#include <wfc.h>
#pragma hdrstop
/*
** Author: Samuel R. Blackburn
** Internet: wfc@pobox.com
**
** You can use it any way you like as long as you don't try to sell it.
**
** Any attempt to sell WFC in source code form must have the permission
** of the original author. You can produce commercial executables with
** WFC but you can't sell WFC.
**
** Copyright, 2000, Samuel R. Blackburn
**
** $Workfile: wfc_undocumented_get_system_process_list.cpp $
** $Revision: 1 $
** $Modtime: 1/17/00 9:36a $
** $Reuse Tracing Code: 1 $
*/
#if defined( _DEBUG ) && ! defined( WFC_STL )
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#define new DEBUG_NEW
#endif // _DEBUG
BOOL PASCAL wfc_undocumented_get_system_process_list( BYTE * buffer, DWORD size_of_buffer )
{
WFCLTRACEINIT( TEXT( "wfc_undocumented_get_system_process_list()" ) );
DWORD (__stdcall *NtQuerySystemInformation)( DWORD, VOID *, DWORD, DWORD * );
NtQuerySystemInformation = ( DWORD (__stdcall *)( DWORD, VOID *, DWORD, DWORD *) )
GetProcAddress( GetModuleHandle( TEXT( "ntdll.dll" ) ),
"NtQuerySystemInformation" );
if ( NtQuerySystemInformation == NULL )
{
return( 0 );
}
if ( NtQuerySystemInformation( 5, buffer, size_of_buffer, 0 ) != 0 )
{
return( 0 );
}
return( TRUE );
}
// End of source
#if 0
<HTML>
<HEAD>
<TITLE>WFC - wfc_undocumented_get_system_process_list</TITLE>
<META name="keywords" content="WFC, MFC extension library, freeware class library, Win32, source code">
<META name="description" content="Simple C that uses an undocumented NT function (NtQuerySystemInformation) to get a list of active processes on an NT system.">
</HEAD>
<BODY>
<H1>wfc_undocumented_get_system_process_list</H1>
$Revision: 1 $<HR>
<H2>Declaration</H2>
<PRE>DWORD <B>wfc_undocumented_get_system_process_list</B>( BYTE * buffer, DWORD size_of_buffer )</PRE>
<H2>Description</H2>
This function allows you to get a whole bunch of information about the
currently running processes.
<P>
<B>WARNING</B> It uses an undocumented call and may no longer be supported.
<H2>Example</H2>
<PRE><CODE>#include <wfc.h>
void print_system_record( WFC_SYSTEM_PROCESS_INFORMATION * process_p )
{
<A HREF="WfcTrace.htm">WFCTRACEINIT</A>( TEXT( "print_system_record()" ) );
_tprintf( TEXT( "Thread Count = %lu\n", process_p->ThreadCount );
_tprintf( TEXT( "CreateTime = %I64u\n", process_p->CreateTime );
_tprintf( TEXT( "UserTime = %I64u\n", process_p->UsetTime );
_tprintf( TEXT( "KernelTime = %I64u\n", process_p->KernelTime );
_tprintf( TEXT( "Name = %S\n", process_p->Name.Buffer );
_tprintf( TEXT( "BasePriority = %lu\n", process_p->BasePriority );
_tprintf( TEXT( "UniqueProcessID = %lu\n", process_p->UniqueProcessID );
_tprintf( TEXT( "InheritedFrom = %lu\n", process_p->InheritedFromUniqueProcessID );
_tprintf( TEXT( "HandleCount = %lu\n", process_p->HandleCount );
_tprintf( TEXT( "VmCounters =\n{\n" );
print_vm_counters( &process_p->VmCounters );
_tprintf( TEXT) "}\n" );
_tprintf( TEXT( "CommitCharge = %lu\n", process_p->CommitCharge );
DWORD loop_index = 0;
while( loop_index < process_p->ThreadCount )
{
_tprintf( TEXT( "Thread %lu\n{\n", loop_index );
print_system_thread( &process_p->Threads[ loop_index ] );
_tprintf( TEXT( "}\n" );
loop_index++;
}
}
int _tmain( int, LPCTSTR[] )
{
<A HREF="WfcTrace.htm">WFCTRACEINIT</A>( TEXT( "_tmain()" ) );
DWORD size_of_buffer = 128 * 1024;
BYTE * buffer = (BYTE *) malloc( size_of_buffer );
if ( <B>wfc_undocumented_get_system_process_list</B>( buffer, size_of_buffer ) == FALSE )
{
_tprintf( TEXT( "Can't get process information.\n" );
free( buffer );
return( EXIT_FAILURE );
}
WFC_SYSTEM_PROCESS_INFORMATION * info_p = (WFC_SYSTEM_PROCESS_INFORMATION *) buffer );
while( info_p->Next != 0 )
{
print_system_record( info_p );
info_p = (WFC_SYSTEM_PROCESS_INFORMATION *) ( (DWORD) info_p + info_p->Next );
}
free( buffer );
return( EXIT_SUCCESS );
}</CODE></PRE>
<H2>API's Used</H2>
<B>wfc_undocumented_get_system_process_list</B>() uses the following
<B>undocumented</B> API's:
<UL>
<LI>NtQuerySystemInformation
</UL>
<HR><I>Copyright, 2000, <A HREF="mailto:wfc@pobox.com">Samuel R. Blackburn</A></I><BR>
$Workfile: wfc_undocumented_get_system_process_list.cpp $<BR>
$Modtime: 1/17/00 9:36a $
</BODY>
</HTML>
#endif