Chinaunix首页 | 论坛 | 博客
  • 博客访问: 4117974
  • 博文数量: 671
  • 博客积分: 10010
  • 博客等级: 上将
  • 技术积分: 7310
  • 用 户 组: 普通用户
  • 注册时间: 2006-07-14 09:56
文章分类

全部博文(671)

文章存档

2011年(1)

2010年(2)

2009年(24)

2008年(271)

2007年(319)

2006年(54)

我的朋友

分类: Sybase

2009-03-16 18:19:13

  Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服务。平常我们总是调用MS为我们提供的公用的Win32 API函数来实现来实现我们系统的功能。(PS:前不久,偶写了一个Windows任务管理器,支持对桌面,进程/线程,系统性能,磁盘,环境变量,事件日志,网络,设备驱动,Win32服务,共享,用户,系统及关机等信息的探测和控制,完全基于Win32 API,大家可以到我们的主页下载)。今天我们要谈的是如何通过本机系统服务(Native API)来探测本机系统信息。当然,微软没有为我们提供关于本机系统服务的文档(Undocumented),也就是不会为对它的使用提供任何的保证,所以我们不提倡使用Native API来开发软件。不过在特殊情况下,本机系统服务却为我们提供了通向“秘密”的捷径。本文提到的信息仅在Windows2000/XP/2003上测试过。

  今天,我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然,你不要小看这么一个函数,它却为我们提供了丰富的系统信息,同时还包括对某些信息的控制和设置。以下是这个函数的原型:

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
         (IN   SYSTEM_INFORMATION_CLASS SystemInformationClass,
      IN OUT PVOID          SystemInformation,
      IN   ULONG          SystemInformationLength,
      OUT   PULONG          ReturnLength OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
从中可以看到,SystemInformationClass是一个类型信息,它大概提供了50余种信息,也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针,它为我们提供需要获得的信息,或是我们需要设置的系统信息。SystemInformationLength是SystemInformation的长度,它根据探测的信息类型来决定。至于ReturnLength则是系统返回的需要的长度,通常可以设置为空指针(NULL)。
首先,我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了,所以我就不在老生常谈了,呵呵。那么就提出这个结构类型的定义: typedef struct _SYSTEM_PROCESSES
{
  ULONG     NextEntryDelta;     //构成结构序列的偏移量;
  ULONG     ThreadCount;       //线程数目;
  ULONG     Reserved1[6];     
  LARGE_INTEGER CreateTime;       //创建时间;
  LARGE_INTEGER UserTime;        //用户模式(Ring 3)的CPU时间;
  LARGE_INTEGER KernelTime;       //内核模式(Ring 0)的CPU时间;
  UNICODE_STRING ProcessName;       //进程名称;
  KPRIORITY   BasePriority;      //进程优先权;
  ULONG     ProcessId;        //进程标识符;
  ULONG     InheritedFromProcessId; //父进程的标识符;
  ULONG     HandleCount;       //句柄数目;
  ULONG     Reserved2[2];
  VM_COUNTERS  VmCounters;       //虚拟存储器的结构,见下;
  IO_COUNTERS  IoCounters;       //IO计数结构,见下;
  SYSTEM_THREADS Threads[1];       //进程相关线程的结构数组,见下;
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef struct _SYSTEM_THREADS
{
  LARGE_INTEGER KernelTime;        //CPU内核模式使用时间;
  LARGE_INTEGER UserTime;         //CPU用户模式使用时间;
  LARGE_INTEGER CreateTime;        //线程创建时间;
  ULONG     WaitTime;         //等待时间;
  PVOID     StartAddress;       //线程开始的虚拟地址;
  CLIENT_ID   ClientId;         //线程标识符;
  KPRIORITY   Priority;         //线程优先级;
  KPRIORITY   BasePriority;       //基本优先级;
  ULONG     ContextSwitchCount;    //环境切换数目;
  THREAD_STATE State;          //当前状态;
  KWAIT_REASON WaitReason;        //等待原因;
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _VM_COUNTERS
{
  ULONG PeakVirtualSize;         //虚拟存储峰值大小;
  ULONG VirtualSize;           //虚拟存储大小;
  ULONG PageFaultCount;          //页故障数目;
  ULONG PeakWorkingSetSize;        //工作集峰值大小;
  ULONG WorkingSetSize;          //工作集大小;
  ULONG QuotaPeakPagedPoolUsage;     //分页池使用配额峰值;
  ULONG QuotaPagedPoolUsage;       //分页池使用配额;
  ULONG QuotaPeakNonPagedPoolUsage;    //非分页池使用配额峰值;
  ULONG QuotaNonPagedPoolUsage;      //非分页池使用配额;
  ULONG PagefileUsage;          //页文件使用情况;
  ULONG PeakPagefileUsage;        //页文件使用峰值;
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
  LARGE_INTEGER ReadOperationCount;    //I/O读操作数目;
  LARGE_INTEGER WriteOperationCount;   //I/O写操作数目;
  LARGE_INTEGER OtherOperationCount;   //I/O其他操作数目;
  LARGE_INTEGER ReadTransferCount;    //I/O读数据数目;
  LARGE_INTEGER WriteTransferCount;    //I/O写数据数目;
  LARGE_INTEGER OtherTransferCount;    //I/O其他操作数据数目;
}IO_COUNTERS,*PIO_COUNTERS;
以上这些信息应该是比较全面的了,在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式,在Windows2K/XP/2003都支持它们。

  现在,我们来看看系统的性能信息,性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70余种系统性能方面的信息,真是太丰富了,请慢慢体会~

typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
  LARGE_INTEGER IdleTime;          //CPU空闲时间;
  LARGE_INTEGER ReadTransferCount;      //I/O读操作数目;
  LARGE_INTEGER WriteTransferCount;     //I/O写操作数目;
  LARGE_INTEGER OtherTransferCount;     //I/O其他操作数目;
  ULONG     ReadOperationCount;     //I/O读数据数目;
  ULONG     WriteOperationCount;     //I/O写数据数目;
  ULONG     OtherOperationCount;     //I/O其他操作数据数目;
  ULONG     AvailablePages;       //可获得的页数目;
  ULONG     TotalCommittedPages;     //总共提交页数目;
  ULONG     TotalCommitLimit;      //已提交页数目;
  ULONG     PeakCommitment;       //页提交峰值;
  ULONG     PageFaults;         //页故障数目;
  ULONG     WriteCopyFaults;       //Copy-On-Write故障数目;
  ULONG     TransitionFaults;      //软页故障数目;
  ULONG     Reserved1;
  ULONG     DemandZeroFaults;      //需求0故障数;
  ULONG     PagesRead;          //读页数目;
  ULONG     PageReadIos;         //读页I/O操作数;
  ULONG     Reserved2[2];
  ULONG     PagefilePagesWritten;    //已写页文件页数;
  ULONG     PagefilePageWriteIos;    //已写页文件操作数;
  ULONG     MappedFilePagesWritten;   //已写映射文件页数;
  ULONG     MappedFileWriteIos;     //已写映射文件操作数;
  ULONG     PagedPoolUsage;       //分页池使用;
  ULONG     NonPagedPoolUsage;      //非分页池使用;
  ULONG     PagedPoolAllocs;       //分页池分配情况;
  ULONG     PagedPoolFrees;       //分页池释放情况;
  ULONG     NonPagedPoolAllocs;     //非分页池分配情况;
  ULONG     NonPagedPoolFress;      //非分页池释放情况;
  ULONG     TotalFreeSystemPtes;     //系统页表项释放总数;
  ULONG     SystemCodePage;       //操作系统代码页数;
  ULONG     TotalSystemDriverPages;   //可分页驱动程序页数;
  ULONG     TotalSystemCodePages;    //操作系统代码页总数;
  ULONG     SmallNonPagedLookasideListAllocateHits; //小非分页侧视列表分配次数;
  ULONG     SmallPagedLookasideListAllocateHits;  //小分页侧视列表分配次数;
  ULONG     Reserved3;         
  ULONG     MmSystemCachePage;     //系统缓存页数;
  ULONG     PagedPoolPage;       //分页池页数;
  ULONG     SystemDriverPage;      //可分页驱动页数;
  ULONG     FastReadNoWait;       //异步快速读数目;
  ULONG     FastReadWait;        //同步快速读数目;
  ULONG     FastReadResourceMiss;    //快速读资源冲突数;
  ULONG     FastReadNotPossible;    //快速读失败数;
  ULONG     FastMdlReadNoWait;     //异步MDL快速读数目;
  ULONG     FastMdlReadWait;      //同步MDL快速读数目;
  ULONG     FastMdlReadResourceMiss;  //MDL读资源冲突数;
  ULONG     FastMdlReadNotPossible;   //MDL读失败数;
  ULONG     MapDataNoWait;       //异步映射数据次数;
  ULONG     MapDataWait;        //同步映射数据次数;
  ULONG     MapDataNoWaitMiss;     //异步映射数据冲突次数;
  ULONG     MapDataWaitMiss;      //同步映射数据冲突次数;
  ULONG     PinMappedDataCount;     //牵制映射数据数目;
  ULONG     PinReadNoWait;       //牵制异步读数目;
  ULONG     PinReadWait;        //牵制同步读数目;
  ULONG     PinReadNoWaitMiss;     //牵制异步读冲突数目;
  ULONG     PinReadWaitMiss;      //牵制同步读冲突数目;
  ULONG     CopyReadNoWait;       //异步拷贝读次数;
  ULONG     CopyReadWait;        //同步拷贝读次数;
  ULONG     CopyReadNoWaitMiss;     //异步拷贝读故障次数;
  ULONG     CopyReadWaitMiss;      //同步拷贝读故障次数;
  ULONG     MdlReadNoWait;       //异步MDL读次数;
  ULONG     MdlReadWait;        //同步MDL读次数;
  ULONG     MdlReadNoWaitMiss;     //异步MDL读故障次数;
  ULONG     MdlReadWaitMiss;      //同步MDL读故障次数;
  ULONG     ReadAheadIos;        //向前读操作数目;
  ULONG     LazyWriteIos;        //LAZY写操作数目;
  ULONG     LazyWritePages;       //LAZY写页文件数目;
  ULONG     DataFlushes;        //缓存刷新次数;
  ULONG     DataPages;         //缓存刷新页数;
  ULONG     ContextSwitches;      //环境切换数目;
  ULONG     FirstLevelTbFills;     //第一层缓冲区填充次数;
  ULONG     SecondLevelTbFills;     //第二层缓冲区填充次数;
  ULONG     SystemCall;         //系统调用次数;
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;
现在看到的是结构SYSTEM_PROCESSOR_TIMES提供的系统处理器的使用情况,包括各种情况下的使用时间及中断数目:typedef struct __SYSTEM_PROCESSOR_TIMES
{
  LARGE_INTEGER IdleTime;        //空闲时间;
  LARGE_INTEGER KernelTime;       //内核模式时间;
  LARGE_INTEGER UserTime;        //用户模式时间;
  LARGE_INTEGER DpcTime;        //延迟过程调用时间;
  LARGE_INTEGER InterruptTime;     //中断时间;
  ULONG     InterruptCount;     //中断次数;
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;
页文件的使用情况,SYSTEM_PAGEFILE_INFORMATION提供了所需的相关信息:typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
  ULONG NetxEntryOffset;        //下一个结构的偏移量;
  ULONG CurrentSize;          //当前页文件大小;
  ULONG TotalUsed;           //当前使用的页文件数;
  ULONG PeakUsed;            //当前使用的页文件峰值数;
  UNICODE_STRING FileName;       //页文件的文件名称;
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;
系统高速缓存的使用情况参见结构SYSTEM_CACHE_INFORMATION提供的信息:typedef struct _SYSTEM_CACHE_INFORMATION
{
  ULONG SystemCacheWsSize;       //高速缓存大小;
  ULONG SystemCacheWsPeakSize;     //高速缓存峰值大小;
  ULONG SystemCacheWsFaults;      //高速缓存页故障数目;
  ULONG SystemCacheWsMinimum;      //高速缓存最小页大小;
  ULONG SystemCacheWsMaximum;      //高速缓存最大页大小;
  ULONG TransitionSharedPages;     //共享页数目;
  ULONG TransitionSharedPagesPeak;   //共享页峰值数目;
  ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;
附录:(所有完整源代码,您可以到我们FZ5FZ的主页下载)。

1.T-PMList的头文件源代码:#ifndef T_PMLIST_H
#define T_PMLIST_H
#include
#include
#define NT_PROCESSTHREAD_INFO    0x05
#define MAX_INFO_BUF_LEN       0x500000
#define STATUS_SUCCESS        ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
typedef LONG NTSTATUS;
typedef struct _LSA_UNICODE_STRING
{
  USHORT Length;
  USHORT MaximumLength;
  PWSTR  Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _CLIENT_ID
{
  HANDLE UniqueProcess;
  HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;
typedef LONG KPRIORITY;
typedef struct _VM_COUNTERS
{
  ULONG PeakVirtualSize;
  ULONG VirtualSize;
  ULONG PageFaultCount;
  ULONG PeakWorkingSetSize;
  ULONG WorkingSetSize;
  ULONG QuotaPeakPagedPoolUsage;
  ULONG QuotaPagedPoolUsage;
  ULONG QuotaPeakNonPagedPoolUsage;
  ULONG QuotaNonPagedPoolUsage;
  ULONG PagefileUsage;
  ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
  LARGE_INTEGER ReadOperationCount;
  LARGE_INTEGER WriteOperationCount;
  LARGE_INTEGER OtherOperationCount;
  LARGE_INTEGER ReadTransferCount;
  LARGE_INTEGER WriteTransferCount;
  LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;
typedef enum _THREAD_STATE
{
  StateInitialized,
  StateReady,
  StateRunning,
  StateStandby,
  StateTerminated,
  StateWait,
  StateTransition,
  StateUnknown
}THREAD_STATE;
typedef enum _KWAIT_REASON
{
  Executive,
  FreePage,
  PageIn,
  PoolAllocation,
  DelayExecution,
  Suspended,
  UserRequest,
  WrExecutive,
  WrFreePage,
  WrPageIn,
  WrPoolAllocation,
  WrDelayExecution,
  WrSuspended,
  WrUserRequest,
  WrEventPair,
  WrQueue,
  WrLpcReceive,
  WrLpcReply,
  WrVertualMemory,
  WrPageOut,
  WrRendezvous,
  Spare2,
  Spare3,
  Spare4,
  Spare5,
  Spare6,
  WrKernel
}KWAIT_REASON;
typedef struct _SYSTEM_THREADS
{
  LARGE_INTEGER KernelTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER CreateTime;
  ULONG     WaitTime;
  PVOID     StartAddress;
  CLIENT_ID   ClientId;
  KPRIORITY   Priority;
  KPRIORITY   BasePriority;
  ULONG     ContextSwitchCount;
  THREAD_STATE State;
  KWAIT_REASON WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _SYSTEM_PROCESSES
{
  ULONG     NextEntryDelta;
  ULONG     ThreadCount;
  ULONG     Reserved1[6];
  LARGE_INTEGER CreateTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER KernelTime;
  UNICODE_STRING ProcessName;
  KPRIORITY   BasePriority;
  ULONG     ProcessId;
  ULONG     InheritedFromProcessId;
  ULONG     HandleCount;
  ULONG     Reserved2[2];
  VM_COUNTERS  VmCounters;
  IO_COUNTERS  IoCounters;
  SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef DWORD  SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
         (IN   SYSTEM_INFORMATION_CLASS,
      IN OUT PVOID,
      IN   ULONG,
      OUT  PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD EnumProcess()
{
    PSYSTEM_PROCESSES pSystemProc;
  HMODULE      hNtDll     = NULL;
  LPVOID       lpSystemInfo  = NULL;
  DWORD       dwNumberBytes = MAX_INFO_BUF_LEN;
  DWORD       dwTotalProcess = 0;
  DWORD       dwReturnLength;
  NTSTATUS      Status;
  LONGLONG      llTempTime;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
        if(hNtDll == NULL)
    {
          printf("LoadLibrary Error: %d\n",GetLastError());
        __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
       if(NtQuerySystemInformation == NULL)
    {
        printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
        __leave;
    }
    lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
    Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                    lpSystemInfo,
              dwNumberBytes,
              &dwReturnLength);
    if(Status == STATUS_INFO_LENGTH_MISMATCH)
    {
      printf("STATUS_INFO_LENGTH_MISMATCH\n");
      __leave;
    }
    else if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","Prio.","Thread","Handle","CPU Time");
    printf("--------------------------------------------------------------------------\n");
    pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
    while(pSystemProc->NextEntryDelta != 0)
    {
      if(pSystemProc->ProcessId != 0)
      {
        wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);
      }
      else
      {
        wprintf(L"%-20s",L"System Idle Process");
      }
      printf("%6d",pSystemProc->ProcessId);
      printf("%7d",pSystemProc->InheritedFromProcessId);
      printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);
      printf("%6d",pSystemProc->BasePriority);
      printf("%7d",pSystemProc->ThreadCount);
      printf("%7d",pSystemProc->HandleCount);
      llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart;
      llTempTime /= 10000;
      printf("%3d:",llTempTime/(60*60*1000));
      llTempTime %= 60*60*1000;
      printf("%.2d:",llTempTime/(60*1000));
      llTempTime %= 60*1000;
      printf("%.2d.",llTempTime/1000);
      llTempTime %= 1000;
      printf("%.3d",llTempTime);
      printf("\n");
      dwTotalProcess ++;
      pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
    }
    printf("--------------------------------------------------------------------------\n");
    printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);
    printf("PID\t ==> Process Identification\n");
    printf("PPID\t ==> Parent Process Identification\n");
    printf("WsSize\t ==> Working Set Size\n");
    printf("Prio.\t ==> Base Priority\n");
    printf("Thread\t ==> Thread Count\n");
    printf("Handle\t ==> Handle Count\n");
    printf("CPU Time ==> Processor Time\n");
  }
  __finally
  {
    if(lpSystemInfo != NULL)
    {
      free(lpSystemInfo);
    }
    if(hNtDll != NULL)
    {
        FreeLibrary(hNtDll);
    }
  }
  return 0;
}
DWORD SpeciProcess(DWORD dwPID)
{
    PSYSTEM_PROCESSES pSystemProc  = NULL;
  PSYSTEM_THREADS  pSystemThre  = NULL; 
  HMODULE      hNtDll     = NULL;
  LPVOID       lpSystemInfo  = NULL;
  DWORD       dwNumberBytes = MAX_INFO_BUF_LEN;
  DWORD       dwTotalProcess = 0;
  DWORD       dwReturnLength;
  NTSTATUS      Status;
  LONGLONG      llTempTime;
  ULONG       ulIndex;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
        if(hNtDll == NULL)
    {
          printf("LoadLibrary Error: %d\n",GetLastError());
           __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
     if(NtQuerySystemInformation == NULL)
    {
        printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
          __leave;
    }
    lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
    Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                    lpSystemInfo,
              dwNumberBytes,
              &dwReturnLength);
    if(Status == STATUS_INFO_LENGTH_MISMATCH)
    {
      printf("STATUS_INFO_LENGTH_MISMATCH\n");
      __leave;
    }
    else if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
    while(pSystemProc->NextEntryDelta != 0)
    {
      if(pSystemProc->ProcessId == dwPID)
      {
        printf("ProcessName:\t\t ");
        if(pSystemProc->ProcessId != 0)
        {
          wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);
        }
        else
        {
          wprintf(L"%-20s\n",L"System Idle Process");
        }
        printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);
        printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);
        printf("KernelTime:\t\t ");
        llTempTime = pSystemProc->KernelTime.QuadPart;
        llTempTime /= 10000;
        printf("%d:",llTempTime/(60*60*1000));
        llTempTime %= 60*60*1000;
        printf("%.2d:",llTempTime/(60*1000));
        llTempTime %= 60*1000;
        printf("%.2d.",llTempTime/1000);
        llTempTime %= 1000;
        printf("%.3d\t",llTempTime);
        printf("UserTime:\t\t");
        llTempTime = pSystemProc->UserTime.QuadPart;
        llTempTime /= 10000;
        printf("%d:",llTempTime/(60*60*1000));
        llTempTime %= 60*60*1000;
        printf("%.2d:",llTempTime/(60*1000));
        llTempTime %= 60*1000;
        printf("%.2d.",llTempTime/1000);
        llTempTime %= 1000;
        printf("%.3d\n",llTempTime);
        printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
        printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
        printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);
        printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);
        printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);
        printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount);
        printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorkingSetSize/1024);
        printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize/1024);
        printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPagedPoolUsage/1024);
        printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);
        printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage/1024);
        printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);
        printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsage/1024);
        printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);
        printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualSize/1024);
        printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);
        printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCount);
        printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperationCount);
        printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCount);
        printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);
        printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCount);
        printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);
        printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv","User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");
          printf("-------------------------------------------------------------------------------\n");
        for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
        {
          pSystemThre = &pSystemProc->Threads[ulIndex];
          printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);
            printf("%3d",pSystemProc->Threads[ulIndex].Priority);
          printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);
          printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
           printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
          llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
          llTempTime /= 10000;
          printf("%2d:",llTempTime/(60*60*1000));
          llTempTime %= 60*60*1000;
          printf("%.2d.",llTempTime/(60*1000));
          llTempTime %= 60*1000;
          printf("%.2d.",llTempTime/1000);
          llTempTime %= 100;
          printf("%.2d ",llTempTime);
          llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
          llTempTime /= 10000;
          printf("%2d:",llTempTime/(60*60*1000));
          llTempTime %= 60*60*1000;
          printf("%.2d.",llTempTime/(60*1000));
          llTempTime %= 60*1000;
          printf("%.2d.",llTempTime/1000);
          llTempTime %= 100;
          printf("%.2d ",llTempTime);
          printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);
          printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);
          switch(pSystemProc->Threads[ulIndex].State)
          {
          case StateInitialized:
            printf("%6s","Init.");
            break;
          case StateReady:
            printf("%6s","Ready");
            break;
          case StateRunning:
            printf("%6s","Run");
            break;
          case StateStandby:
            printf("%6s","StBy.");
            break;
          case StateTerminated:
            printf("%6s","Term.");
            break;
          case StateWait:
            printf("%6s","Wait");
            break;
          case StateTransition:
            printf("%6s","Tran.");
            break;
          case StateUnknown:
            printf("%6s","Unkn.");
            break;
          default:
            printf("%6s","Unkn.");
            break;
          }
          switch(pSystemProc->Threads[ulIndex].WaitReason)
          {
          case Executive:
            printf(" %-8s","Executi.");
            break;
          case FreePage:
            printf(" %-8s","FreePag.");
            break;
          case PageIn:
            printf(" %-8s","PageIn");
            break;
          case PoolAllocation:
            printf(" %-8s","PoolAll.");
            break;
          case DelayExecution:
            printf(" %-8s","DelayEx.");
            break;
          case Suspended:
            printf(" %-8s","Suspend.");
            break;
          case UserRequest:
            printf(" %-8s","UserReq.");
            break;
          case WrExecutive:
            printf(" %-8s","WrExect.");
            break;
          case WrFreePage:
            printf(" %-8s","WrFrePg.");
            break;
          case WrPageIn:
            printf(" %-8s","WrPageIn");
            break;
          case WrPoolAllocation:
            printf(" %-8s","WrPoolA.");
            break;
          case WrSuspended:
            printf(" %-8s","WrSuspe.");
            break;
          case WrUserRequest:
            printf(" %-8s","WrUsReq.");
            break;
          case WrEventPair:
            printf(" %-8s","WrEvent.");
            break;
          case WrQueue:
            printf(" %-8s","WrQueue");
            break;
          case WrLpcReceive:
            printf(" %-8s","WrLpcRv.");
            break;
          case WrLpcReply:
            printf(" %-8s","WrLpcRp.");
            break;
          case WrVertualMemory:
            printf(" %-8s","WrVerMm.");
            break;
          case WrPageOut:
            printf(" %-8s","WrPgOut.");
            break;
          case WrRendezvous:
            printf(" %-8s","WrRende.");
            break;
          case WrKernel:
            printf(" %-8s","WrKernel");
            break;
          default:
            printf(" %-8s","Unknown");
            break;
          }
              printf("\n");
        }
            printf("-------------------------------------------------------------------------------\n\n");
             printf("Total %d Thread(s) !\n\n",ulIndex);
        dwTotalProcess ++;
        break;
      }
      pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
    }
  }
  __finally
  {
    if(dwTotalProcess == 0)
    {
      printf("Could not found the %d Process !\n",dwPID);
    }
    else
    {
      printf("TID:\t\t====>\tThread Identification\n");
      printf("Pri:\t\t====>\tPriority\n");
      printf("BPr:\t\t====>\tBase Priority\n");
      printf("Priv:\t\t====>\tPrivilege\n");
      printf("StartAddr:\t====>\tThread Start Address\n");
      printf("CSwitC:\t\t====>\tContext Switch Count\n");
      printf("WtReason:\t====>\tWait Reason\n");
    }
    if(lpSystemInfo != NULL)
    {
      free(lpSystemInfo);
    }
    if(hNtDll != NULL)
    {
        FreeLibrary(hNtDll);
    }
  }
  return 0;
}
VOID Start()
{
  printf("T-PMList, by TOo2y\n");
  printf("E-mail: TOo2y@safechina.net\n");
  printf("HomePage: \n");
  printf("Date: 05-10-2003\n\n");
  return ;
}
VOID Usage()
{
  printf("Usage:\tT-PMList [-e] | [-s PID]\n");
  printf(" -e\t Enumerate All Processes\n");
  printf(" -s PID Show Special Process Information with PID\n\n");
  return ;
}
#endif
2.T-PMPerf的头文件源代码:
#ifndef T_PMPERF_H
#define T_PMPERF_H
#include "windows.h"
#include "stdio.h"
#define SYSTEM_PERF_INFO       0x02
#define SYSTEM_PROC_TIME       0x08
#define SYSTEM_PAGE_INFO       0x12
#define SYSTEM_CACHE_INFO      0x15
#define MAX_INFO_BUF_LEN       0x500000
#define STATUS_SUCCESS        ((NTSTATUS)0x00000000L)
typedef LONG NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef struct _LSA_UNICODE_STRING
{
  USHORT Length;
  USHORT MaximumLength;
  PWSTR  Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
  LARGE_INTEGER IdleTime;
  LARGE_INTEGER ReadTransferCount;
  LARGE_INTEGER WriteTransferCount;
  LARGE_INTEGER OtherTransferCount;
  ULONG     ReadOperationCount;
  ULONG     WriteOperationCount;
  ULONG     OtherOperationCount;
  ULONG     AvailablePages;
  ULONG     TotalCommittedPages;
  ULONG     TotalCommitLimit;
  ULONG     PeakCommitment;
  ULONG     PageFaults;
  ULONG     WriteCopyFaults;
  ULONG     TransitionFaults;
  ULONG     Reserved1;
  ULONG     DemandZeroFaults;
  ULONG     PagesRead;
  ULONG     PageReadIos;
  ULONG     Reserved2[2];
  ULONG     PagefilePagesWritten;
  ULONG     PagefilePageWriteIos;
  ULONG     MappedFilePagesWritten;
  ULONG     MappedFileWriteIos;
  ULONG     PagedPoolUsage;
  ULONG     NonPagedPoolUsage;
  ULONG     PagedPoolAllocs;
  ULONG     PagedPoolFrees;
  ULONG     NonPagedPoolAllocs;
  ULONG     NonPagedPoolFress;
  ULONG     TotalFreeSystemPtes;
  ULONG     SystemCodePage;
  ULONG     TotalSystemDriverPages;
  ULONG     TotalSystemCodePages;
  ULONG     SmallNonPagedLookasideListAllocateHits;
  ULONG     SmallPagedLookasideListAllocateHits;
  ULONG     Reserved3;
  ULONG     MmSystemCachePage;
  ULONG     PagedPoolPage;
  ULONG     SystemDriverPage;
  ULONG     FastReadNoWait;
  ULONG     FastReadWait;
  ULONG     FastReadResourceMiss;
  ULONG     FastReadNotPossible;
  ULONG     FastMdlReadNoWait;
  ULONG     FastMdlReadWait;
  ULONG     FastMdlReadResourceMiss;
  ULONG     FastMdlReadNotPossible;
  ULONG     MapDataNoWait;
  ULONG     MapDataWait;
  ULONG     MapDataNoWaitMiss;
  ULONG     MapDataWaitMiss;
  ULONG     PinMappedDataCount;
  ULONG     PinReadNoWait;
  ULONG     PinReadWait;
  ULONG     PinReadNoWaitMiss;
  ULONG     PinReadWaitMiss;
  ULONG     CopyReadNoWait;
  ULONG     CopyReadWait;
  ULONG     CopyReadNoWaitMiss;
  ULONG     CopyReadWaitMiss;
  ULONG     MdlReadNoWait;
  ULONG     MdlReadWait;
  ULONG     MdlReadNoWaitMiss;
  ULONG     MdlReadWaitMiss;
  ULONG     ReadAheadIos;
  ULONG     LazyWriteIos;
  ULONG     LazyWritePages;
  ULONG     DataFlushes;
  ULONG     DataPages;
  ULONG     ContextSwitches;
  ULONG     FirstLevelTbFills;
  ULONG     SecondLevelTbFills;
  ULONG     SystemCall;
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;
typedef struct __SYSTEM_PROCESSOR_TIMES
{
  LARGE_INTEGER IdleTime;
  LARGE_INTEGER KernelTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER DpcTime;
  LARGE_INTEGER InterruptTime;
  ULONG     InterruptCount;
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
  ULONG NetxEntryOffset;
  ULONG CurrentSize;
  ULONG TotalUsed;
  ULONG PeakUsed;
  UNICODE_STRING FileName;
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;
typedef struct _SYSTEM_CACHE_INFORMATION
{
  ULONG SystemCacheWsSize;
  ULONG SystemCacheWsPeakSize;
  ULONG SystemCacheWsFaults;
  ULONG SystemCacheWsMinimum;
  ULONG SystemCacheWsMaximum;
  ULONG TransitionSharedPages;
  ULONG TransitionSharedPagesPeak;
  ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;
typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)
         (IN   SYSTEM_INFORMATION_CLASS,
      IN OUT PVOID,
      INT  ULONG,
        OUT  PULONG OPTION);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD PerfInfo()
{
  SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
  HMODULE     hNtDll = NULL;
  DWORD      dwNumberBytes;
  DWORD      dwReturnLength;
  NTSTATUS    Status;
  LONGLONG    llTempTime;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
      if(hNtDll == NULL)
    {
          printf("LoadLibrary Error: %d\n",GetLastError());
         __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
    if(NtQuerySystemInformation == NULL)
    {
      printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
    Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,
                    &SystemPerfInfo,
              dwNumberBytes,
              &dwReturnLength);
    if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError());
      __leave;
    }
    printf("IdleTime:\t\t");
    llTempTime = SystemPerfInfo.IdleTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);
    printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);
    printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);
    printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);
    printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);
    printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);
    printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);
    printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);
    printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);
    printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);
    printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);
    printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);
    printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);
    printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);
    printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);
    printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);
    printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);
    printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);
    printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWritten);
    printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);
    printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);
    printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);
    printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);
    printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);
    printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);
    printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);
    printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);
    printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);
    printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);
    printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages);
    printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);
    printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);
    printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);
    printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);
    printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);
    printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);
    printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);
    printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);
    printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossible);
    printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss);
    printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);
    printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);
    printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);
    printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);
    printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);
    printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);
    printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);
    printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);
    printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);
    printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);
    printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);
    printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);
    printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);
    printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);
    printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);
    printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);
    printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);
    printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);
    printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);
    printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);
    printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);
    printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);
    printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);
    printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);
    printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);
    printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);
    printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);
    printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPagedLookasideListAllocateHits);
    printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);
  }
  __finally
  {
    if(hNtDll != NULL)
    {
      FreeLibrary(hNtDll);
    }
  }
  return 0;
}
DWORD ProcTime()
{
  SYSTEM_PROCESSOR_TIMES SystemProcTime;
  HMODULE         hNtDll = NULL;
  DWORD          dwNumberBytes;
  DWORD          dwReturnLength;
  NTSTATUS        Status;
  LONGLONG        llTempTime;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
      if(hNtDll == NULL)
    {
         printf("LoadLibrary Error: %d\n",GetLastError());
        __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
    if(NtQuerySystemInformation == NULL)
    {
      printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
    if(NtQuerySystemInformation == NULL)
    {
      printf("GetProcAddress Error: %d\n",GetLastError());
      __leave;
    }
    Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,
                    &SystemProcTime,
              dwNumberBytes,
              &dwReturnLength);
    if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastError());
      __leave;
    }
    printf("IdleTime:\t\t");
    llTempTime = SystemProcTime.IdleTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("KernelTime:\t\t");
    llTempTime = SystemProcTime.KernelTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("UserTime:\t\t");
    llTempTime = SystemProcTime.UserTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("DpcTime:\t\t");
    llTempTime = SystemProcTime.DpcTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("InterruptTime:\t\t");
    llTempTime = SystemProcTime.InterruptTime.QuadPart;
    llTempTime /= 10000;
    printf("%d:",llTempTime/(60*60*1000));
    llTempTime %= 60*60*1000;
    printf("%.2d:",llTempTime/(60*1000));
    llTempTime %= 60*1000;
    printf("%.2d.",llTempTime/1000);
    llTempTime %= 1000;
    printf("%.3d\n",llTempTime);
    printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);
  }
  __finally
  {
    if(hNtDll != NULL)
    {
      FreeLibrary(hNtDll);
    }
  }
  return 0;
}
DWORD PagefileInfo()
{
  PSYSTEM_PAGEFILE_INFORMATION  pSystemPagefileInfo;
  PVOID             pBuffer;
  HMODULE            hNtDll = NULL;
  DWORD             dwNumberBytes;
  DWORD             dwReturnLength;
    NTSTATUS            Status;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
      if(hNtDll == NULL)
    {
         printf("LoadLibrary Error: %d\n",GetLastError());
        __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
    if(NtQuerySystemInformation == NULL)
    {
      printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    dwNumberBytes = MAX_INFO_BUF_LEN;
    pBuffer = (LPVOID)malloc(dwNumberBytes);
    Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO,
                    pBuffer,
               dwNumberBytes,
               &dwReturnLength);
    if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());
      __leave;
    }
    pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
    do
    {
      printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);
      printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);
      printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);
      wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);
      pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSystemPagefileInfo->NetxEntryOffset);
    }while(pSystemPagefileInfo->NetxEntryOffset != 0);
  }
  __finally
  {
    if(pBuffer != NULL)
    {
      free(pBuffer);
    }
    if(hNtDll != NULL)
    {
      FreeLibrary(hNtDll);
    }
  }
  return 0;
}
DWORD CacheInfo()
{
  SYSTEM_CACHE_INFORMATION    SystemCacheInfo;
  HMODULE            hNtDll = NULL;
  DWORD             dwNumberBytes;
  DWORD             dwReturnLength;
    NTSTATUS            Status;
  __try
  {
    hNtDll = LoadLibrary("NtDll.dll");
      if(hNtDll == NULL)
    {
        printf("LoadLibrary Error: %d\n",GetLastError());
        __leave;
    }
    NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
    if(NtQuerySystemInformation == NULL)
    {
      printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
      __leave;
    }
    dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
    Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO,
                    &SystemCacheInfo,
              dwNumberBytes,
              &dwReturnLength);
    if(Status != STATUS_SUCCESS)
    {
      printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError());
      __leave;
    }
    printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize/1024);
    printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);
    printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);
    printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);
    printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);
    printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);
    printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);
  }
  __finally
  {
    if(hNtDll != NULL)
    {
      FreeLibrary(hNtDll);
    }
  }
  return 0;
}
VOID Start()
{
  printf("T-PMPerf, by TOo2y\n");
  printf("E-mail: TOo2y@safechina.net\n");
  printf("HomePage: \n");
  printf("Date: 05-09-2003\n\n");
  return ;
}
VOID Usage()
{
  printf("Usage:\tT-PMPerf
Reference: 《Windows NT/2000 Native API Reference》。

  关于作者:

  FZ5FZ,我们主要从事网络/系统安全的学习与研究,深入编程技术的剖析与探讨,坚持原创,追求共享。

阅读(2336) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~