);



		printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);

		printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPagedLookasideListAllocateHits);

		printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);



	}

	__finally

	{

		if(hNtDll != NULL)

		{

			FreeLibrary(hNtDll);

		}

	}



	return 0;

}



DWORD ProcTime()

{

	SYSTEM_PROCESSOR_TIMES  SystemProcTime;

	HMODULE                 hNtDll = NULL;

	DWORD                   dwNumberBytes;

	DWORD                   dwReturnLength;

	NTSTATUS                Status;

	LONGLONG                llTempTime;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

	       if(hNtDll == NULL)

		{

	         	printf("LoadLibrary Error: %d\n",GetLastError());

	       	__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

		if(NtQuerySystemInformation == NULL)

		{

			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);

		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

		if(NtQuerySystemInformation == NULL)

		{

			printf("GetProcAddress Error: %d\n",GetLastError());

			__leave;

		}



		Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,

			                           &SystemProcTime,

							dwNumberBytes,

							&dwReturnLength);

		if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastError());

			__leave;

		}



		printf("IdleTime:\t\t");

		llTempTime  = SystemProcTime.IdleTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("KernelTime:\t\t");

		llTempTime  = SystemProcTime.KernelTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("UserTime:\t\t");

		llTempTime  = SystemProcTime.UserTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("DpcTime:\t\t");

		llTempTime  = SystemProcTime.DpcTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("InterruptTime:\t\t");

		llTempTime  = SystemProcTime.InterruptTime.QuadPart;

		llTempTime /= 10000;

		printf("%d:",llTempTime/(60*60*1000));

		llTempTime %= 60*60*1000;

		printf("%.2d:",llTempTime/(60*1000));

		llTempTime %= 60*1000;

		printf("%.2d.",llTempTime/1000);

		llTempTime %= 1000;

		printf("%.3d\n",llTempTime);



		printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);



	}

	__finally

	{

		if(hNtDll != NULL)

		{

			FreeLibrary(hNtDll);

		}

	}



	return 0;

}



DWORD PagefileInfo()

{

	PSYSTEM_PAGEFILE_INFORMATION   pSystemPagefileInfo;

	PVOID                          pBuffer;

	HMODULE                        hNtDll = NULL;

	DWORD                          dwNumberBytes;

	DWORD                          dwReturnLength;

       NTSTATUS                       Status;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

	       if(hNtDll == NULL)

		{

	         	printf("LoadLibrary Error: %d\n",GetLastError());

	        	__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

		if(NtQuerySystemInformation == NULL)

		{

			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		dwNumberBytes = MAX_INFO_BUF_LEN;

		pBuffer = (LPVOID)malloc(dwNumberBytes);

		Status  = NtQuerySystemInformation(SYSTEM_PAGE_INFO,

			                            pBuffer,

							 dwNumberBytes,

							 &dwReturnLength);

		if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());

			__leave;

		}



		pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;

		do

		{

			printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);

			printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);

			printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);

			wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);



			pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer   pSystemPagefileInfo->NetxEntryOffset);

		}while(pSystemPagefileInfo->NetxEntryOffset != 0);

	}

	__finally

	{

		if(pBuffer != NULL)

		{

			free(pBuffer);

		} 

		if(hNtDll  != NULL)

		{

			FreeLibrary(hNtDll);

		}

	}



	return 0;

}



DWORD CacheInfo()

{

	SYSTEM_CACHE_INFORMATION       SystemCacheInfo;

	HMODULE                        hNtDll = NULL;

	DWORD                          dwNumberBytes;

	DWORD                          dwReturnLength;

       NTSTATUS                       Status;



	__try

	{

		hNtDll = LoadLibrary("NtDll.dll");

	       if(hNtDll == NULL)

		{

	        	printf("LoadLibrary Error: %d\n",GetLastError());

	       	__leave;

		}



		NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

		if(NtQuerySystemInformation == NULL)

		{

			printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

			__leave;

		}



		dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);

		Status  = NtQuerySystemInformation(SYSTEM_CACHE_INFO,

			                            &SystemCacheInfo,

							dwNumberBytes,

							&dwReturnLength);

		if(Status != STATUS_SUCCESS)

		{

			printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError());

			__leave;

		}



		printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize/1024);

		printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);

		printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);

		printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);

		printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);

		printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);

		printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);



	}

	__finally

	{

		if(hNtDll != NULL)

		{

			FreeLibrary(hNtDll);

		}

	}



	return 0;

}



VOID Start()

{

	printf("T-PMPerf, by TOo2y\n");

	printf("E-mail: [e-mail]\n");

	printf("HomePage: \n");

	printf("Date: 05-09-2003\n\n");

	return ;

}



VOID Usage()

{

	printf("Usage:\tT-PMPerf \n");

	printf("Option:\n");

	printf("  -Perf   System Performance Information\n");

	printf("  -Proc   System Processor Information\n");

	printf("  -Page   System Pagefile Information\n");

	printf("  -Cache  System Cache Information\n");

	return ;

}



#endif

Reference: 《Windows NT/2000 Native API Reference》。

关于作者：
FZ5FZ，我们主要从事网络/系统安全的学习与研究，深入编程技术的剖析与探讨，坚持原创，追求共享。
FZ5FZ 主页：
下载本文示例代码

输入您的搜索字词 提交搜索表单