利用Native API获取进程和线程信息

最新推荐文章于 2025-05-13 22:50:30 发布

原创最新推荐文章于 2025-05-13 22:50:30 发布 · 2.9k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#api #buffer #delete #windows #system #list

Windows内核（原创）专栏收录该内容

13 篇文章

订阅专栏

本文介绍如何利用Windows Native API中的ZwQuerySystemInformation函数获取系统进程和线程信息。通过示例代码展示了如何申请内存缓冲区并逐步调整其大小直至成功装载系统信息，最后遍历并打印出每个进程的ID和名称。

    Windows平台下的Native API - ZwQuerySystemInformation可以用来获取很多系统信息,本文以获取系统进程和线程信息为例描述了该函数的用法,以展示它的强大功能。
    首先需要获取该函数的地址，获取Native API地址的方法或直接调用的技术可参照我的文章-《用户态应用程序调用Native API的方法》。
    下面即为示例代码：

     ULONG cbBuffer = 32*1024;
     PUCHAR pBuffer = NULL; // declare pointer to a buffer
     NTSTATUS Status;

     do
     {
         pBuffer = new UCHAR [cbBuffer];

         //
         // try to obtain system information into the buffer
         //
         ULONG ulReturnLength = 0;
         Status = MyZwQuerySystemInformation (SystemProcessesAndThreadsInformation, pBuffer, cbBuffer, &ulReturnLength);

         //
         // if the size of the information is larger than the size of the buffer
         //
         if (Status == STATUS_INFO_LENGTH_MISMATCH)
         {
              delete [] pBuffer; // free the memory associated with the buffer
              cbBuffer *= 2; // and increase buffer size twice its original size
         }
         else if (!NT_SUCCESS(Status)) // if operation is not succeeded by any other reason
         {
              delete [] pBuffer; // free the memory
              return -1; //and exit
         }
     }
     while (Status == STATUS_INFO_LENGTH_MISMATCH);

PSYSTEM_PROCESS_INFORMATION pInfo;
pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;

     //
     // List all the process information
     //
     for (;;)
     {
         _tprintf (_T ("Process ID:/t%i/tProcess Name:/t%s/n"), pInfo->ProcessId,
              (LPWSTR)pInfo->ProcessName.Buffer);

         //
         // if there are no other entries in pInfo, exit the loop
         //
         if (pInfo->NextEntryDelta == 0)
              break;

         //
         // if we are still in the loop, current entry does not contain
         // the process we are looking for, but there is at least one more entry in pInfo
         //
         pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo)+ pInfo->NextEntryDelta); // obtain that new entry
     }

if (pBuffer)
delete [] pBuffer;