NtQuerySystemInformation API Works on 32bit but not on 64bits?

Question

5.00/5 (2 votes)

See more:

im using the API NtQuerySystemInformation to retrieve SystemHandleInformation.
So far, its working perfectly when i run the code in a 32bit OS, but when i run the code in a 64bit OS i eget invalid data in the destination pointer

VB

Public Declare Auto Function NtQuerySystemInformation Lib "ntdll.dll" (ByVal SystemInformationClass As Integer, ByVal SystemInformation As IntPtr, ByVal SystemInformationLength As Integer, ByRef returnLength As Integer) As UInteger

'Initial Length and buffer
Dim retLength As Integer = 512
Dim lpBufferHandles As IntPtr
'Handle Pointer
Dim Handle As New SYSTEM_HANDLE_INFORMATION()

'Allocate initial 512 bytes and call...
lpBufferHandles = Marshal.AllocHGlobal(retLength)
NtQuerySystemInformation(SystemHandleInformation, lpBufferHandles, retLength, retLength)

'Free buffer and resize, then call function again.
Marshal.FreeHGlobal(lpBufferHandles)
lpBufferHandles = Marshal.AllocHGlobal(retLength)
NtQuerySystemInformation(SystemHandleInformation, lpBufferHandles, retLength, retLength

Dim totalHandles as integer = Marshal.ReadInt32(lpBufferHandles)

For X As Integer = 0 To m_totalHandles - 1
  Handle = DirectCast(Marshal.PtrToStructure(New IntPtr(lpBufferHandles.ToInt32 + 4 + (16 * X)), Handle.[GetType]()), SYSTEM_HANDLE_INFORMATION)
  Debug.WriteLine("Found handle type {0} for PID {1}.", Handle.ObjectTypeNumber, Handle.ProcessID)
Next

and here is the SYSTEM_HANDLE_INFORMATION structure

VB

<StructLayout(LayoutKind.Sequential)> Structure SYSTEM_HANDLE_INFORMATION
  Public ProcessID As Integer
  Public ObjectTypeNumber As Byte
  Public Flags As Byte
  Public Handle As UShort
  Public Object_Pointer As Integer
  Public GrantedAccess As Integer
End Structure

Im currently running Windows 7 64 bit, so what i usually do is set CPU to AnyCPU, regardless of this, when i compile this piece of code for x86 it runs correctly and returns correct data, but when i compile it for x64 it returns all sort of invalid details (wrong data).

So far i wasn't able to understand what is wrong, could anyone help me?
As an added information, if i query the struct size of "Handle" they are the same, in both cases, but the buffersize, in this case lpBufferHandles is very different, around 37k in x86 and 58k in x64 ... so, it looks like its returning details is some other structure or so?

Posted 25-Jan-11 21:04pm

creizlein

Add a Solution

Comments

Sandeep Mewara 26-Jan-11 3:56am

Nicely formed Q!

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

creizlein · Accepted Answer · 2011-01-25T23:33:00

Well, im gonna answer myself, as this might not be the "perfect" solution, it seems to be working both on 32 and 64 bits.

VB

Public Function GetAllHandles(Optional ByVal PID As Integer = 0) As List(Of HandleInfo)
  Dim nCurrentLength As Integer = 0
  Dim nHandleInfoSize As Integer = &H10000
  Dim lpHandle As IntPtr = IntPtr.Zero
  Dim lpBufferHandles As IntPtr = Marshal.AllocHGlobal(nHandleInfoSize)

  While NtQuerySystemInformation(SystemHandleInformation, lpBufferHandles, nHandleInfoSize, nCurrentLength) = STATUS_INFO_LENGTH_MISMATCH
    nHandleInfoSize = nCurrentLength
    Marshal.FreeHGlobal(lpBufferHandles)
    lpBufferHandles = Marshal.AllocHGlobal(nCurrentLength)
  End While

  Dim lHandleCount As Long = 0
  If Is64Bits() Then
    lHandleCount = Marshal.ReadInt64(lpBufferHandles)
    lpHandle = New IntPtr(lpBufferHandles.ToInt64() + 8)
  Else
    lHandleCount = Marshal.ReadInt32(lpBufferHandles)
    lpHandle = New IntPtr(lpBufferHandles.ToInt32() + 4)
  End If

  Dim shHandle As SYSTEM_HANDLE_INFORMATION
  Dim HandlesInfos As New List(Of HandleInfo)

  For lIndex As Long = 0 To lHandleCount - 1
    shHandle = New SYSTEM_HANDLE_INFORMATION()
    If Is64Bits() Then
      lpHandle = New IntPtr(lpHandle.ToInt64() + Marshal.SizeOf(shHandle) + 8)
      shHandle = DirectCast(Marshal.PtrToStructure(lpHandle, shHandle.[GetType]()), SYSTEM_HANDLE_INFORMATION)
    Else
      lpHandle = New IntPtr(lpHandle.ToInt32() + Marshal.SizeOf(shHandle))
      shHandle = DirectCast(Marshal.PtrToStructure(lpHandle, shHandle.[GetType]()), SYSTEM_HANDLE_INFORMATION)
    End If
    If PID = 0 OrElse PID = shHandle.ProcessID Then
      HandlesInfos.Add(RetrieveObject(shHandle))
    End If
  Next

  CloseProcessForHandle()
  Marshal.FreeHGlobal(lpBufferHandles)
  Return HandlesInfos
End Function

As you can notice in the above code, it uses a is64Bits function, which act as a flag and then move the pointers according, as it seems that the IntPtr has not the same size, in 32bits its 4 bytes and in 64bits its 8 bytes long.

Hope this does help other uses as well.

NtQuerySystemInformation API Works on 32bit but not on 64bits?

1 solution

Solution 1

Add your solution here

Preview 0

NtQuerySystemInformation API Works on 32bit but not on 64bits?

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us