今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包
括对某些信息的控制和设置。以下是这个函数的原型：
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
从中可以看到，SystemInformationClass是一个类型信息，它大概提供了50余种信息，也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针，它为我们提供需要获得的信息，或是我们需要设置的系统信息。SystemInformationLength是SystemInformation的长度，它根据探测的信息类型来决
定。至于ReturnLength则是系统返回的需要的长度，通常可以设置为空指针(NULL)。
首先，我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了，所以我就不在老生常谈了，呵呵。那么就提出这个结构类型的定义：
typedef struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta; //构成结构序列的偏移量；
ULONG ThreadCount; //线程数目；
ULONG Reserved1[6];
LARGE_INTEGER CreateTime; //创建时间；
LARGE_INTEGER UserTime; //用户模式(Ring 3)的CPU时间；
LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间；
UNICODE_STRING ProcessName; //进程名称；
KPRIORITY BasePriority; //进程优先权；
ULONG ProcessId; //进程标识符；
ULONG InheritedFromProcessId; //父进程的标识符；
ULONG HandleCount; //句柄数目；
ULONG Reserved2[2];
VM_COUNTERS VmCounters; //虚拟存储器的结构，见下；
IO_COUNTERS IoCounters; //IO计数结构，见下；
SYSTEM_THREADS Threads[1]; //进程相关线程的结构数组，见下；
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime; //CPU内核模式使用时间；
LARGE_INTEGER UserTime; //CPU用户模式使用时间；
LARGE_INTEGER CreateTime; //线程创建时间；
ULONG WaitTime; //等待时间；
PVOID StartAddress; //线程开始的虚拟地址；
CLIENT_ID ClientId; //线程标识符；
KPRIORITY Priority; //线程优先级；
KPRIORITY BasePriority; //基本优先级；
ULONG ContextSwitchCount; //环境切换数目；
THREAD_STATE State; //当前状态；
KWAIT_REASON WaitReason; //等待原因；
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize; //虚拟存储峰值大小；
ULONG VirtualSize; //虚拟存储大小；
ULONG PageFaultCount; //页故障数目；
ULONG PeakWorkingSetSize; //工作集峰值大小；
ULONG WorkingSetSize; //工作集大小；
ULONG QuotaPeakPagedPoolUsage; //分页池使用配额峰值；
ULONG QuotaPagedPoolUsage; //分页池使用配额；
ULONG QuotaPeakNonPagedPoolUsage; //非分页池使用配额峰值；
ULONG QuotaNonPagedPoolUsage; //非分页池使用配额；
ULONG PagefileUsage; //页文件使用情况；
ULONG PeakPagefileUsage; //页文件使用峰值；
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount; //I/O读操作数目；
LARGE_INTEGER WriteOperationCount; //I/O写操作数目；
LARGE_INTEGER OtherOperationCount; //I/O其他操作数目；
LARGE_INTEGER ReadTransferCount; //I/O读数据数目；
LARGE_INTEGER WriteTransferCount; //I/O写数据数目；
LARGE_INTEGER OtherTransferCount; //I/O其他操作数据数目；
}IO_COUNTERS,*PIO_COUNTERS;
以上这些信息应该是比较全面的了，在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式，在Windows2K/XP/2003都支持它们。
现在，我们来看看系统的性能信息，性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70余种系统性能方面的信息，真是太丰富了，请慢慢体会~
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime; //CPU空闲时间；
LARGE_INTEGER ReadTransferCount; //I/O读操作数目；
LARGE_INTEGER WriteTransferCount; //I/O写操作数目；
LARGE_INTEGER OtherTransferCount; //I/O其他操作数目；
ULONG ReadOperationCount; //I/O读数据数目；
ULONG WriteOperationCount; //I/O写数据数目；
ULONG OtherOperationCount; //I/O其他操作数据数目；
ULONG AvailablePages; //可获得的页数目；
ULONG TotalCommittedPages; //总共提交页数目；
ULONG TotalCommitLimit; //已提交页数目；
ULONG PeakCommitment; //页提交峰值；
ULONG PageFaults; //页故障数目；
ULONG WriteCopyFaults; //Copy-On-Write故障数目；
ULONG TransitionFaults; //软页故障数目；
ULONG Reserved1;
ULONG DemandZeroFaults; //需求0故障数；
ULONG PagesRead; //读页数目；
ULONG PageReadIos; //读页I/O操作数；
ULONG Reserved2[2];
ULONG PagefilePagesWritten; //已写页文件页数；
ULONG PagefilePageWriteIos; //已写页文件操作数；
ULONG MappedFilePagesWritten; //已写映射文件页数；
ULONG MappedFileWriteIos; //已写映射文件操作数；
ULONG PagedPoolUsage; //分页池使用；
ULONG NonPagedPoolUsage; //非分页池使用；
ULONG PagedPoolAllocs; //分页池分配情况；
ULONG PagedPoolFrees; //分页池释放情况；
ULONG NonPagedPoolAllocs; //非分页池分配情况；
ULONG NonPagedPoolFress; //非分页池释放情况；
ULONG TotalFreeSystemPtes; //系统页表项释放总数；
ULONG SystemCodePage; //操作系统代码页数；
ULONG TotalSystemDriverPages; //可分页驱动程序页数；
ULONG TotalSystemCodePages; //操作系统代码页总数；
ULONG SmallNonPagedLookasideListAllocateHits; //
ULONG SmallPagedLookasideListAllocateHits;
ULONG Reserved3;
ULONG MmSystemCachePage; //系统缓存页数；
ULONG PagedPoolPage; //分页池页数；
ULONG SystemDriverPage; //可分页驱动页数；
ULONG FastReadNoWait; //异步快速读数目；
ULONG FastReadWait; //同步快速读数目；
ULONG FastReadResourceMiss; //快速读资源冲突数；
ULONG FastReadNotPossible; //快速读失败数；
ULONG FastMdlReadNoWait; //异步MDL快速读数目；
ULONG FastMdlReadWait; //同步MDL快速读数目；
ULONG FastMdlReadResourceMiss; //MDL读资源冲突数；
ULONG FastMdlReadNotPossible; //MDL读失败数；
ULONG MapDataNoWait; //异步映射数据次数；
ULONG MapDataWait; //同步映射数据次数；
ULONG MapDataNoWaitMiss; //异步映射数据冲突次数；
ULONG MapDataWaitMiss; //同步映射数据冲突次数；
ULONG PinMappedDataCount; //牵制映射数据数目；
ULONG PinReadNoWait; //牵制异步读数目；
ULONG PinReadWait; //牵制同步读数目；
ULONG PinReadNoWaitMiss; //牵制异步读冲突数目；
ULONG PinReadWaitMiss; //牵制同步读冲突数目；
ULONG CopyReadNoWait; //异步拷贝读次数；
ULONG CopyReadWait; //同步拷贝读次数；
ULONG CopyReadNoWaitMiss; //异步拷贝读故障次数；
ULONG CopyReadWaitMiss; //同步拷贝读故障次数；
ULONG MdlReadNoWait; //异步MDL读次数；
ULONG MdlReadWait; //同步MDL读次数；
ULONG MdlReadNoWaitMiss; //异步MDL读故障次数；
ULONG MdlReadWaitMiss; //同步MDL读故障次数；
ULONG ReadAheadIos; //向前读操作数目；
ULONG LazyWriteIos; //LAZY写操作数目；
ULONG LazyWritePages; //LAZY写页文件数目；
ULONG DataFlushes; //缓存刷新次数；
ULONG DataPages; //缓存刷新页数；
ULONG ContextSwitches; //环境切换数目；
ULONG FirstLevelTbFills; //第一层缓冲区填充次数；
ULONG SecondLevelTbFills; //第二层缓冲区填充次数；
ULONG SystemCall; //系统调用次数；
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;
现在看到的是结构SYSTEM_PROCESSOR_TIMES提供的系统处理器的使用情况，包括各种情况下的使用时间及中断数目：
typedef struct __SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime; //空闲时间；
LARGE_INTEGER KernelTime; //内核模式时间；
LARGE_INTEGER UserTime; //用户模式时间；
LARGE_INTEGER DpcTime; //延迟过程调用时间；
LARGE_INTEGER InterruptTime; //中断时间；
ULONG InterruptCount; //中断次数；
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;
页文件的使用情况，SYSTEM_PAGEFILE_INFORMATION提供了所需的相关信息：
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NetxEntryOffset; //下一个结构的偏移量；
ULONG CurrentSize; //当前页文件大小；
ULONG TotalUsed; //当前使用的页文件数；
ULONG PeakUsed; //当前使用的页文件峰值数；
UNICODE_STRING FileName; //页文件的文件名称；
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;
系统高速缓存的使用情况参见结构SYSTEM_CACHE_INFORMATION提供的信息：
typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG SystemCacheWsSize; //高速缓存大小；
ULONG SystemCacheWsPeakSize; //高速缓存峰值大小；
ULONG SystemCacheWsFaults; //高速缓存页故障数目；
ULONG SystemCacheWsMinimum; //高速缓存最小页大小；
ULONG SystemCacheWsMaximum; //高速缓存最大页大小；
ULONG TransitionSharedPages; //共享页数目；
ULONG TransitionSharedPagesPeak; //共享页峰值数目；
ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;
附录：(所有完整源代码，您可以到我们FZ5FZ的主页下载)。
1.T-PMList的头文件源代码：
#ifndef T_PMLIST_H
#define T_PMLIST_H
#include <windows.h>
#include <stdio.h>
#define NT_PROCESSTHREAD_INFO 0x05
#define MAX_INFO_BUF_LEN 0x500000
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
typedef LONG NTSTATUS;
typedef struct _LSA_UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;
typedef LONG KPRIORITY;
typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
ULONG QuotaPeakPagedPoolUsage;
ULONG QuotaPagedPoolUsage;
ULONG QuotaPeakNonPagedPoolUsage;
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;
typedef enum _THREAD_STATE
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
}THREAD_STATE;
typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVertualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel
}KWAIT_REASON;
typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
THREAD_STATE State;
KWAIT_REASON WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS,
IN OUT PVOID,
IN ULONG,
OUT PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD EnumProcess()
{
PSYSTEM_PROCESSES pSystemProc;
HMODULE hNtDll = NULL;
LPVOID lpSystemInfo = NULL;
DWORD dwNumberBytes = MAX_INFO_BUF_LEN;
DWORD dwTotalProcess = 0;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetL
astError());
__leave;
}
lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH
");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d
",GetLastError());
__leave;
}
printf("%-20s%6s%7s%8s%6s%7s%7s%13s
","ProcessName","PID","PPID","WsSize","
Prio.","Thread","Handle","CPU Time");
printf("--------------------------------------------------------------------
------
");
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s",L"System Idle Process");
}
printf("%6d",pSystemProc->ProcessId);
printf("%7d",pSystemProc->InheritedFromProcessId);
printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);
printf("%6d",pSystemProc->BasePriority);
printf("%7d",pSystemProc->ThreadCount);
printf("%7d",pSystemProc->HandleCount);
llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.Quad
Part;
llTempTime /= 10000;
printf("%3d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d",llTempTime);
printf("
");
dwTotalProcess ++;
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEn
tryDelta);
}
printf("--------------------------------------------------------------------
------
");
printf("
Total %d Process(es) !
",dwTotalProcess);
printf("PID ==> Process Identification
");
printf("PPID ==> Parent Process Identification
");
printf("WsSize ==> Working Set Size
");
printf("Prio. ==> Base Priority
");
printf("Thread ==> Thread Count
");
printf("Handle ==> Handle Count
");
printf("CPU Time ==> Processor Time
");
}
__finally
{
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD SpeciProcess(DWORD dwPID)
{
PSYSTEM_PROCESSES pSystemProc = NULL;
PSYSTEM_THREADS pSystemThre = NULL;
HMODULE hNtDll = NULL;
LPVOID lpSystemInfo = NULL;
DWORD dwNumberBytes = MAX_INFO_BUF_LEN;
DWORD dwTotalProcess = 0;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
ULONG ulIndex;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetL
astError());
__leave;
}
lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH
");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d
",GetLastError());
__leave;
}
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId == dwPID)
{
printf("ProcessName: ");
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s
",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s
",L"System Idle Process");
}
printf("ProcessID: %d ",pSystemProc->ProcessId);
printf("ParentProcessID: %d
",pSystemProc->InheritedFromProcessId);
printf("KernelTime: ");
llTempTime = pSystemProc->KernelTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d ",llTempTime);
printf("UserTime: ");
llTempTime = pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("Privilege: %d%% ",(pSystemProc->KernelTime.QuadPart * 100)/
(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("User: %d%%
",(pSystemProc->UserTime.QuadPart * 100)/(pSystem
Proc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("ThreadCount: %d ",pSystemProc->ThreadCount);
printf("HandleCount: %d
",pSystemProc->HandleCount);
printf("BasePriority: %-2d ",pSystemProc->BasePriority);
printf("PageFaultCount: %d
",pSystemProc->VmCounters.PageFaultCount)
;
printf("PeakWorkingSetSize(K): %-8d ",pSystemProc->VmCounters.PeakWorki
ngSetSize/1024);
printf("WorkingSetSize(K): %-8d
",pSystemProc->VmCounters.WorkingSetSize
/1024);
printf("PeakPagedPool(K): %-8d ",pSystemProc->VmCounters.QuotaPeakPaged
PoolUsage/1024);
printf("PagedPool(K): %-8d
",pSystemProc->VmCounters.QuotaPagedPoolUsa
ge/1024);
printf("PeakNonPagedPook(K): %-8d ",pSystemProc->VmCounters.QuotaPeakNo
nPagedPoolUsage/1024);
printf("NonePagedPook(K): %-8d
",pSystemProc->VmCounters.QuotaNonPagedPo
olUsage/1024);
printf("PeakPagefile(K): %-8d ",pSystemProc->VmCounters.PeakPagefileUsa
ge/1024);
printf("Pagefile(K): %-8d
",pSystemProc->VmCounters.PagefileUsage/1024
);
printf("PeakVirtualSize(K): %-8d ",pSystemProc->VmCounters.PeakVirtualS
ize/1024);
printf("VirtualSize(K): %-8d
",pSystemProc->VmCounters.VirtualSize/1
024);
printf("ReadTransfer: %-8d ",pSystemProc->IoCounters.ReadTransferCoun
t);
printf("ReadOperationCount: %-8d
",pSystemProc->IoCounters.ReadOperation
Count);
printf("WriteTransfer: %-8d ",pSystemProc->IoCounters.WriteTransferCo
unt);
printf("WriteOperationCount: %-8d
",pSystemProc->IoCounters.WriteOperati
onCount);
printf("OtherTransfer: %-8d ",pSystemProc->IoCounters.OtherTransferCo
unt);
printf("OtherOperationCount: %-8d
",pSystemProc->IoCounters.OtherOpera
tionCount);
printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s
","TID","Pri","BPr","Priv",
"User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");
printf("---------------------------------------------------------
----------------------
");
for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
{
pSystemThre = &pSystemProc->Threads[ulIndex];
printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);
printf("%3d",pSystemProc->Threads[ulIndex].Priority);
printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);
printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 10
0)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100
)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
llTempTime /= 10000;
printf("%2d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d.",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 100;
printf("%.2d ",llTempTime);
llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
llTempTime /= 10000;
printf("%2d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d.",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 100;
printf("%.2d ",llTempTime);
printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);
printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);
switch(pSystemProc->Threads[ulIndex].State)
{
case StateInitialized:
printf("%6s","Init.");
break;
case StateReady:
printf("%6s","Ready");
break;
case StateRunning:
printf("%6s","Run");
break;
case StateStandby:
printf("%6s","StBy.");
break;
case StateTerminated:
printf("%6s","Term.");
break;
case StateWait:
printf("%6s","Wait");
break;
case StateTransition:
printf("%6s","Tran.");
break;
case StateUnknown:
printf("%6s","Unkn.");
break;
default:
printf("%6s","Unkn.");
break;
}
switch(pSystemProc->Threads[ulIndex].WaitReason)
{
case Executive:
printf(" %-8s","Executi.");
break;
case FreePage:
printf(" %-8s","FreePag.");
break;
case PageIn:
printf(" %-8s","PageIn");
break;
case PoolAllocation:
printf(" %-8s","PoolAll.");
break;
case DelayExecution:
printf(" %-8s","DelayEx.");
break;
case Suspended:
printf(" %-8s","Suspend.");
break;
case UserRequest:
printf(" %-8s","UserReq.");
break;
case WrExecutive:
printf(" %-8s","WrExect.");
break;
case WrFreePage:
printf(" %-8s","WrFrePg.");
break;
case WrPageIn:
printf(" %-8s","WrPageIn");
break;
case WrPoolAllocation:
printf(" %-8s","WrPoolA.");
break;
case WrSuspended:
printf(" %-8s","WrSuspe.");
break;
case WrUserRequest:
printf(" %-8s","WrUsReq.");
break;
case WrEventPair:
printf(" %-8s","WrEvent.");
break;
case WrQueue:
printf(" %-8s","WrQueue");
break;
case WrLpcReceive:
printf(" %-8s","WrLpcRv.");
break;
case WrLpcReply:
printf(" %-8s","WrLpcRp.");
break;
case WrVertualMemory:
printf(" %-8s","WrVerMm.");
break;
case WrPageOut:
printf(" %-8s","WrPgOut.");
break;
case WrRendezvous:
printf(" %-8s","WrRende.");
break;
case WrKernel:
printf(" %-8s","WrKernel");
break;
default:
printf(" %-8s","Unknown");
break;
}
printf("
");
}
printf("----------------------------------------------------
---------------------------
");
printf("Total %d Thread(s) !
",ulIndex);
dwTotalProcess ++;
break;
}
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEn
tryDelta);
}
}
__finally
{
if(dwTotalProcess == 0)
{
printf("Could not found the %d Process !
",dwPID);
}
else
{
printf("TID: ====> Thread Identification
");
printf("Pri: ====> Priority
");
printf("BPr: ====> Base Priority
");
printf("Priv: ====> Privilege
");
printf("StartAddr: ====> Thread Start Address
");
printf("CSwitC: ====> Context Switch Count
");
printf("WtReason: ====> Wait Reason
");
}
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
VOID Start()
{
printf("T-PMList, by TOo2y
");
printf("E-mail: TOo2y@safechina.net
");
printf("HomePage: www.safechina.net
");
printf("Date: 05-10-2003
");
return ;
}
VOID Usage()
{
printf("Usage: T-PMList [-e] | [-s PID]
");
printf(" -e Enumerate All Processes
");
printf(" -s PID Show Special Process Information with PID
");
return ;
}
#endif
2.T-PMPerf的头文件源代码：
#ifndef T_PMPERF_H
#define T_PMPERF_H
#include "windows.h"
#include "stdio.h"
#define SYSTEM_PERF_INFO 0x02
#define SYSTEM_PROC_TIME 0x08
#define SYSTEM_PAGE_INFO 0x12
#define SYSTEM_CACHE_INFO 0x15
#define MAX_INFO_BUF_LEN 0x500000
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
typedef LONG NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef struct _LSA_UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
ULONG ReadOperationCount;
ULONG WriteOperationCount;
ULONG OtherOperationCount;
ULONG AvailablePages;
ULONG TotalCommittedPages;
ULONG TotalCommitLimit;
ULONG PeakCommitment;
ULONG PageFaults;
ULONG WriteCopyFaults;
ULONG TransitionFaults;
ULONG Reserved1;
ULONG DemandZeroFaults;
ULONG PagesRead;
ULONG PageReadIos;
ULONG Reserved2[2];
ULONG PagefilePagesWritten;
ULONG PagefilePageWriteIos;
ULONG MappedFilePagesWritten;
ULONG MappedFileWriteIos;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFress;
ULONG TotalFreeSystemPtes;
ULONG SystemCodePage;
ULONG TotalSystemDriverPages;
ULONG TotalSystemCodePages;
ULONG SmallNonPagedLookasideListAllocateHits;
ULONG SmallPagedLookasideListAllocateHits;
ULONG Reserved3;
ULONG MmSystemCachePage;
ULONG PagedPoolPage;
ULONG SystemDriverPage;
ULONG FastReadNoWait;
ULONG FastReadWait;
ULONG FastReadResourceMiss;
ULONG FastReadNotPossible;
ULONG FastMdlReadNoWait;
ULONG FastMdlReadWait;
ULONG FastMdlReadResourceMiss;
ULONG FastMdlReadNotPossible;
ULONG MapDataNoWait;
ULONG MapDataWait;
ULONG MapDataNoWaitMiss;
ULONG MapDataWaitMiss;
ULONG PinMappedDataCount;
ULONG PinReadNoWait;
ULONG PinReadWait;
ULONG PinReadNoWaitMiss;
ULONG PinReadWaitMiss;
ULONG CopyReadNoWait;
ULONG CopyReadWait;
ULONG CopyReadNoWaitMiss;
ULONG CopyReadWaitMiss;
ULONG MdlReadNoWait;
ULONG MdlReadWait;
ULONG MdlReadNoWaitMiss;
ULONG MdlReadWaitMiss;
ULONG ReadAheadIos;
ULONG LazyWriteIos;
ULONG LazyWritePages;
ULONG DataFlushes;
ULONG DataPages;
ULONG ContextSwitches;
ULONG FirstLevelTbFills;
ULONG SecondLevelTbFills;
ULONG SystemCall;
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;
typedef struct __SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
ULONG InterruptCount;
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NetxEntryOffset;
ULONG CurrentSize;
ULONG TotalUsed;
ULONG PeakUsed;
UNICODE_STRING FileName;
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;
typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG SystemCacheWsSize;
ULONG SystemCacheWsPeakSize;
ULONG SystemCacheWsFaults;
ULONG SystemCacheWsMinimum;
ULONG SystemCacheWsMaximum;
ULONG TransitionSharedPages;
ULONG TransitionSharedPagesPeak;
ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;
typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS,
IN OUT PVOID,
INT ULONG,
OUT PULONG OPTION);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD PerfInfo()
{
SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetLastErr
or());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,
&SystemPerfInfo,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Performance Error: %d
",GetLastError(
));
__leave;
}
printf("IdleTime: ");
llTempTime = SystemPerfInfo.IdleTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("ReadOperationCount: %-10d ",SystemPerfInfo.ReadOperationCount);
printf("ReadTransferCount: %d
",SystemPerfInfo.ReadTransferCount);
printf("WriteOperationCount: %-10d ",SystemPerfInfo.WriteOperationCount);
printf("WriteTransferCount: %d
",SystemPerfInfo.WriteTransferCount);
printf("OtherOperationCount: %-10d ",SystemPerfInfo.OtherOperationCount);
printf("OtherTransferCount: %d
",SystemPerfInfo.OtherTransferCount);
printf("AvailablePages: %-10d ",SystemPerfInfo.AvailablePages);
printf("TotalCommittedPage: %d
",SystemPerfInfo.TotalCommittedPages);
printf("CommitLimit: %-10d ",SystemPerfInfo.TotalCommitLimit);
printf("PeakCommitment: %d
",SystemPerfInfo.PeakCommitment);
printf("PageFault: %-10d ",SystemPerfInfo.PageFaults);
printf("WriteCopyFault: %d
",SystemPerfInfo.WriteCopyFaults);
printf("TransitionFault: %-10d ",SystemPerfInfo.TransitionFaults);
printf("DemandZeroFault: %d
",SystemPerfInfo.DemandZeroFaults);
printf("PagesRead: %-10d ",SystemPerfInfo.PagesRead);
printf("PageReadIos: %d
",SystemPerfInfo.PageReadIos);
printf("PagesWritten: %-10d ",SystemPerfInfo.PagefilePagesWritten);
printf("PageWriteIos: %d
",SystemPerfInfo.PagefilePageWriteIos);
printf("MappedFilePagesWritten: %-10d ",SystemPerfInfo.MappedFilePagesWrit
ten);
printf("MappedFileWriteIos: %d
",SystemPerfInfo.MappedFileWriteIos);
printf("PagedPoolUsage: %-10d ",SystemPerfInfo.PagedPoolUsage);
printf("NonPagedPoolUsage: %d
",SystemPerfInfo.NonPagedPoolUsage);
printf("PagedPoolAllocs: %-10d ",SystemPerfInfo.PagedPoolAllocs);
printf("NonPagedPoolAllocs: %d
",SystemPerfInfo.NonPagedPoolAllocs);
printf("PagedPoolFrees: %-10d ",SystemPerfInfo.PagedPoolFrees);
printf("NonPagedPoolFrees: %d
",SystemPerfInfo.NonPagedPoolFress);
printf("SystemCodePage: %-10d ",SystemPerfInfo.SystemCodePage);
printf("TotalSystemCodePage: %d
",SystemPerfInfo.TotalSystemCodePages);
printf("TotalFreeSysPTE: %-10d ",SystemPerfInfo.TotalFreeSystemPtes);
printf("TotalSystemDriverPages: %d
",SystemPerfInfo.TotalSystemDriverPages
);
printf("PagedPoolPage: %-10d ",SystemPerfInfo.PagedPoolPage);
printf("SystemDriverPage: %d
",SystemPerfInfo.SystemDriverPage);
printf("FastReadWait: %-10d ",SystemPerfInfo.FastReadWait);
printf("FastReadNoWait: %d
",SystemPerfInfo.FastReadNoWait);
printf("FastReadNoPossible: %-10d ",SystemPerfInfo.FastReadNotPossible);
printf("FastReadResourceMiss: %d
",SystemPerfInfo.FastReadResourceMiss);
printf("FastMdlReadWait: %-10d ",SystemPerfInfo.FastMdlReadWait);
printf("FastMdlReadNoWait: %d
",SystemPerfInfo.FastMdlReadNoWait);
printf("FastMdlReadNotPossible: %-10d ",SystemPerfInfo.FastMdlReadNotPossi
ble);
printf("FastMdlReadResourceMiss:%d
",SystemPerfInfo.FastMdlReadResourceMiss
);
printf("MapDataWait: %-10d ",SystemPerfInfo.MapDataWait);
printf("MapDataNoWait: %d
",SystemPerfInfo.MapDataNoWait);
printf("MapDataWaitMiss: %-10d ",SystemPerfInfo.MapDataWaitMiss);
printf("MapDataNoWaitMiss: %d
",SystemPerfInfo.MapDataNoWaitMiss);
printf("ReadAheadIos: %-10d ",SystemPerfInfo.ReadAheadIos);
printf("PinMappedDataCount: %d
",SystemPerfInfo.PinMappedDataCount);
printf("PinReadWait: %-10d ",SystemPerfInfo.PinReadWait);
printf("PinReadNoWait: %d
",SystemPerfInfo.PinReadNoWait);
printf("PinReadWaitMiss: %-10d ",SystemPerfInfo.PinReadWaitMiss);
printf("PinReadNoWaitMiss: %d
",SystemPerfInfo.PinReadNoWaitMiss);
printf("CopyReadWait: %-10d ",SystemPerfInfo.CopyReadWait);
printf("CopyReadNoWait: %d
",SystemPerfInfo.CopyReadNoWait);
printf("CopyReadWaitMiss: %-10d ",SystemPerfInfo.CopyReadWaitMiss);
printf("CopyReadNoWaitMiss: %-10d
",SystemPerfInfo.CopyReadNoWaitMiss);
printf("MdlReadWait: %-10d ",SystemPerfInfo.MdlReadWait);
printf("MdlReadNoWait: %d
",SystemPerfInfo.MdlReadNoWait);
printf("MdlReadWaitMiss: %-10d ",SystemPerfInfo.MdlReadWaitMiss);
printf("MdlReadNoWaitMiss: %d
",SystemPerfInfo.MdlReadNoWaitMiss);
printf("LazyWriteIos: %-10d ",SystemPerfInfo.LazyWriteIos);
printf("LazyWritePages: %d
",SystemPerfInfo.LazyWritePages);
printf("DataPages: %-10d ",SystemPerfInfo.DataPages);
printf("DataFlushes: %d
",SystemPerfInfo.DataFlushes);
printf("FirstLevelTbFills: %-10d ",SystemPerfInfo.FirstLevelTbFills);
printf("SecondLevelTbFills: %d
",SystemPerfInfo.SecondLevelTbFills);
printf("ContextSwitches: %-10d ",SystemPerfInfo.ContextSwitches);
printf("SytemCall: %d
",SystemPerfInfo.SystemCall);
printf("MemorySystemCachePage: %d
",SystemPerfInfo.MmSystemCachePage);
printf("SmallPagedLookasideListAllocateHits: %d
",SystemPerfInfo.SmallPage
dLookasideListAllocateHits);
printf("SmallNonPagedLookasideListAllocateHits: %d
",SystemPerfInfo.SmallN
onPagedLookasideListAllocateHits);
}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD ProcTime()
{
SYSTEM_PROCESSOR_TIMES SystemProcTime;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetLastErr
or());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress Error: %d
",GetLastError());
__leave;
}
Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,
&SystemProcTime,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Processor Time Error: %d
",GetLastErr
or());
__leave;
}
printf("IdleTime: ");
llTempTime = SystemProcTime.IdleTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("KernelTime: ");
llTempTime = SystemProcTime.KernelTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("UserTime: ");
llTempTime = SystemProcTime.UserTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("DpcTime: ");
llTempTime = SystemProcTime.DpcTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("InterruptTime: ");
llTempTime = SystemProcTime.InterruptTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d
",llTempTime);
printf("InterruptCount: %d
",SystemProcTime.InterruptCount);
}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD PagefileInfo()
{
PSYSTEM_PAGEFILE_INFORMATION pSystemPagefileInfo;
PVOID pBuffer;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetLastErr
or());
__leave;
}
dwNumberBytes = MAX_INFO_BUF_LEN;
pBuffer = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO,
pBuffer,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Pagefile Error: %d
",GetLastError());
__leave;
}
pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
do
{
printf("CurrentPagefileSize: %d
",pSystemPagefileInfo->CurrentSize);
printf("TotalPagefileUsed: %d
",pSystemPagefileInfo->TotalUsed);
printf("PeakPagefileUsed: %d
",pSystemPagefileInfo->PeakUsed);
wprintf(L"PagefileFileName: %s
",pSystemPagefileInfo->FileName.Buffer);
pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSys
temPagefileInfo->NetxEntryOffset);
}while(pSystemPagefileInfo->NetxEntryOffset != 0);
}
__finally
{
if(pBuffer != NULL)
{
free(pBuffer);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD CacheInfo()
{
SYSTEM_CACHE_INFORMATION SystemCacheInfo;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d
",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d
",GetLastError());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO,
&SystemCacheInfo,dwNumberBytes,&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Cache Error: %d
",GetLastError());
__leave;
}
printf("CacheWorkingSetSize: %d(KB)
",SystemCacheInfo.SystemCacheWsSize1024);
printf("CacheWorkingSetPeakSize: %d(KB)
",SystemCacheInfo.SystemCacheWsPeakSize/1024);
printf("CacheWorkingSetFaults: %d
",SystemCacheInfo.SystemCacheWsFaults);
printf("CacheWorkingSetMinimum: %d
",SystemCacheInfo.SystemCacheWsMinimum);
printf("CacheWorkingSetMaximum: %d
",SystemCacheInfo.SystemCacheWsMaximum);
printf("TransitionSharedPages: %d
",SystemCacheInfo.TransitionSharedPages);
printf("TransitionSharedPagesPeak: %d
",SystemCacheInfo.TransitionSharedPagesPeak);
}__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
VOID Start()
{
printf("T-PMPerf, by TOo2y
");
printf("E-mail: TOo2y@safechina.net
");
printf("HomePage: www.safechina.net
");
printf("Date: 05-09-2003
");
return ;
}
VOID Usage()
{
printf("Usage: T-PMPerf <Option>
");
printf("Option:
");
printf(" -Perf System Performance Information
");
printf(" -Proc System Processor Information
");
printf(" -Page System Pagefile Information
");
printf(" -Cache System Cache Information
");
return ;
}
#endif
http://www.cnblogs.com/-clq/archive/2012/03/15/2397492.html