NtQuerySystemInformation的使用

 今天，我們主要讨論的是一個函數NtQuerySystemInformation(ZwQuerySystemInformation)。當然，你不要小看這麼一個函數，它卻為我們提供了豐富的系統資訊，同時還包

括對某些資訊的控制和設定。以下是這個函數的原型：

 typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

    (IN      SYSTEM_INFORMATION_CLASS SystemInformationClass,

     IN OUT  PVOID                    SystemInformation,

     IN      ULONG                    SystemInformationLength,

     OUT     PULONG                   ReturnLength  OPTIONAL);

 NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

    從中可以看到，SystemInformationClass是一個類型資訊，它大概提供了50餘種資訊，也就是我們可以通過這個函數對大約50多種的系統資訊進行探測或設定。SystemInformation是一個LPVOID型的指針，它為我們提供需要獲得的資訊，或是我們需要設定的系統資訊。SystemInformationLength是SystemInformation的長度，它根據探測的資訊類型來決

定。至于ReturnLength則是系統傳回的需要的長度，通常可以設定為空指針(NULL)。

    首先，我們來看看大家比較熟悉的系統程序/線程相關的資訊。這個題目在網上已經讨論了N多年了，是以我就不在老生常談了，呵呵。那麼就提出這個結構類型的定義：

 typedef struct _SYSTEM_PROCESSES

 {

  ULONG          NextEntryDelta;          //構成結構序列的偏移量；

  ULONG          ThreadCount;             //線程數目；

  ULONG          Reserved1[6];           

  LARGE_INTEGER  CreateTime;              //建立時間；

  LARGE_INTEGER  UserTime;                //使用者模式(Ring 3)的CPU時間；

  LARGE_INTEGER  KernelTime;              //核心模式(Ring 0)的CPU時間；

  UNICODE_STRING ProcessName;             //程序名稱；

  KPRIORITY      BasePriority;            //程序優先權；

  ULONG          ProcessId;               //程序辨別符；

  ULONG          InheritedFromProcessId;  //父程序的辨別符；

  ULONG          HandleCount;             //句柄數目；

  ULONG          Reserved2[2];

  VM_COUNTERS    VmCounters;              //虛拟存儲器的結構，見下；

  IO_COUNTERS    IoCounters;              //IO計數結構，見下；

  SYSTEM_THREADS Threads[1];              //程序相關線程的結構數組，見下；

 }SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

 typedef struct _SYSTEM_THREADS

  LARGE_INTEGER KernelTime;               //CPU核心模式使用時間；

  LARGE_INTEGER UserTime;                 //CPU使用者模式使用時間；

  LARGE_INTEGER CreateTime;               //線程建立時間；

  ULONG         WaitTime;                 //等待時間；

  PVOID         StartAddress;             //線程開始的虛拟位址；

  CLIENT_ID     ClientId;                 //線程辨別符；

  KPRIORITY     Priority;                 //線程優先級；

  KPRIORITY     BasePriority;             //基本優先級；

  ULONG         ContextSwitchCount;       //環境切換數目；

  THREAD_STATE  State;                    //目前狀态；

  KWAIT_REASON  WaitReason;               //等待原因；

 }SYSTEM_THREADS,*PSYSTEM_THREADS;

 typedef struct _VM_COUNTERS

  ULONG PeakVirtualSize;                  //虛拟存儲峰值大小；

  ULONG VirtualSize;                      //虛拟存儲大小；

  ULONG PageFaultCount;                   //頁故障數目；

  ULONG PeakWorkingSetSize;               //工作集峰值大小；

  ULONG WorkingSetSize;                   //工作集大小；

  ULONG QuotaPeakPagedPoolUsage;          //分頁池使用配額峰值；

  ULONG QuotaPagedPoolUsage;              //分頁池使用配額；

  ULONG QuotaPeakNonPagedPoolUsage;       //非分頁池使用配額峰值；

  ULONG QuotaNonPagedPoolUsage;           //非分頁池使用配額；

  ULONG PagefileUsage;                    //頁檔案使用情況；

  ULONG PeakPagefileUsage;                //頁檔案使用峰值；

 }VM_COUNTERS,*PVM_COUNTERS;

 typedef struct _IO_COUNTERS

  LARGE_INTEGER ReadOperationCount;       //I/O讀操作數目；

  LARGE_INTEGER WriteOperationCount;      //I/O寫操作數目；

  LARGE_INTEGER OtherOperationCount;      //I/O其他操作數目；

  LARGE_INTEGER ReadTransferCount;        //I/O讀資料數目；

  LARGE_INTEGER WriteTransferCount;       //I/O寫資料數目；

  LARGE_INTEGER OtherTransferCount;       //I/O其他操作資料數目；

 }IO_COUNTERS,*PIO_COUNTERS;

    以上這些資訊應該是比較全面的了，在Win32 API裡為我們提供了PSAPI(程序狀态)和ToolHelp32這兩種探測系統程序/線程資訊的方式，在Windows2K/XP/2003都支援它們。

    現在，我們來看看系統的性能資訊，性能結構SYSTEM_PERFORMANCE_INFORMATION為我們提供了70餘種系統性能方面的資訊，真是太豐富了，請慢慢體會~

 typedef struct _SYSTEM_PERFORMANCE_INFORMATION

  LARGE_INTEGER  IdleTime;                    //CPU空閑時間；

  LARGE_INTEGER  ReadTransferCount;           //I/O讀操作數目；

  LARGE_INTEGER  WriteTransferCount;          //I/O寫操作數目；

  LARGE_INTEGER  OtherTransferCount;          //I/O其他操作數目；

  ULONG          ReadOperationCount;          //I/O讀資料數目；

  ULONG          WriteOperationCount;         //I/O寫資料數目；

  ULONG          OtherOperationCount;         //I/O其他操作資料數目；

  ULONG          AvailablePages;              //可獲得的頁數目；

  ULONG          TotalCommittedPages;         //總共送出頁數目；

  ULONG          TotalCommitLimit;            //已送出頁數目；

  ULONG          PeakCommitment;              //頁送出峰值；

  ULONG          PageFaults;                  //頁故障數目；

  ULONG          WriteCopyFaults;             //Copy-On-Write故障數目；

  ULONG          TransitionFaults;            //軟頁故障數目；

  ULONG          Reserved1;

  ULONG          DemandZeroFaults;            //需求0故障數；

  ULONG          PagesRead;                   //讀頁數目；

  ULONG          PageReadIos;                 //讀頁I/O操作數；

  ULONG          PagefilePagesWritten;        //已寫頁檔案頁數；

  ULONG          PagefilePageWriteIos;        //已寫頁檔案操作數；

  ULONG          MappedFilePagesWritten;      //已寫映射檔案頁數；

  ULONG          MappedFileWriteIos;          //已寫映射檔案操作數；

  ULONG          PagedPoolUsage;              //分頁池使用；

  ULONG          NonPagedPoolUsage;           //非分頁池使用；

  ULONG          PagedPoolAllocs;             //分頁池配置設定情況；

  ULONG          PagedPoolFrees;              //分頁池釋放情況；

  ULONG          NonPagedPoolAllocs;          //非分頁池配置設定情況；

  ULONG          NonPagedPoolFress;           //非分頁池釋放情況；

  ULONG          TotalFreeSystemPtes;         //系統頁表項釋放總數；

  ULONG          SystemCodePage;              //作業系統代碼頁數；

  ULONG          TotalSystemDriverPages;      //可分頁驅動程式頁數；

  ULONG          TotalSystemCodePages;        //作業系統代碼頁總數；

  ULONG          SmallNonPagedLookasideListAllocateHits; //

  ULONG          SmallPagedLookasideListAllocateHits;

  ULONG          Reserved3;                   

  ULONG          MmSystemCachePage;          //系統緩存頁數；

  ULONG          PagedPoolPage;              //分頁池頁數；

  ULONG          SystemDriverPage;           //可分頁驅動頁數；

  ULONG          FastReadNoWait;             //異步快速讀數目；

  ULONG          FastReadWait;               //同步快速讀數目；

  ULONG          FastReadResourceMiss;       //快速讀資源沖突數；

  ULONG          FastReadNotPossible;        //快速讀失敗數；

  ULONG          FastMdlReadNoWait;          //異步MDL快速讀數目；

  ULONG          FastMdlReadWait;            //同步MDL快速讀數目；

  ULONG          FastMdlReadResourceMiss;    //MDL讀資源沖突數；

  ULONG          FastMdlReadNotPossible;     //MDL讀失敗數；

  ULONG          MapDataNoWait;              //異步映射資料次數；

  ULONG          MapDataWait;                //同步映射資料次數；

  ULONG          MapDataNoWaitMiss;          //異步映射資料沖突次數；

  ULONG          MapDataWaitMiss;            //同步映射資料沖突次數；

  ULONG          PinMappedDataCount;         //牽制映射資料數目；

  ULONG          PinReadNoWait;              //牽制異步讀數目；

  ULONG          PinReadWait;                //牽制同步讀數目；

  ULONG          PinReadNoWaitMiss;          //牽制異步讀沖突數目；

  ULONG          PinReadWaitMiss;            //牽制同步讀沖突數目；

  ULONG          CopyReadNoWait;             //異步拷貝讀次數；

  ULONG          CopyReadWait;               //同步拷貝讀次數；

  ULONG          CopyReadNoWaitMiss;         //異步拷貝讀故障次數；

  ULONG          CopyReadWaitMiss;           //同步拷貝讀故障次數；

  ULONG          MdlReadNoWait;              //異步MDL讀次數；

  ULONG          MdlReadWait;                //同步MDL讀次數；

  ULONG          MdlReadNoWaitMiss;          //異步MDL讀故障次數；

  ULONG          MdlReadWaitMiss;            //同步MDL讀故障次數；

  ULONG          ReadAheadIos;               //向前讀操作數目；

  ULONG          LazyWriteIos;               //LAZY寫操作數目；

  ULONG          LazyWritePages;             //LAZY寫頁檔案數目；

  ULONG          DataFlushes;                //緩存重新整理次數；

  ULONG          DataPages;                  //緩存重新整理頁數；

  ULONG          ContextSwitches;            //環境切換數目；

  ULONG          FirstLevelTbFills;          //第一層緩沖區填充次數；

  ULONG          SecondLevelTbFills;         //第二層緩沖區填充次數；

  ULONG          SystemCall;                 //系統調用次數；

 }SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

    現在看到的是結構SYSTEM_PROCESSOR_TIMES提供的系統處理器的使用情況，包括各種情況下的使用時間及中斷數目：

 typedef struct __SYSTEM_PROCESSOR_TIMES

  LARGE_INTEGER IdleTime;               //空閑時間；

  LARGE_INTEGER KernelTime;             //核心模式時間；

  LARGE_INTEGER UserTime;               //使用者模式時間；

  LARGE_INTEGER DpcTime;                //延遲過程調用時間；

  LARGE_INTEGER InterruptTime;          //中斷時間；

  ULONG         InterruptCount;         //中斷次數；

 }SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

    頁檔案的使用情況，SYSTEM_PAGEFILE_INFORMATION提供了所需的相關資訊：

 typedef struct _SYSTEM_PAGEFILE_INFORMATION

  ULONG NetxEntryOffset;                //下一個結構的偏移量；

  ULONG CurrentSize;                    //目前頁檔案大小；

  ULONG TotalUsed;                      //目前使用的頁檔案數；

  ULONG PeakUsed;                       //目前使用的頁檔案峰值數；

  UNICODE_STRING FileName;              //頁檔案的檔案名稱；

 }SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

    系統高速緩存的使用情況參見結構SYSTEM_CACHE_INFORMATION提供的資訊：

 typedef struct _SYSTEM_CACHE_INFORMATION

  ULONG SystemCacheWsSize;              //高速緩存大小；

  ULONG SystemCacheWsPeakSize;          //高速緩存峰值大小；

  ULONG SystemCacheWsFaults;            //高速緩存頁故障數目；

  ULONG SystemCacheWsMinimum;           //高速緩存最小頁大小；

  ULONG SystemCacheWsMaximum;           //高速緩存最大頁大小；

  ULONG TransitionSharedPages;          //共享頁數目；

  ULONG TransitionSharedPagesPeak;      //共享頁峰值數目；

  ULONG Reserved[2];

 }SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

附錄：(所有完整源代碼，您可以到我們FZ5FZ的首頁下載下傳)。

1.T-PMList的頭檔案源代碼：

#ifndef T_PMLIST_H

#define T_PMLIST_H

#include <windows.h>

#include <stdio.h>

#define NT_PROCESSTHREAD_INFO        0x05

#define MAX_INFO_BUF_LEN             0x500000

#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)

#define STATUS_INFO_LENGTH_MISMATCH  ((NTSTATUS)0xC0000004L)

typedef LONG NTSTATUS;

typedef struct _LSA_UNICODE_STRING

{

USHORT  Length;

USHORT  MaximumLength;

PWSTR   Buffer;

}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;

typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

typedef struct _CLIENT_ID

HANDLE UniqueProcess;

HANDLE UniqueThread;

}CLIENT_ID;

typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;

typedef struct _VM_COUNTERS

ULONG PeakVirtualSize;

ULONG VirtualSize;

ULONG PageFaultCount;

ULONG PeakWorkingSetSize;

ULONG WorkingSetSize;

ULONG QuotaPeakPagedPoolUsage;

ULONG QuotaPagedPoolUsage;

ULONG QuotaPeakNonPagedPoolUsage;

ULONG QuotaNonPagedPoolUsage;

ULONG PagefileUsage;

ULONG PeakPagefileUsage;

}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS

LARGE_INTEGER ReadOperationCount;

LARGE_INTEGER WriteOperationCount;

LARGE_INTEGER OtherOperationCount;

LARGE_INTEGER ReadTransferCount;

LARGE_INTEGER WriteTransferCount;

LARGE_INTEGER OtherTransferCount;

}IO_COUNTERS,*PIO_COUNTERS;

typedef enum _THREAD_STATE

StateInitialized,

StateReady,

StateRunning,

StateStandby,

StateTerminated,

StateWait,

StateTransition,

StateUnknown

}THREAD_STATE;

typedef enum _KWAIT_REASON

Executive,

FreePage,

PageIn,

PoolAllocation,

DelayExecution,

Suspended,

UserRequest,

WrExecutive,

WrFreePage,

WrPageIn,

WrPoolAllocation,

WrDelayExecution,

WrSuspended,

WrUserRequest,

WrEventPair,

WrQueue,

WrLpcReceive,

WrLpcReply,

WrVertualMemory,

WrPageOut,

WrRendezvous,

Spare2,

Spare3,

Spare4,

Spare5,

Spare6,

WrKernel

}KWAIT_REASON;

typedef struct _SYSTEM_THREADS

LARGE_INTEGER KernelTime;

LARGE_INTEGER UserTime;

LARGE_INTEGER CreateTime;

ULONG         WaitTime;

PVOID         StartAddress;

CLIENT_ID     ClientId;

KPRIORITY     Priority;

KPRIORITY     BasePriority;

ULONG         ContextSwitchCount;

THREAD_STATE  State;

KWAIT_REASON  WaitReason;

}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES

ULONG          NextEntryDelta;

ULONG          ThreadCount;

ULONG          Reserved1[6];

LARGE_INTEGER  CreateTime;

LARGE_INTEGER  UserTime;

LARGE_INTEGER  KernelTime;

UNICODE_STRING ProcessName;

KPRIORITY      BasePriority;

ULONG          ProcessId;

ULONG          InheritedFromProcessId;

ULONG          HandleCount;

ULONG          Reserved2[2];

VM_COUNTERS    VmCounters;

IO_COUNTERS    IoCounters;

SYSTEM_THREADS Threads[1];

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

typedef DWORD    SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

                 (IN     SYSTEM_INFORMATION_CLASS,

    IN OUT PVOID,

    IN     ULONG,

    OUT    PULONG OPTIONAL);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

DWORD EnumProcess()

       PSYSTEM_PROCESSES  pSystemProc;

HMODULE            hNtDll         = NULL;

LPVOID             lpSystemInfo   = NULL;

DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;

DWORD              dwTotalProcess = 0;

DWORD              dwReturnLength;

NTSTATUS           Status; 

LONGLONG           llTempTime;

__try

hNtDll = LoadLibrary("NtDll.dll");

            if(hNtDll == NULL)

             printf("LoadLibrary Error: %d\n",GetLastError());

        __leave;

}

NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"

NtQuerySystemInformation");

           if(NtQuerySystemInformation == NULL)

        printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetL

astError());

         __leave;

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);

Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,

                           lpSystemInfo,

dwNumberBytes,

&dwReturnLength);

if(Status == STATUS_INFO_LENGTH_MISMATCH)

printf("STATUS_INFO_LENGTH_MISMATCH\n");

__leave;

else if(Status != STATUS_SUCCESS)

printf("NtQuerySystemInformation Error: %d\n",GetLastError());

printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","

Prio.","Thread","Handle","CPU Time");

printf("--------------------------------------------------------------------

------\n");

pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;

while(pSystemProc->NextEntryDelta != 0)

if(pSystemProc->ProcessId != 0)

wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);

else

wprintf(L"%-20s",L"System Idle Process");

printf("%6d",pSystemProc->ProcessId);

printf("%7d",pSystemProc->InheritedFromProcessId);

printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);

printf("%6d",pSystemProc->BasePriority);

printf("%7d",pSystemProc->ThreadCount);

printf("%7d",pSystemProc->HandleCount);

llTempTime  = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.Quad

Part;

llTempTime /= 10000;

printf("%3d:",llTempTime/(60*60*1000));

llTempTime %= 60*60*1000;

printf("%.2d:",llTempTime/(60*1000));

llTempTime %= 60*1000;

printf("%.2d.",llTempTime/1000);

llTempTime %= 1000;

printf("%.3d",llTempTime);

printf("\n");

dwTotalProcess ++;

pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEn

tryDelta);

printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);

printf("PID\t ==> Process Identification\n");

printf("PPID\t ==> Parent Process Identification\n");

printf("WsSize\t ==> Working Set Size\n");

printf("Prio.\t ==> Base Priority\n");

printf("Thread\t ==> Thread Count\n");

printf("Handle\t ==> Handle Count\n");

printf("CPU Time ==> Processor Time\n");

__finally

if(lpSystemInfo != NULL)

free(lpSystemInfo);

if(hNtDll != NULL)

        FreeLibrary(hNtDll);

return 0;

DWORD SpeciProcess(DWORD dwPID)

       PSYSTEM_PROCESSES  pSystemProc    = NULL;

PSYSTEM_THREADS    pSystemThre    = NULL;  

ULONG              ulIndex;

            printf("LoadLibrary Error: %d\n",GetLastError());

               __leave;

      if(NtQuerySystemInformation == NULL)

             __leave;

if(pSystemProc->ProcessId == dwPID)

printf("ProcessName:\t\t ");

wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);

wprintf(L"%-20s\n",L"System Idle Process");

printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);

printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);

printf("KernelTime:\t\t ");

llTempTime  = pSystemProc->KernelTime.QuadPart;

printf("%d:",llTempTime/(60*60*1000));

printf("%.3d\t",llTempTime);

printf("UserTime:\t\t");

llTempTime  = pSystemProc->UserTime.QuadPart;

printf("%.3d\n",llTempTime);

printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/

(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystem

Proc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);

printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);

printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);

printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount)

;

printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorki

ngSetSize/1024);

printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize

/1024);

printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPaged

PoolUsage/1024);

printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsa

ge/1024);

printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNo

nPagedPoolUsage/1024);

printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPo

olUsage/1024);

printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsa

printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024

);

printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualS

ize/1024);

printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1

024);

printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCoun

t);

printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperation

Count);

printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCo

unt);

printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperati

onCount);

printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCo

printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOpera

tionCount);

printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv",

"User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");

            printf("---------------------------------------------------------

----------------------\n");

for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)

pSystemThre = &pSystemProc->Threads[ulIndex];

printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);

       printf("%3d",pSystemProc->Threads[ulIndex].Priority);

printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);

     printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 10

0)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

      printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100

)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

llTempTime  = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;

printf("%2d:",llTempTime/(60*60*1000));

printf("%.2d.",llTempTime/(60*1000));

llTempTime %= 100;

printf("%.2d ",llTempTime);

llTempTime  = pSystemProc->Threads[ulIndex].UserTime.QuadPart;

printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);

printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);

switch(pSystemProc->Threads[ulIndex].State)

case StateInitialized:

printf("%6s","Init.");

break;

case StateReady:

printf("%6s","Ready");

case StateRunning:

printf("%6s","Run");

case StateStandby:

printf("%6s","StBy.");

case StateTerminated:

printf("%6s","Term.");

case StateWait:

printf("%6s","Wait");

case StateTransition:

printf("%6s","Tran.");

case StateUnknown:

printf("%6s","Unkn.");

default:

switch(pSystemProc->Threads[ulIndex].WaitReason)

case Executive:

printf(" %-8s","Executi.");

case FreePage:

printf(" %-8s","FreePag.");

case PageIn:

printf(" %-8s","PageIn");

case PoolAllocation:

printf(" %-8s","PoolAll.");

case DelayExecution:

printf(" %-8s","DelayEx.");

case Suspended:

printf(" %-8s","Suspend.");

case UserRequest:

printf(" %-8s","UserReq.");

case WrExecutive:

printf(" %-8s","WrExect.");

case WrFreePage:

printf(" %-8s","WrFrePg.");

case WrPageIn:

printf(" %-8s","WrPageIn");

case WrPoolAllocation:

printf(" %-8s","WrPoolA.");

case WrSuspended:

printf(" %-8s","WrSuspe.");

case WrUserRequest:

printf(" %-8s","WrUsReq.");

case WrEventPair:

printf(" %-8s","WrEvent.");

case WrQueue:

printf(" %-8s","WrQueue");

case WrLpcReceive:

printf(" %-8s","WrLpcRv.");

case WrLpcReply:

printf(" %-8s","WrLpcRp.");

case WrVertualMemory:

printf(" %-8s","WrVerMm.");

case WrPageOut:

printf(" %-8s","WrPgOut.");

case WrRendezvous:

printf(" %-8s","WrRende.");

case WrKernel:

printf(" %-8s","WrKernel");

printf(" %-8s","Unknown");

                 printf("\n");

                  printf("----------------------------------------------------

---------------------------\n\n");

                    printf("Total %d Thread(s) !\n\n",ulIndex);

if(dwTotalProcess == 0)

printf("Could not found the %d Process !\n",dwPID);

printf("TID:\t\t====>\tThread Identification\n");

printf("Pri:\t\t====>\tPriority\n");

printf("BPr:\t\t====>\tBase Priority\n");

printf("Priv:\t\t====>\tPrivilege\n");

printf("StartAddr:\t====>\tThread Start Address\n");

printf("CSwitC:\t\t====>\tContext Switch Count\n");

printf("WtReason:\t====>\tWait Reason\n");

VOID Start()

printf("T-PMList, by TOo2y\n");

printf("Date: 05-10-2003\n\n");

return ;

VOID Usage()

printf("Usage:\tT-PMList  [-e] | [-s PID]\n"); 

printf("  -e\t  Enumerate All Processes\n");

printf("  -s PID  Show Special Process Information with PID\n\n");

#endif

2.T-PMPerf的頭檔案源代碼：

#ifndef T_PMPERF_H

#define T_PMPERF_H

#include "windows.h"

#include "stdio.h"

#define SYSTEM_PERF_INFO             0x02

#define SYSTEM_PROC_TIME             0x08

#define SYSTEM_PAGE_INFO             0x12

#define SYSTEM_CACHE_INFO            0x15

typedef LONG  NTSTATUS;

typedef DWORD SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION

LARGE_INTEGER  IdleTime;

LARGE_INTEGER  ReadTransferCount;

LARGE_INTEGER  WriteTransferCount;

LARGE_INTEGER  OtherTransferCount;

ULONG          ReadOperationCount;

ULONG          WriteOperationCount;

ULONG          OtherOperationCount;

ULONG          AvailablePages;

ULONG          TotalCommittedPages;

ULONG          TotalCommitLimit;

ULONG          PeakCommitment;

ULONG          PageFaults;

ULONG          WriteCopyFaults;

ULONG          TransitionFaults;

ULONG          Reserved1;

ULONG          DemandZeroFaults;

ULONG          PagesRead;

ULONG          PageReadIos;

ULONG          PagefilePagesWritten;

ULONG          PagefilePageWriteIos;

ULONG          MappedFilePagesWritten;

ULONG          MappedFileWriteIos;

ULONG          PagedPoolUsage;

ULONG          NonPagedPoolUsage;

ULONG          PagedPoolAllocs;

ULONG          PagedPoolFrees;

ULONG          NonPagedPoolAllocs;

ULONG          NonPagedPoolFress;

ULONG          TotalFreeSystemPtes;

ULONG          SystemCodePage;

ULONG          TotalSystemDriverPages;

ULONG          TotalSystemCodePages;

ULONG          SmallNonPagedLookasideListAllocateHits;

ULONG          SmallPagedLookasideListAllocateHits;

ULONG          Reserved3;

ULONG          MmSystemCachePage;

ULONG          PagedPoolPage;

ULONG          SystemDriverPage;

ULONG          FastReadNoWait;

ULONG          FastReadWait;

ULONG          FastReadResourceMiss;

ULONG          FastReadNotPossible;

ULONG          FastMdlReadNoWait;

ULONG          FastMdlReadWait;

ULONG          FastMdlReadResourceMiss;

ULONG          FastMdlReadNotPossible;

ULONG          MapDataNoWait;

ULONG          MapDataWait;

ULONG          MapDataNoWaitMiss;

ULONG          MapDataWaitMiss;

ULONG          PinMappedDataCount;

ULONG          PinReadNoWait;

ULONG          PinReadWait;

ULONG          PinReadNoWaitMiss;

ULONG          PinReadWaitMiss;

ULONG          CopyReadNoWait;

ULONG          CopyReadWait;

ULONG          CopyReadNoWaitMiss;

ULONG          CopyReadWaitMiss;

ULONG          MdlReadNoWait;

ULONG          MdlReadWait;

ULONG          MdlReadNoWaitMiss;

ULONG          MdlReadWaitMiss;

ULONG          ReadAheadIos;

ULONG          LazyWriteIos;

ULONG          LazyWritePages;

ULONG          DataFlushes;

ULONG          DataPages;

ULONG          ContextSwitches;

ULONG          FirstLevelTbFills;

ULONG          SecondLevelTbFills;

ULONG          SystemCall;

}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct __SYSTEM_PROCESSOR_TIMES

LARGE_INTEGER IdleTime;

LARGE_INTEGER DpcTime;

LARGE_INTEGER InterruptTime;

ULONG         InterruptCount;

}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

typedef struct _SYSTEM_PAGEFILE_INFORMATION

ULONG NetxEntryOffset;

ULONG CurrentSize;

ULONG TotalUsed;

ULONG PeakUsed;

UNICODE_STRING FileName;

}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

typedef struct _SYSTEM_CACHE_INFORMATION

ULONG SystemCacheWsSize;

ULONG SystemCacheWsPeakSize;

ULONG SystemCacheWsFaults;

ULONG SystemCacheWsMinimum;

ULONG SystemCacheWsMaximum;

ULONG TransitionSharedPages;

ULONG TransitionSharedPagesPeak;

ULONG Reserved[2];

}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)

    INT    ULONG,

           OUT    PULONG OPTION);

DWORD PerfInfo()

SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;

HMODULE         hNtDll = NULL;

DWORD           dwNumberBytes;

DWORD           dwReturnLength;

NTSTATUS        Status;

LONGLONG        llTempTime;

       if(hNtDll == NULL)

           __leave;

if(NtQuerySystemInformation == NULL)

printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastErr

or());

dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);

Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,

                           &SystemPerfInfo,

if(Status != STATUS_SUCCESS)

printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError(

));

printf("IdleTime:\t\t");

llTempTime  = SystemPerfInfo.IdleTime.QuadPart;

printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);

printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);

printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);

printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);

printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);

printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);

printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);

printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);

printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);

printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);

printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);

printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);

printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);

printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);

printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);

printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);

printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);

printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);

printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWrit

ten);

printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);

printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);

printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);

printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);

printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);

printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);

printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);

printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);

printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);

printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);

printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages

printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);

printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);

printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);

printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);

printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);

printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);

printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);

printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);

printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossi

ble);

printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss

printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);

printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);

printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);

printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);

printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);

printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);

printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);

printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);

printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);

printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);

printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);

printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);

printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);

printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);

printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);

printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);

printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);

printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);

printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);

printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);

printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);

printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);

printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);

printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);

printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);

printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);

printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);

printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPage

dLookasideListAllocateHits);

printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallN

onPagedLookasideListAllocateHits);

FreeLibrary(hNtDll);

DWORD ProcTime()

SYSTEM_PROCESSOR_TIMES  SystemProcTime;

HMODULE                 hNtDll = NULL;

DWORD                   dwNumberBytes;

DWORD                   dwReturnLength;

NTSTATUS                Status;

LONGLONG                llTempTime;

          printf("LoadLibrary Error: %d\n",GetLastError());

dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);

printf("GetProcAddress Error: %d\n",GetLastError());

Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,

                           &SystemProcTime,

printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastErr

llTempTime  = SystemProcTime.IdleTime.QuadPart;

printf("KernelTime:\t\t");

llTempTime  = SystemProcTime.KernelTime.QuadPart;

llTempTime  = SystemProcTime.UserTime.QuadPart;

printf("DpcTime:\t\t");

llTempTime  = SystemProcTime.DpcTime.QuadPart;

printf("InterruptTime:\t\t");

llTempTime  = SystemProcTime.InterruptTime.QuadPart;

printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);

DWORD PagefileInfo()

PSYSTEM_PAGEFILE_INFORMATION   pSystemPagefileInfo;

PVOID                          pBuffer;

HMODULE                        hNtDll = NULL;

DWORD                          dwNumberBytes;

DWORD                          dwReturnLength;

       NTSTATUS                       Status;

dwNumberBytes = MAX_INFO_BUF_LEN;

pBuffer = (LPVOID)malloc(dwNumberBytes);

Status  = NtQuerySystemInformation(SYSTEM_PAGE_INFO,

                            pBuffer,

 dwNumberBytes,

 &dwReturnLength);

printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;

do

printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);

printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);

printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);

wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSys

temPagefileInfo->NetxEntryOffset);

}while(pSystemPagefileInfo->NetxEntryOffset != 0);

if(pBuffer != NULL)

free(pBuffer);

} 

if(hNtDll  != NULL)

DWORD CacheInfo()

 SYSTEM_CACHE_INFORMATION       SystemCacheInfo;

 HMODULE                        hNtDll = NULL;

 DWORD                          dwNumberBytes;

 DWORD                          dwReturnLength;

 NTSTATUS                       Status;

 __try

  hNtDll = LoadLibrary("NtDll.dll");

         if(hNtDll == NULL)

  {

    printf("LoadLibrary Error: %d\n",GetLastError());

   __leave;

  }

  NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

  if(NtQuerySystemInformation == NULL)

   printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

  dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);

  Status  = NtQuerySystemInformation(SYSTEM_CACHE_INFO,

                            &SystemCacheInfo,dwNumberBytes,&dwReturnLength);

  if(Status != STATUS_SUCCESS)

   printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError());

  printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize1024);

  printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);

  printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);

  printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);

  printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);

  printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);

  printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);

 }__finally

  if(hNtDll != NULL)

  FreeLibrary(hNtDll);

 }

 return 0;

 printf("T-PMPerf, by TOo2y\n");

 printf("Date: 05-09-2003\n\n");

 return ;

 printf("Usage:\tT-PMPerf <Option>\n");

 printf("Option:\n");

 printf("  -Perf   System Performance Information\n");

 printf("  -Proc   System Processor Information\n");

 printf("  -Page   System Pagefile Information\n");

 printf("  -Cache  System Cache Information\n");

本文轉自einyboy部落格園部落格，原文連結：http://www.cnblogs.com/einyboy/archive/2012/06/13/2548243.html