NtQuerySystemInformation的使用

今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包

括对某些信息的控制和设置。以下是这个函数的原型：

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

(IN SYSTEM_INFORMATION_CLASS SystemInformationClass,

IN OUT PVOID SystemInformation,

IN ULONG SystemInformationLength,

OUT PULONG ReturnLength OPTIONAL);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

从中可以看到，SystemInformationClass是一个类型信息，它大概提供了50余种信息，也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针，它为我们提供需要获得的信息，或是我们需要设置的系统信息。SystemInformationLength是SystemInformation的长度，它根据探测的信息类型来决

定。至于ReturnLength则是系统返回的需要的长度，通常可以设置为空指针(NULL)。

首先，我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了，所以我就不在老生常谈了，呵呵。那么就提出这个结构类型的定义：

typedef struct _SYSTEM_PROCESSES

{

ULONG NextEntryDelta; //构成结构序列的偏移量；

ULONG ThreadCount; //线程数目；

ULONG Reserved1[6];

LARGE_INTEGER CreateTime; //创建时间；

LARGE_INTEGER UserTime; //用户模式(Ring 3)的CPU时间；

LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间；

UNICODE_STRING ProcessName; //进程名称；

KPRIORITY BasePriority; //进程优先权；

ULONG ProcessId; //进程标识符；

ULONG InheritedFromProcessId; //父进程的标识符；

ULONG HandleCount; //句柄数目；

ULONG Reserved2[2];

VM_COUNTERS VmCounters; //虚拟存储器的结构，见下；

IO_COUNTERS IoCounters; //IO计数结构，见下；

SYSTEM_THREADS Threads[1]; //进程相关线程的结构数组，见下；

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

typedef struct _SYSTEM_THREADS

LARGE_INTEGER KernelTime; //CPU内核模式使用时间；

LARGE_INTEGER UserTime; //CPU用户模式使用时间；

LARGE_INTEGER CreateTime; //线程创建时间；

ULONG WaitTime; //等待时间；

PVOID StartAddress; //线程开始的虚拟地址；

CLIENT_ID ClientId; //线程标识符；

KPRIORITY Priority; //线程优先级；

KPRIORITY BasePriority; //基本优先级；

ULONG ContextSwitchCount; //环境切换数目；

THREAD_STATE State; //当前状态；

KWAIT_REASON WaitReason; //等待原因；

}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _VM_COUNTERS

ULONG PeakVirtualSize; //虚拟存储峰值大小；

ULONG VirtualSize; //虚拟存储大小；

ULONG PageFaultCount; //页故障数目；

ULONG PeakWorkingSetSize; //工作集峰值大小；

ULONG WorkingSetSize; //工作集大小；

ULONG QuotaPeakPagedPoolUsage; //分页池使用配额峰值；

ULONG QuotaPagedPoolUsage; //分页池使用配额；

ULONG QuotaPeakNonPagedPoolUsage; //非分页池使用配额峰值；

ULONG QuotaNonPagedPoolUsage; //非分页池使用配额；

ULONG PagefileUsage; //页文件使用情况；

ULONG PeakPagefileUsage; //页文件使用峰值；

}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS

LARGE_INTEGER ReadOperationCount; //I/O读操作数目；

LARGE_INTEGER WriteOperationCount; //I/O写操作数目；

LARGE_INTEGER OtherOperationCount; //I/O其他操作数目；

LARGE_INTEGER ReadTransferCount; //I/O读数据数目；

LARGE_INTEGER WriteTransferCount; //I/O写数据数目；

LARGE_INTEGER OtherTransferCount; //I/O其他操作数据数目；

}IO_COUNTERS,*PIO_COUNTERS;

以上这些信息应该是比较全面的了，在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式，在Windows2K/XP/2003都支持它们。

现在，我们来看看系统的性能信息，性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70余种系统性能方面的信息，真是太丰富了，请慢慢体会~

typedef struct _SYSTEM_PERFORMANCE_INFORMATION

LARGE_INTEGER IdleTime; //CPU空闲时间；

LARGE_INTEGER ReadTransferCount; //I/O读操作数目；

LARGE_INTEGER WriteTransferCount; //I/O写操作数目；

LARGE_INTEGER OtherTransferCount; //I/O其他操作数目；

ULONG ReadOperationCount; //I/O读数据数目；

ULONG WriteOperationCount; //I/O写数据数目；

ULONG OtherOperationCount; //I/O其他操作数据数目；

ULONG AvailablePages; //可获得的页数目；

ULONG TotalCommittedPages; //总共提交页数目；

ULONG TotalCommitLimit; //已提交页数目；

ULONG PeakCommitment; //页提交峰值；

ULONG PageFaults; //页故障数目；

ULONG WriteCopyFaults; //Copy-On-Write故障数目；

ULONG TransitionFaults; //软页故障数目；

ULONG Reserved1;

ULONG DemandZeroFaults; //需求0故障数；

ULONG PagesRead; //读页数目；

ULONG PageReadIos; //读页I/O操作数；

ULONG PagefilePagesWritten; //已写页文件页数；

ULONG PagefilePageWriteIos; //已写页文件操作数；

ULONG MappedFilePagesWritten; //已写映射文件页数；

ULONG MappedFileWriteIos; //已写映射文件操作数；

ULONG PagedPoolUsage; //分页池使用；

ULONG NonPagedPoolUsage; //非分页池使用；

ULONG PagedPoolAllocs; //分页池分配情况；

ULONG PagedPoolFrees; //分页池释放情况；

ULONG NonPagedPoolAllocs; //非分页池分配情况；

ULONG NonPagedPoolFress; //非分页池释放情况；

ULONG TotalFreeSystemPtes; //系统页表项释放总数；

ULONG SystemCodePage; //操作系统代码页数；

ULONG TotalSystemDriverPages; //可分页驱动程序页数；

ULONG TotalSystemCodePages; //操作系统代码页总数；

ULONG SmallNonPagedLookasideListAllocateHits; //

ULONG SmallPagedLookasideListAllocateHits;

ULONG Reserved3;

ULONG MmSystemCachePage; //系统缓存页数；

ULONG PagedPoolPage; //分页池页数；

ULONG SystemDriverPage; //可分页驱动页数；

ULONG FastReadNoWait; //异步快速读数目；

ULONG FastReadWait; //同步快速读数目；

ULONG FastReadResourceMiss; //快速读资源冲突数；

ULONG FastReadNotPossible; //快速读失败数；

ULONG FastMdlReadNoWait; //异步MDL快速读数目；

ULONG FastMdlReadWait; //同步MDL快速读数目；

ULONG FastMdlReadResourceMiss; //MDL读资源冲突数；

ULONG FastMdlReadNotPossible; //MDL读失败数；

ULONG MapDataNoWait; //异步映射数据次数；

ULONG MapDataWait; //同步映射数据次数；

ULONG MapDataNoWaitMiss; //异步映射数据冲突次数；

ULONG MapDataWaitMiss; //同步映射数据冲突次数；

ULONG PinMappedDataCount; //牵制映射数据数目；

ULONG PinReadNoWait; //牵制异步读数目；

ULONG PinReadWait; //牵制同步读数目；

ULONG PinReadNoWaitMiss; //牵制异步读冲突数目；

ULONG PinReadWaitMiss; //牵制同步读冲突数目；

ULONG CopyReadNoWait; //异步拷贝读次数；

ULONG CopyReadWait; //同步拷贝读次数；

ULONG CopyReadNoWaitMiss; //异步拷贝读故障次数；

ULONG CopyReadWaitMiss; //同步拷贝读故障次数；

ULONG MdlReadNoWait; //异步MDL读次数；

ULONG MdlReadWait; //同步MDL读次数；

ULONG MdlReadNoWaitMiss; //异步MDL读故障次数；

ULONG MdlReadWaitMiss; //同步MDL读故障次数；

ULONG ReadAheadIos; //向前读操作数目；

ULONG LazyWriteIos; //LAZY写操作数目；

ULONG LazyWritePages; //LAZY写页文件数目；

ULONG DataFlushes; //缓存刷新次数；

ULONG DataPages; //缓存刷新页数；

ULONG ContextSwitches; //环境切换数目；

ULONG FirstLevelTbFills; //第一层缓冲区填充次数；

ULONG SecondLevelTbFills; //第二层缓冲区填充次数；

ULONG SystemCall; //系统调用次数；

}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

现在看到的是结构SYSTEM_PROCESSOR_TIMES提供的系统处理器的使用情况，包括各种情况下的使用时间及中断数目：

typedef struct __SYSTEM_PROCESSOR_TIMES

LARGE_INTEGER IdleTime; //空闲时间；

LARGE_INTEGER KernelTime; //内核模式时间；

LARGE_INTEGER UserTime; //用户模式时间；

LARGE_INTEGER DpcTime; //延迟过程调用时间；

LARGE_INTEGER InterruptTime; //中断时间；

ULONG InterruptCount; //中断次数；

}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

页文件的使用情况，SYSTEM_PAGEFILE_INFORMATION提供了所需的相关信息：

typedef struct _SYSTEM_PAGEFILE_INFORMATION

ULONG NetxEntryOffset; //下一个结构的偏移量；

ULONG CurrentSize; //当前页文件大小；

ULONG TotalUsed; //当前使用的页文件数；

ULONG PeakUsed; //当前使用的页文件峰值数；

UNICODE_STRING FileName; //页文件的文件名称；

}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

系统高速缓存的使用情况参见结构SYSTEM_CACHE_INFORMATION提供的信息：

typedef struct _SYSTEM_CACHE_INFORMATION

ULONG SystemCacheWsSize; //高速缓存大小；

ULONG SystemCacheWsPeakSize; //高速缓存峰值大小；

ULONG SystemCacheWsFaults; //高速缓存页故障数目；

ULONG SystemCacheWsMinimum; //高速缓存最小页大小；

ULONG SystemCacheWsMaximum; //高速缓存最大页大小；

ULONG TransitionSharedPages; //共享页数目；

ULONG TransitionSharedPagesPeak; //共享页峰值数目；

ULONG Reserved[2];

}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

附录：(所有完整源代码，您可以到我们FZ5FZ的主页下载)。

1.T-PMList的头文件源代码：

#ifndef T_PMLIST_H

#define T_PMLIST_H

#include <windows.h>

#include <stdio.h>

#define NT_PROCESSTHREAD_INFO 0x05

#define MAX_INFO_BUF_LEN 0x500000

#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)

#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)

typedef LONG NTSTATUS;

typedef struct _LSA_UNICODE_STRING

{

USHORT Length;

USHORT MaximumLength;

PWSTR Buffer;

}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;

typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

typedef struct _CLIENT_ID

HANDLE UniqueProcess;

HANDLE UniqueThread;

}CLIENT_ID;

typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;

typedef struct _VM_COUNTERS

ULONG PeakVirtualSize;

ULONG VirtualSize;

ULONG PageFaultCount;

ULONG PeakWorkingSetSize;

ULONG WorkingSetSize;

ULONG QuotaPeakPagedPoolUsage;

ULONG QuotaPagedPoolUsage;

ULONG QuotaPeakNonPagedPoolUsage;

ULONG QuotaNonPagedPoolUsage;

ULONG PagefileUsage;

ULONG PeakPagefileUsage;

}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS

LARGE_INTEGER ReadOperationCount;

LARGE_INTEGER WriteOperationCount;

LARGE_INTEGER OtherOperationCount;

LARGE_INTEGER ReadTransferCount;

LARGE_INTEGER WriteTransferCount;

LARGE_INTEGER OtherTransferCount;

}IO_COUNTERS,*PIO_COUNTERS;

typedef enum _THREAD_STATE

StateInitialized,

StateReady,

StateRunning,

StateStandby,

StateTerminated,

StateWait,

StateTransition,

StateUnknown

}THREAD_STATE;

typedef enum _KWAIT_REASON

Executive,

FreePage,

PageIn,

PoolAllocation,

DelayExecution,

Suspended,

UserRequest,

WrExecutive,

WrFreePage,

WrPageIn,

WrPoolAllocation,

WrDelayExecution,

WrSuspended,

WrUserRequest,

WrEventPair,

WrQueue,

WrLpcReceive,

WrLpcReply,

WrVertualMemory,

WrPageOut,

WrRendezvous,

Spare2,

Spare3,

Spare4,

Spare5,

Spare6,

WrKernel

}KWAIT_REASON;

typedef struct _SYSTEM_THREADS

LARGE_INTEGER KernelTime;

LARGE_INTEGER UserTime;

LARGE_INTEGER CreateTime;

ULONG WaitTime;

PVOID StartAddress;

CLIENT_ID ClientId;

KPRIORITY Priority;

KPRIORITY BasePriority;

ULONG ContextSwitchCount;

THREAD_STATE State;

KWAIT_REASON WaitReason;

}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES

ULONG NextEntryDelta;

ULONG ThreadCount;

ULONG Reserved1[6];

LARGE_INTEGER CreateTime;

LARGE_INTEGER UserTime;

LARGE_INTEGER KernelTime;

UNICODE_STRING ProcessName;

KPRIORITY BasePriority;

ULONG ProcessId;

ULONG InheritedFromProcessId;

ULONG HandleCount;

ULONG Reserved2[2];

VM_COUNTERS VmCounters;

IO_COUNTERS IoCounters;

SYSTEM_THREADS Threads[1];

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

typedef DWORD SYSTEM_INFORMATION_CLASS;

typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)

(IN SYSTEM_INFORMATION_CLASS,

IN OUT PVOID,

IN ULONG,

OUT PULONG OPTIONAL);

NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

DWORD EnumProcess()

PSYSTEM_PROCESSES pSystemProc;

HMODULE hNtDll = NULL;

LPVOID lpSystemInfo = NULL;

DWORD dwNumberBytes = MAX_INFO_BUF_LEN;

DWORD dwTotalProcess = 0;

DWORD dwReturnLength;

NTSTATUS Status;

LONGLONG llTempTime;

__try

hNtDll = LoadLibrary("NtDll.dll");

if(hNtDll == NULL)

printf("LoadLibrary Error: %d\n",GetLastError());

__leave;

}

NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"

NtQuerySystemInformation");

if(NtQuerySystemInformation == NULL)

printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetL

astError());

__leave;

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);

Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,

lpSystemInfo,

dwNumberBytes,

&dwReturnLength);

if(Status == STATUS_INFO_LENGTH_MISMATCH)

printf("STATUS_INFO_LENGTH_MISMATCH\n");

__leave;

else if(Status != STATUS_SUCCESS)

printf("NtQuerySystemInformation Error: %d\n",GetLastError());

printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","

Prio.","Thread","Handle","CPU Time");

printf("--------------------------------------------------------------------

------\n");

pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;

while(pSystemProc->NextEntryDelta != 0)

if(pSystemProc->ProcessId != 0)

wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);

else

wprintf(L"%-20s",L"System Idle Process");

printf("%6d",pSystemProc->ProcessId);

printf("%7d",pSystemProc->InheritedFromProcessId);

printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);

printf("%6d",pSystemProc->BasePriority);

printf("%7d",pSystemProc->ThreadCount);

printf("%7d",pSystemProc->HandleCount);

llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.Quad

Part;

llTempTime /= 10000;

printf("%3d:",llTempTime/(60*60*1000));

llTempTime %= 60*60*1000;

printf("%.2d:",llTempTime/(60*1000));

llTempTime %= 60*1000;

printf("%.2d.",llTempTime/1000);

llTempTime %= 1000;

printf("%.3d",llTempTime);

printf("\n");

dwTotalProcess ++;

pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEn

tryDelta);

printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);

printf("PID\t ==> Process Identification\n");

printf("PPID\t ==> Parent Process Identification\n");

printf("WsSize\t ==> Working Set Size\n");

printf("Prio.\t ==> Base Priority\n");

printf("Thread\t ==> Thread Count\n");

printf("Handle\t ==> Handle Count\n");

printf("CPU Time ==> Processor Time\n");

__finally

if(lpSystemInfo != NULL)

free(lpSystemInfo);

if(hNtDll != NULL)

FreeLibrary(hNtDll);

return 0;

DWORD SpeciProcess(DWORD dwPID)

PSYSTEM_PROCESSES pSystemProc = NULL;

PSYSTEM_THREADS pSystemThre = NULL;

ULONG ulIndex;

printf("LoadLibrary Error: %d\n",GetLastError());

__leave;

if(NtQuerySystemInformation == NULL)

__leave;

if(pSystemProc->ProcessId == dwPID)

printf("ProcessName:\t\t ");

wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);

wprintf(L"%-20s\n",L"System Idle Process");

printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);

printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);

printf("KernelTime:\t\t ");

llTempTime = pSystemProc->KernelTime.QuadPart;

printf("%d:",llTempTime/(60*60*1000));

printf("%.3d\t",llTempTime);

printf("UserTime:\t\t");

llTempTime = pSystemProc->UserTime.QuadPart;

printf("%.3d\n",llTempTime);

printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/

(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystem

Proc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);

printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);

printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);

printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount)

;

printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorki

ngSetSize/1024);

printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize

/1024);

printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPaged

PoolUsage/1024);

printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsa

ge/1024);

printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNo

nPagedPoolUsage/1024);

printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPo

olUsage/1024);

printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsa

printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024

);

printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualS

ize/1024);

printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1

024);

printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCoun

t);

printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperation

Count);

printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCo

unt);

printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperati

onCount);

printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCo

printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOpera

tionCount);

printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv",

"User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");

printf("---------------------------------------------------------

----------------------\n");

for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)

pSystemThre = &pSystemProc->Threads[ulIndex];

printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);

printf("%3d",pSystemProc->Threads[ulIndex].Priority);

printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);

printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 10

0)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100

)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;

printf("%2d:",llTempTime/(60*60*1000));

printf("%.2d.",llTempTime/(60*1000));

llTempTime %= 100;

printf("%.2d ",llTempTime);

llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;

printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);

printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);

switch(pSystemProc->Threads[ulIndex].State)

case StateInitialized:

printf("%6s","Init.");

break;

case StateReady:

printf("%6s","Ready");

case StateRunning:

printf("%6s","Run");

case StateStandby:

printf("%6s","StBy.");

case StateTerminated:

printf("%6s","Term.");

case StateWait:

printf("%6s","Wait");

case StateTransition:

printf("%6s","Tran.");

case StateUnknown:

printf("%6s","Unkn.");

default:

switch(pSystemProc->Threads[ulIndex].WaitReason)

case Executive:

printf(" %-8s","Executi.");

case FreePage:

printf(" %-8s","FreePag.");

case PageIn:

printf(" %-8s","PageIn");

case PoolAllocation:

printf(" %-8s","PoolAll.");

case DelayExecution:

printf(" %-8s","DelayEx.");

case Suspended:

printf(" %-8s","Suspend.");

case UserRequest:

printf(" %-8s","UserReq.");

case WrExecutive:

printf(" %-8s","WrExect.");

case WrFreePage:

printf(" %-8s","WrFrePg.");

case WrPageIn:

printf(" %-8s","WrPageIn");

case WrPoolAllocation:

printf(" %-8s","WrPoolA.");

case WrSuspended:

printf(" %-8s","WrSuspe.");

case WrUserRequest:

printf(" %-8s","WrUsReq.");

case WrEventPair:

printf(" %-8s","WrEvent.");

case WrQueue:

printf(" %-8s","WrQueue");

case WrLpcReceive:

printf(" %-8s","WrLpcRv.");

case WrLpcReply:

printf(" %-8s","WrLpcRp.");

case WrVertualMemory:

printf(" %-8s","WrVerMm.");

case WrPageOut:

printf(" %-8s","WrPgOut.");

case WrRendezvous:

printf(" %-8s","WrRende.");

case WrKernel:

printf(" %-8s","WrKernel");

printf(" %-8s","Unknown");

printf("\n");

printf("----------------------------------------------------

---------------------------\n\n");

printf("Total %d Thread(s) !\n\n",ulIndex);

if(dwTotalProcess == 0)

printf("Could not found the %d Process !\n",dwPID);

printf("TID:\t\t====>\tThread Identification\n");

printf("Pri:\t\t====>\tPriority\n");

printf("BPr:\t\t====>\tBase Priority\n");

printf("Priv:\t\t====>\tPrivilege\n");

printf("StartAddr:\t====>\tThread Start Address\n");

printf("CSwitC:\t\t====>\tContext Switch Count\n");

printf("WtReason:\t====>\tWait Reason\n");

VOID Start()

printf("T-PMList, by TOo2y\n");

printf("Date: 05-10-2003\n\n");

return ;

VOID Usage()

printf("Usage:\tT-PMList [-e] | [-s PID]\n");

printf(" -e\t Enumerate All Processes\n");

printf(" -s PID Show Special Process Information with PID\n\n");

#endif

2.T-PMPerf的头文件源代码：

#ifndef T_PMPERF_H

#define T_PMPERF_H

#include "windows.h"

#include "stdio.h"

#define SYSTEM_PERF_INFO 0x02

#define SYSTEM_PROC_TIME 0x08

#define SYSTEM_PAGE_INFO 0x12

#define SYSTEM_CACHE_INFO 0x15

typedef LONG NTSTATUS;

typedef DWORD SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_PERFORMANCE_INFORMATION

LARGE_INTEGER IdleTime;

LARGE_INTEGER ReadTransferCount;

LARGE_INTEGER WriteTransferCount;

LARGE_INTEGER OtherTransferCount;

ULONG ReadOperationCount;

ULONG WriteOperationCount;

ULONG OtherOperationCount;

ULONG AvailablePages;

ULONG TotalCommittedPages;

ULONG TotalCommitLimit;

ULONG PeakCommitment;

ULONG PageFaults;

ULONG WriteCopyFaults;

ULONG TransitionFaults;

ULONG Reserved1;

ULONG DemandZeroFaults;

ULONG PagesRead;

ULONG PageReadIos;

ULONG PagefilePagesWritten;

ULONG PagefilePageWriteIos;

ULONG MappedFilePagesWritten;

ULONG MappedFileWriteIos;

ULONG PagedPoolUsage;

ULONG NonPagedPoolUsage;

ULONG PagedPoolAllocs;

ULONG PagedPoolFrees;

ULONG NonPagedPoolAllocs;

ULONG NonPagedPoolFress;

ULONG TotalFreeSystemPtes;

ULONG SystemCodePage;

ULONG TotalSystemDriverPages;

ULONG TotalSystemCodePages;

ULONG SmallNonPagedLookasideListAllocateHits;

ULONG SmallPagedLookasideListAllocateHits;

ULONG Reserved3;

ULONG MmSystemCachePage;

ULONG PagedPoolPage;

ULONG SystemDriverPage;

ULONG FastReadNoWait;

ULONG FastReadWait;

ULONG FastReadResourceMiss;

ULONG FastReadNotPossible;

ULONG FastMdlReadNoWait;

ULONG FastMdlReadWait;

ULONG FastMdlReadResourceMiss;

ULONG FastMdlReadNotPossible;

ULONG MapDataNoWait;

ULONG MapDataWait;

ULONG MapDataNoWaitMiss;

ULONG MapDataWaitMiss;

ULONG PinMappedDataCount;

ULONG PinReadNoWait;

ULONG PinReadWait;

ULONG PinReadNoWaitMiss;

ULONG PinReadWaitMiss;

ULONG CopyReadNoWait;

ULONG CopyReadWait;

ULONG CopyReadNoWaitMiss;

ULONG CopyReadWaitMiss;

ULONG MdlReadNoWait;

ULONG MdlReadWait;

ULONG MdlReadNoWaitMiss;

ULONG MdlReadWaitMiss;

ULONG ReadAheadIos;

ULONG LazyWriteIos;

ULONG LazyWritePages;

ULONG DataFlushes;

ULONG DataPages;

ULONG ContextSwitches;

ULONG FirstLevelTbFills;

ULONG SecondLevelTbFills;

ULONG SystemCall;

}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

typedef struct __SYSTEM_PROCESSOR_TIMES

LARGE_INTEGER IdleTime;

LARGE_INTEGER DpcTime;

LARGE_INTEGER InterruptTime;

ULONG InterruptCount;

}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

typedef struct _SYSTEM_PAGEFILE_INFORMATION

ULONG NetxEntryOffset;

ULONG CurrentSize;

ULONG TotalUsed;

ULONG PeakUsed;

UNICODE_STRING FileName;

}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

typedef struct _SYSTEM_CACHE_INFORMATION

ULONG SystemCacheWsSize;

ULONG SystemCacheWsPeakSize;

ULONG SystemCacheWsFaults;

ULONG SystemCacheWsMinimum;

ULONG SystemCacheWsMaximum;

ULONG TransitionSharedPages;

ULONG TransitionSharedPagesPeak;

ULONG Reserved[2];

}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)

INT ULONG,

OUT PULONG OPTION);

DWORD PerfInfo()

SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;

HMODULE hNtDll = NULL;

DWORD dwNumberBytes;

DWORD dwReturnLength;

NTSTATUS Status;

LONGLONG llTempTime;

if(hNtDll == NULL)

__leave;

if(NtQuerySystemInformation == NULL)

printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastErr

or());

dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);

Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,

&SystemPerfInfo,

if(Status != STATUS_SUCCESS)

printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError(

));

printf("IdleTime:\t\t");

llTempTime = SystemPerfInfo.IdleTime.QuadPart;

printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);

printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);

printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);

printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);

printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);

printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);

printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);

printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);

printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);

printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);

printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);

printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);

printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);

printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);

printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);

printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);

printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);

printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);

printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWrit

ten);

printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);

printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);

printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);

printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);

printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);

printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);

printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);

printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);

printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);

printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);

printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages

printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);

printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);

printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);

printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);

printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);

printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);

printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);

printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);

printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossi

ble);

printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss

printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);

printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);

printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);

printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);

printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);

printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);

printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);

printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);

printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);

printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);

printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);

printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);

printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);

printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);

printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);

printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);

printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);

printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);

printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);

printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);

printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);

printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);

printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);

printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);

printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);

printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);

printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);

printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPage

dLookasideListAllocateHits);

printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallN

onPagedLookasideListAllocateHits);

FreeLibrary(hNtDll);

DWORD ProcTime()

SYSTEM_PROCESSOR_TIMES SystemProcTime;

HMODULE hNtDll = NULL;

DWORD dwNumberBytes;

DWORD dwReturnLength;

NTSTATUS Status;

LONGLONG llTempTime;

printf("LoadLibrary Error: %d\n",GetLastError());

dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);

printf("GetProcAddress Error: %d\n",GetLastError());

Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,

&SystemProcTime,

printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastErr

llTempTime = SystemProcTime.IdleTime.QuadPart;

printf("KernelTime:\t\t");

llTempTime = SystemProcTime.KernelTime.QuadPart;

llTempTime = SystemProcTime.UserTime.QuadPart;

printf("DpcTime:\t\t");

llTempTime = SystemProcTime.DpcTime.QuadPart;

printf("InterruptTime:\t\t");

llTempTime = SystemProcTime.InterruptTime.QuadPart;

printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);

DWORD PagefileInfo()

PSYSTEM_PAGEFILE_INFORMATION pSystemPagefileInfo;

PVOID pBuffer;

HMODULE hNtDll = NULL;

DWORD dwNumberBytes;

DWORD dwReturnLength;

NTSTATUS Status;

dwNumberBytes = MAX_INFO_BUF_LEN;

pBuffer = (LPVOID)malloc(dwNumberBytes);

Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO,

pBuffer,

dwNumberBytes,

&dwReturnLength);

printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;

printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);

printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);

printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);

wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSys

temPagefileInfo->NetxEntryOffset);

}while(pSystemPagefileInfo->NetxEntryOffset != 0);

if(pBuffer != NULL)

free(pBuffer);

}

if(hNtDll != NULL)

DWORD CacheInfo()

SYSTEM_CACHE_INFORMATION SystemCacheInfo;

HMODULE hNtDll = NULL;

DWORD dwNumberBytes;

DWORD dwReturnLength;

NTSTATUS Status;

__try

hNtDll = LoadLibrary("NtDll.dll");

if(hNtDll == NULL)

{

printf("LoadLibrary Error: %d\n",GetLastError());

__leave;

}

NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");

if(NtQuerySystemInformation == NULL)

printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());

dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);

Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO,

&SystemCacheInfo,dwNumberBytes,&dwReturnLength);

if(Status != STATUS_SUCCESS)

printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError());

printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize1024);

printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);

printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);

printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);

printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);

printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);

printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);

}__finally

if(hNtDll != NULL)

FreeLibrary(hNtDll);

}

return 0;

printf("T-PMPerf, by TOo2y\n");

printf("Date: 05-09-2003\n\n");

return ;

printf("Usage:\tT-PMPerf <Option>\n");

printf("Option:\n");

printf(" -Perf System Performance Information\n");

printf(" -Proc System Processor Information\n");

printf(" -Page System Pagefile Information\n");

printf(" -Cache System Cache Information\n");

本文转自einyboy博客园博客，原文链接：http://www.cnblogs.com/einyboy/archive/2012/06/13/2548243.html

NtQuerySystemInformation的使用

继续阅读

Linux(Centos7版本中安装mysql5.7 遇到的各种问题，最后由于Centos7安装mysql5.7需要收费，安装了 mariadb 数据库）

InnoDB & index页-mysql详解（二）

Redis 的回收进程如何工作的？

【HTTP】711- 图解 HTTP 缓存

MyBatis一级缓存中增删改要提交事务，查的话就不用

Redis：Creating Server TCP listening socket 127.0.0.1:6379: bind: No error

SpringBoot交友APP项目实战（详细介绍+案例源码） - 9.小视频（SpringCache缓存）系列文章目录一、访客功能二、分布式存储FastDFS三、视频功能四、通用缓存SpringCache

redis延迟双删的策略

自定义SDWebImage图片缓冲区自清理机制

分布式缓存的基本原理

redis主从复制读写分离总结

redis的选择和定位redis的选择和定位

Redis单线程模型和IO多路复用

vue-loader-v16/package.json报错

ZooKeeper ： Curator框架之数据缓存与监听CuratorCache

K-近邻算法以及图像分类应用