探測Windows2K/XP/2003本機系統資訊
Native API乃Windows使用者模式中為上層Win32 API提供介面的本機系統服務。平常我們總是呼叫MS為我們提供的公用的Win32 API函式來實現來實現我們系統的功能。（PS：前不久，偶寫了一個Windows工作管理員，支援對桌面，程式/執行緒，系統效能，磁碟，環境變數，事件日誌，網路，裝置驅動，Win32服務，共享，使用者，系統及關機等資訊的探測和控制，完全基於Win32 API，大家可以到我們的主頁下載）。今天我們要談的是如何通過本機系統服務(Native API）來探測本機系統資訊。當然，微軟沒有為我們提供關於本機系統服務的文件(Undocumented)，也就是不會為對它的使用提供任何的保證，所以我們不提倡使用Native API來開發軟體。不過在特殊情況下，本機系統服務卻為我們提供了通向“祕密”的捷徑。本文提到的資訊僅在Windows2000/XP/2003上測試過。
今天，我們主要討論的是一個函式NtQuerySystemInformation(ZwQuerySystemInformation)。當然，你不要小看這麼一個函式，它卻為我們提供了豐富的系統資訊，同時還包括對某些資訊的控制和設定。以下是這個函式的原型：
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
從中可以看到，SystemInformationClass是一個型別資訊，它大概提供了50餘種資訊，也就是我們可以通過這個函式對大約50多種的系統資訊進行探測或設定。SystemInformation是一個LPVOID型的指標，它為我們提供需要獲得的資訊，或是我們需要設定的系統資訊。SystemInformationLength是SystemInformation的長度，它根據探測的資訊型別來決定。至於ReturnLength則是系統返回的需要的長度，通常可以設定為空指標(NULL)。
首先，我們來看看大家比較熟悉的系統程式/執行緒相關的資訊。這個題目在網上已經討論了N多年了，所以我就不在老生常談了，呵呵。那麼就提出這個結構型別的定義：
typedef struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta; //構成結構序列的偏移量；
ULONG ThreadCount; //執行緒數目；
ULONG Reserved1[6];
LARGE_INTEGER CreateTime; //建立時間；
LARGE_INTEGER UserTime; //使用者模式(Ring 3)的CPU時間；
LARGE_INTEGER KernelTime; //核心模式(Ring 0)的CPU時間；
UNICODE_STRING ProcessName; //程式名稱；
KPRIORITY BasePriority; //程式優先權；
ULONG ProcessId; //程式識別符號；
ULONG InheritedFromProcessId; //父程式的識別符號；
ULONG HandleCount; //控制程式碼數目；
ULONG Reserved2[2];
VM_COUNTERS VmCounters; //虛擬儲存器的結構，見下；
IO_COUNTERS IoCounters; //IO計數結構，見下；
SYSTEM_THREADS Threads[1]; //程式相關執行緒的結構陣列，見下；
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime; //CPU核心模式使用時間；
LARGE_INTEGER UserTime; //CPU使用者模式使用時間；
LARGE_INTEGER CreateTime; //執行緒建立時間；
ULONG WaitTime; //等待時間；
PVOID StartAddress; //執行緒開始的虛擬地址；
CLIENT_ID ClientId; //執行緒識別符號；
KPRIORITY Priority; //執行緒優先順序；
KPRIORITY BasePriority; //基本優先順序；
ULONG ContextSwitchCount; //環境切換數目；
THREAD_STATE State; //當前狀態；
KWAIT_REASON WaitReason; //等待原因；
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize; //虛擬儲存峰值大小；
ULONG VirtualSize; //虛擬儲存大小；
ULONG PageFaultCount; //頁故障數目；
ULONG PeakWorkingSetSize; //工作集峰值大小；
ULONG WorkingSetSize; //工作集大小；
ULONG QuotaPeakPagedPoolUsage; //分頁池使用配額峰值；
ULONG QuotaPagedPoolUsage; //分頁池使用配額；
ULONG QuotaPeakNonPagedPoolUsage; //非分頁池使用配額峰值；
ULONG QuotaNonPagedPoolUsage; //非分頁池使用配額；
ULONG PagefileUsage; //頁檔案使用情況；
ULONG PeakPagefileUsage; //頁檔案使用峰值；
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount; //I/O讀運算元目；
LARGE_INTEGER WriteOperationCount; //I/O寫運算元目；
LARGE_INTEGER OtherOperationCount; //I/O其他運算元目；
LARGE_INTEGER ReadTransferCount; //I/O讀資料數目；
LARGE_INTEGER WriteTransferCount; //I/O寫資料數目；
LARGE_INTEGER OtherTransferCount; //I/O其他運算元據數目；
}IO_COUNTERS,*PIO_COUNTERS;以上這些資訊應該是比較全面的了，在Win32 API裡為我們提供了PSAPI(程式狀態)和ToolHelp32這兩種探測系統程式/執行緒資訊的方式，在Windows2K/XP/2003都支援它們。
現在，我們來看看系統的效能資訊，效能結構SYSTEM_PERFORMANCE_INFORMATION為我們提供了70餘種系統效能方面的資訊，真是太豐富了，請慢慢體會~
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime; //CPU空閒時間；
LARGE_INTEGER ReadTransferCount; //I/O讀運算元目；
LARGE_INTEGER WriteTransferCount; //I/O寫運算元目；
LARGE_INTEGER OtherTransferCount; //I/O其他運算元目；
ULONG ReadOperationCount; //I/O讀資料數目；
ULONG WriteOperationCount; //I/O寫資料數目；
ULONG OtherOperationCount; //I/O其他運算元據數目；
ULONG AvailablePages; //可獲得的頁數目；
ULONG TotalCommittedPages; //總共提交頁數目；
ULONG TotalCommitLimit; //已提交頁數目；
ULONG PeakCommitment; //頁提交峰值；
ULONG PageFaults; //頁故障數目；
ULONG WriteCopyFaults; //Copy-On-Write故障數目；
ULONG TransitionFaults; //軟頁故障數目；
ULONG Reserved1;
ULONG DemandZeroFaults; //需求0故障數；
ULONG PagesRead; //讀頁數目；
ULONG PageReadIos; //讀頁I/O運算元；
ULONG Reserved2[2];
ULONG PagefilePagesWritten; //已寫頁檔案頁數；
ULONG PagefilePageWriteIos; //已寫頁檔案運算元；
ULONG MappedFilePagesWritten; //已寫對映檔案頁數；
ULONG MappedFileWriteIos; //已寫對映檔案運算元；
ULONG PagedPoolUsage; //分頁池使用；
ULONG NonPagedPoolUsage; //非分頁池使用；
ULONG PagedPoolAllocs; //分頁池分配情況；
ULONG PagedPoolFrees; //分頁池釋放情況；
ULONG NonPagedPoolAllocs; //非分頁池分配情況；
ULONG NonPagedPoolFress; //非分頁池釋放情況；
ULONG TotalFreeSystemPtes; //系統頁表項釋放總數；
ULONG SystemCodePage; //作業系統內碼表數；
ULONG TotalSystemDriverPages; //可分頁驅動程式頁數；
ULONG TotalSystemCodePages; //作業系統內碼表總數；
ULONG SmallNonPagedLookasideListAllocateHits; //小非分頁側視列表分配次數；
ULONG SmallPagedLookasideListAllocateHits; //小分頁側視列表分配次數；
ULONG Reserved3;
ULONG MmSystemCachePage; //系統快取頁數；
ULONG PagedPoolPage; //分頁池頁數；
ULONG SystemDriverPage; //可分頁驅動頁數；
ULONG FastReadNoWait; //非同步快速讀數目；
ULONG FastReadWait; //同步快速讀數目；
ULONG FastReadResourceMiss; //快速讀資源衝突數；
ULONG FastReadNotPossible; //快速讀失敗數；
ULONG FastMdlReadNoWait; //非同步MDL快速讀數目；
ULONG FastMdlReadWait; //同步MDL快速讀數目；
ULONG FastMdlReadResourceMiss; //MDL讀資源衝突數；
ULONG FastMdlReadNotPossible; //MDL讀失敗數；
ULONG MapDataNoWait; //非同步對映資料次數；
ULONG MapDataWait; //同步對映資料次數；
ULONG MapDataNoWaitMiss; //非同步對映資料衝突次數；
ULONG MapDataWaitMiss; //同步對映資料衝突次數；
ULONG PinMappedDataCount; //牽制對映資料數目；
ULONG PinReadNoWait; //牽制非同步讀數目；
ULONG PinReadWait; //牽制同步讀數目；
ULONG PinReadNoWaitMiss; //牽制非同步讀衝突數目；
ULONG PinReadWaitMiss; //牽制同步讀衝突數目；
ULONG CopyReadNoWait; //非同步拷貝讀次數；
ULONG CopyReadWait; //同步拷貝讀次數；
ULONG CopyReadNoWaitMiss; //非同步拷貝讀故障次數；
ULONG CopyReadWaitMiss; //同步拷貝讀故障次數；
ULONG MdlReadNoWait; //非同步MDL讀次數；
ULONG MdlReadWait; //同步MDL讀次數；
ULONG MdlReadNoWaitMiss; //非同步MDL讀故障次數；
ULONG MdlReadWaitMiss; //同步MDL讀故障次數；
ULONG ReadAheadIos; //向前讀運算元目；
ULONG LazyWriteIos; //LAZY寫運算元目；
ULONG LazyWritePages; //LAZY寫頁檔案數目；
ULONG DataFlushes; //快取重新整理次數；
ULONG DataPages; //快取重新整理頁數；
ULONG ContextSwitches; //環境切換數目；
ULONG FirstLevelTbFills; //第一層緩衝區填充次數；
ULONG SecondLevelTbFills; //第二層緩衝區填充次數；
ULONG SystemCall; //系統呼叫次數；
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;現在看到的是結構SYSTEM_PROCESSOR_TIMES提供的系統處理器的使用情況，包括各種情況下的使用時間及中斷數目：
typedef struct __SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime; //空閒時間；
LARGE_INTEGER KernelTime; //核心模式時間；
LARGE_INTEGER UserTime; //使用者模式時間；
LARGE_INTEGER DpcTime; //延遲過程呼叫時間；
LARGE_INTEGER InterruptTime; //中斷時間；
ULONG InterruptCount; //中斷次數；
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;頁檔案的使用情況，SYSTEM_PAGEFILE_INFORMATION提供了所需的相關資訊：
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NetxEntryOffset; //下一個結構的偏移量；
ULONG CurrentSize; //當前頁檔案大小；
ULONG TotalUsed; //當前使用的頁檔案數；
ULONG PeakUsed; //當前使用的頁檔案峰值數；
UNICODE_STRING FileName; //頁檔案的檔名稱；
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;系統快取記憶體的使用情況參見結構SYSTEM_CACHE_INFORMATION提供的資訊：
typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG SystemCacheWsSize; //快取記憶體大小；
ULONG SystemCacheWsPeakSize; //快取記憶體峰值大小；
ULONG SystemCacheWsFaults; //快取記憶體頁故障數目；
ULONG SystemCacheWsMinimum; //快取記憶體最小頁大小；
ULONG SystemCacheWsMaximum; //快取記憶體最大頁大小；
ULONG TransitionSharedPages; //共享頁數目；
ULONG TransitionSharedPagesPeak; //共享頁峰值數目；
ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;1.T-PMList的標頭檔案原始碼：
#ifndef T_PMLIST_H
#define T_PMLIST_H
#include <windows.h>
#include <stdio.h>
#define NT_PROCESSTHREAD_INFO 0x05
#define MAX_INFO_BUF_LEN 0x500000
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
typedef LONG NTSTATUS;
typedef struct _LSA_UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;
typedef LONG KPRIORITY;
typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
ULONG QuotaPeakPagedPoolUsage;
ULONG QuotaPagedPoolUsage;
ULONG QuotaPeakNonPagedPoolUsage;
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;
typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;
typedef enum _THREAD_STATE
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
}THREAD_STATE;
typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVertualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel
}KWAIT_REASON;
typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
THREAD_STATE State;
KWAIT_REASON WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;
typedef struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;
typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS,
IN OUT PVOID,
IN ULONG,
OUT PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD EnumProcess()
{
PSYSTEM_PROCESSES pSystemProc;
HMODULE hNtDll = NULL;
LPVOID lpSystemInfo = NULL;
DWORD dwNumberBytes = MAX_INFO_BUF_LEN;
DWORD dwTotalProcess = 0;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH\n");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","Prio.","Thread","Handle","CPU Time");
printf("--------------------------------------------------------------------------\n");
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s",L"System Idle Process");
}
printf("%6d",pSystemProc->ProcessId);
printf("%7d",pSystemProc->InheritedFromProcessId);
printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);
printf("%6d",pSystemProc->BasePriority);
printf("%7d",pSystemProc->ThreadCount);
printf("%7d",pSystemProc->HandleCount);
llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf("%3d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d",llTempTime);
printf("\n");
dwTotalProcess ++;
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
}
printf("--------------------------------------------------------------------------\n");
printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);
printf("PID\t ==> Process Identification\n");
printf("PPID\t ==> Parent Process Identification\n");
printf("WsSize\t ==> Working Set Size\n");
printf("Prio.\t ==> Base Priority\n");
printf("Thread\t ==> Thread Count\n");
printf("Handle\t ==> Handle Count\n");
printf("CPU Time ==> Processor Time\n");
}
__finally
{
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD SpeciProcess(DWORD dwPID)
{
PSYSTEM_PROCESSES pSystemProc = NULL;
PSYSTEM_THREADS pSystemThre = NULL;
HMODULE hNtDll = NULL;
LPVOID lpSystemInfo = NULL;
DWORD dwNumberBytes = MAX_INFO_BUF_LEN;
DWORD dwTotalProcess = 0;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
ULONG ulIndex;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH\n");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId == dwPID)
{
printf("ProcessName:\t\t ");
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s\n",L"System Idle Process");
}
printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);
printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);
printf("KernelTime:\t\t ");
llTempTime = pSystemProc->KernelTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\t",llTempTime);
printf("UserTime:\t\t");
llTempTime = pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);
printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);
printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);
printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount);
printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorkingSetSize/1024);
printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize/1024);
printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPagedPoolUsage/1024);
printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);
printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage/1024);
printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);
printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsage/1024);
printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);
printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualSize/1024);
printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);
printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCount);
printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperationCount);
printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCount);
printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);
printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCount);
printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);
printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv","User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");
printf("-------------------------------------------------------------------------------\n");
for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
{
pSystemThre = &pSystemProc->Threads[ulIndex];
printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);
printf("%3d",pSystemProc->Threads[ulIndex].Priority);
printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);
printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
llTempTime /= 10000;
printf("%2d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d.",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 100;
printf("%.2d ",llTempTime);
llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
llTempTime /= 10000;
printf("%2d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d.",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 100;
printf("%.2d ",llTempTime);
printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);
printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);
switch(pSystemProc->Threads[ulIndex].State)
{
case StateInitialized:
printf("%6s","Init.");
break;
case StateReady:
printf("%6s","Ready");
break;
case StateRunning:
printf("%6s","Run");
break;
case StateStandby:
printf("%6s","StBy.");
break;
case StateTerminated:
printf("%6s","Term.");
break;
case StateWait:
printf("%6s","Wait");
break;
case StateTransition:
printf("%6s","Tran.");
break;
case StateUnknown:
printf("%6s","Unkn.");
break;
default:
printf("%6s","Unkn.");
break;
}
switch(pSystemProc->Threads[ulIndex].WaitReason)
{
case Executive:
printf(" %-8s","Executi.");
break;
case FreePage:
printf(" %-8s","FreePag.");
break;
case PageIn:
printf(" %-8s","PageIn");
break;
case PoolAllocation:
printf(" %-8s","PoolAll.");
break;
case DelayExecution:
printf(" %-8s","DelayEx.");
break;
case Suspended:
printf(" %-8s","Suspend.");
break;
case UserRequest:
printf(" %-8s","UserReq.");
break;
case WrExecutive:
printf(" %-8s","WrExect.");
break;
case WrFreePage:
printf(" %-8s","WrFrePg.");
break;
case WrPageIn:
printf(" %-8s","WrPageIn");
break;
case WrPoolAllocation:
printf(" %-8s","WrPoolA.");
break;
case WrSuspended:
printf(" %-8s","WrSuspe.");
break;
case WrUserRequest:
printf(" %-8s","WrUsReq.");
break;
case WrEventPair:
printf(" %-8s","WrEvent.");
break;
case WrQueue:
printf(" %-8s","WrQueue");
break;
case WrLpcReceive:
printf(" %-8s","WrLpcRv.");
break;
case WrLpcReply:
printf(" %-8s","WrLpcRp.");
break;
case WrVertualMemory:
printf(" %-8s","WrVerMm.");
break;
case WrPageOut:
printf(" %-8s","WrPgOut.");
break;
case WrRendezvous:
printf(" %-8s","WrRende.");
break;
case WrKernel:
printf(" %-8s","WrKernel");
break;
default:
printf(" %-8s","Unknown");
break;
}
printf("\n");
}
printf("-------------------------------------------------------------------------------\n\n");
printf("Total %d Thread(s) !\n\n",ulIndex);
dwTotalProcess ++;
break;
}
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
}
}
__finally
{
if(dwTotalProcess == 0)
{
printf("Could not found the %d Process !\n",dwPID);
}
else
{
printf("TID:\t\t====>\tThread Identification\n");
printf("Pri:\t\t====>\tPriority\n");
printf("BPr:\t\t====>\tBase Priority\n");
printf("Priv:\t\t====>\tPrivilege\n");
printf("StartAddr:\t====>\tThread Start Address\n");
printf("CSwitC:\t\t====>\tContext Switch Count\n");
printf("WtReason:\t====>\tWait Reason\n");
}
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
VOID Start()
{
printf("T-PMList, by TOo2y\n");
printf("E-mail: TOo2y@safechina.net\n");
printf("HomePage: www.safechina.net\n");
printf("Date: 05-10-2003\n\n");
return ;
}
VOID Usage()
{
printf("Usage:\tT-PMList [-e] | [-s PID]\n");
printf(" -e\t Enumerate All Processes\n");
printf(" -s PID Show Special Process Information with PID\n\n");
return ;
}
#endif2.T-PMPerf的標頭檔案原始碼
#ifndef T_PMPERF_H
#define T_PMPERF_H
#include "windows.h"
#include "stdio.h"
#define SYSTEM_PERF_INFO 0x02
#define SYSTEM_PROC_TIME 0x08
#define SYSTEM_PAGE_INFO 0x12
#define SYSTEM_CACHE_INFO 0x15
#define MAX_INFO_BUF_LEN 0x500000
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
typedef LONG NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef struct _LSA_UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;
typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
ULONG ReadOperationCount;
ULONG WriteOperationCount;
ULONG OtherOperationCount;
ULONG AvailablePages;
ULONG TotalCommittedPages;
ULONG TotalCommitLimit;
ULONG PeakCommitment;
ULONG PageFaults;
ULONG WriteCopyFaults;
ULONG TransitionFaults;
ULONG Reserved1;
ULONG DemandZeroFaults;
ULONG PagesRead;
ULONG PageReadIos;
ULONG Reserved2[2];
ULONG PagefilePagesWritten;
ULONG PagefilePageWriteIos;
ULONG MappedFilePagesWritten;
ULONG MappedFileWriteIos;
ULONG PagedPoolUsage;
ULONG NonPagedPoolUsage;
ULONG PagedPoolAllocs;
ULONG PagedPoolFrees;
ULONG NonPagedPoolAllocs;
ULONG NonPagedPoolFress;
ULONG TotalFreeSystemPtes;
ULONG SystemCodePage;
ULONG TotalSystemDriverPages;
ULONG TotalSystemCodePages;
ULONG SmallNonPagedLookasideListAllocateHits;
ULONG SmallPagedLookasideListAllocateHits;
ULONG Reserved3;
ULONG MmSystemCachePage;
ULONG PagedPoolPage;
ULONG SystemDriverPage;
ULONG FastReadNoWait;
ULONG FastReadWait;
ULONG FastReadResourceMiss;
ULONG FastReadNotPossible;
ULONG FastMdlReadNoWait;
ULONG FastMdlReadWait;
ULONG FastMdlReadResourceMiss;
ULONG FastMdlReadNotPossible;
ULONG MapDataNoWait;
ULONG MapDataWait;
ULONG MapDataNoWaitMiss;
ULONG MapDataWaitMiss;
ULONG PinMappedDataCount;
ULONG PinReadNoWait;
ULONG PinReadWait;
ULONG PinReadNoWaitMiss;
ULONG PinReadWaitMiss;
ULONG CopyReadNoWait;
ULONG CopyReadWait;
ULONG CopyReadNoWaitMiss;
ULONG CopyReadWaitMiss;
ULONG MdlReadNoWait;
ULONG MdlReadWait;
ULONG MdlReadNoWaitMiss;
ULONG MdlReadWaitMiss;
ULONG ReadAheadIos;
ULONG LazyWriteIos;
ULONG LazyWritePages;
ULONG DataFlushes;
ULONG DataPages;
ULONG ContextSwitches;
ULONG FirstLevelTbFills;
ULONG SecondLevelTbFills;
ULONG SystemCall;
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;
typedef struct __SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
ULONG InterruptCount;
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NetxEntryOffset;
ULONG CurrentSize;
ULONG TotalUsed;
ULONG PeakUsed;
UNICODE_STRING FileName;
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;
typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG SystemCacheWsSize;
ULONG SystemCacheWsPeakSize;
ULONG SystemCacheWsFaults;
ULONG SystemCacheWsMinimum;
ULONG SystemCacheWsMaximum;
ULONG TransitionSharedPages;
ULONG TransitionSharedPagesPeak;
ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;
typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS,
IN OUT PVOID,
INT ULONG,
OUT PULONG OPTION);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
DWORD PerfInfo()
{
SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,
&SystemPerfInfo,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError());
__leave;
}
printf("IdleTime:\t\t");
llTempTime = SystemPerfInfo.IdleTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);
printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);
printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);
printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);
printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);
printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);
printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);
printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);
printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);
printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);
printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);
printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);
printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);
printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);
printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);
printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);
printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);
printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);
printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWritten);
printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);
printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);
printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);
printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);
printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);
printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);
printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);
printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);
printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);
printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);
printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages);
printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);
printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);
printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);
printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);
printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);
printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);
printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);
printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);
printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossible);
printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss);
printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);
printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);
printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);
printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);
printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);
printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);
printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);
printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);
printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);
printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);
printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);
printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);
printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);
printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);
printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);
printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);
printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);
printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);
printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);
printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);
printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);
printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);
printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);
printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);
printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);
printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);
printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);
printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPagedLookasideListAllocateHits);
printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);
}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD ProcTime()
{
SYSTEM_PROCESSOR_TIMES SystemProcTime;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
LONGLONG llTempTime;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress Error: %d\n",GetLastError());
__leave;
}
Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,
&SystemProcTime,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastError());
__leave;
}
printf("IdleTime:\t\t");
llTempTime = SystemProcTime.IdleTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("KernelTime:\t\t");
llTempTime = SystemProcTime.KernelTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("UserTime:\t\t");
llTempTime = SystemProcTime.UserTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("DpcTime:\t\t");
llTempTime = SystemProcTime.DpcTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("InterruptTime:\t\t");
llTempTime = SystemProcTime.InterruptTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);
printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);
}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD PagefileInfo()
{
PSYSTEM_PAGEFILE_INFORMATION pSystemPagefileInfo;
PVOID pBuffer;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
dwNumberBytes = MAX_INFO_BUF_LEN;
pBuffer = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO,
pBuffer,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());
__leave;
}
pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
do
{
printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);
printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);
printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);
wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);
pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSystemPagefileInfo->NetxEntryOffset);
}while(pSystemPagefileInfo->NetxEntryOffset != 0);
}
__finally
{
if(pBuffer != NULL)
{
free(pBuffer);
}
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
DWORD CacheInfo()
{
SYSTEM_CACHE_INFORMATION SystemCacheInfo;
HMODULE hNtDll = NULL;
DWORD dwNumberBytes;
DWORD dwReturnLength;
NTSTATUS Status;
__try
{
hNtDll = LoadLibrary("NtDll.dll");
if(hNtDll == NULL)
{
printf("LoadLibrary Error: %d\n",GetLastError());
__leave;
}
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}
dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO,
&SystemCacheInfo,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError());
__leave;
}
printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize/1024);
printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);
printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);
printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);
printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);
printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);
printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);
}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}
return 0;
}
VOID Start()
{
printf("T-PMPerf, by TOo2y\n");
printf("E-mail: TOo2y@safechina.net\n");
printf("HomePage: www.safechina.net\n");
printf("Date: 05-09-2003\n\n");
return ;
}
VOID Usage()
{
printf("Usage:\tT-PMPerf <Option>\n");
printf("Option:\n");
printf(" -Perf System Performance Information\n");
printf(" -Proc System Processor Information\n");
printf(" -Page System Pagefile Information\n");
printf(" -Cache System Cache Information\n");
return ;
}
#endif相關文章
- Windows XP系統和Windows Server 2003系統原始碼遭洩露WindowsServer原始碼
- 檢測系統是不是windows xp (轉)Windows
- xp系統筆記本如何替換程式字型的小技巧筆記
- EtreCheckPro for Mac(系統資訊監測)Mac
- 資訊系統效能評測
- Xp系統無法關機故障怎麼解除
- 轉：Windows sysprep 系統重新封裝 2003 xp windows2008Windows封裝
- 遠端桌面管理:tsmmc.msc在xp系統中的使用windows2003Windows
- Windows XP 系統中實現1秒關機(轉)Windows
- 減少WinXP2003系統開機&(轉)
- XP死亡影響中國資訊保安，文件管理系統成企業救星
- 【轉】遠端桌面管理:tsmmc.msc在xp系統中的使用windows2003Windows
- Win7系統共享xp的印表機圖文教程Win7
- xp系統啟動是不讓檢測硬碟的辦法！硬碟
- xp_cmdshell---MSSQL系統漏洞SQL
- 探討基於資訊系統的專案型生產管理
- ArcGIS 9在WIN XP 和 WIN 2003 系統下安裝部分動態庫不能註冊
- DNS資訊探測工具DNSRecon常用命令DNS
- PHP外掛系統的實現(三):實現探測器PHP
- 微軟延長 XP 系統安全支援微軟
- 利用VMware安裝Windows XP/7/8/10 虛擬機器系統Windows虛擬機
- 為安全妥協，起底普京XP系統背後的資訊主權之爭
- xp系統怎麼直接升級到win10系統版本 xp重灌為win10系統方法介紹Win10
- windows 7系統比xp系統更強大的功能Windows
- 獲取計算機系統唯一資訊計算機
- How to change Volume Licence Key for Windows XP and 2003Windows
- 滲透測試之主機探測與埠掃描
- python獲得本機硬體資訊Python
- 帕金森患者的新曙光！AI無線智慧探測系統誕生AI
- Xp系統開始選單裡沒有關機按鈕怎麼
- SONY SZ25CP/C 系統安裝實錄 (XP不能關機)
- xp系統安裝不上pythonPython
- windows xp系統啟動模式介紹Windows模式
- 讓Windows XP自動維護系統Windows
- Windows XP 系統總命令集合(轉)Windows
- 遷移虛擬機器後擴硬碟-windows server 2003系統虛擬機硬碟WindowsServer
- 如何系統還原,XP系統還原全攻略 薦
- 審計系統和資訊(報表)系統是業務系統的有機組成部分