微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦！

探测Windows2K/XP/2003本机系统信息

分类：Python作者：whatday原文地址AI导航网

Native API乃Windows用户模式中为上层Win32 API提供接口的本机系统服务。平常我们总是调用MS为我们提供的公用的Win32 API函数来实现来实现我们系统的功能。（PS：前不久，偶写了一个Windows任务管理器，支持对桌面，进程/线程，系统性能，磁盘，环境变量，事件日志，网络，设备驱动，Win32服务，共享，用户，系统及关机等信息的探测和控制，完全基于Win32 API，大家可以到我们的主页下载）。今天我们要谈的是如何通过本机系统服务(Native API）来探测本机系统信息。当然，微软没有为我们提供关于本机系统服务的文档(Undocumented)，也就是不会为对它的使用提供任何的保证，所以我们不提倡使用Native API来开发软件。不过在特殊情况下，本机系统服务却为我们提供了通向“秘密”的捷径。本文提到的信息仅在Windows2000/XP/2003上测试过。

今天，我们主要讨论的是一个函数NtQuerySysteminformation(ZwQuerySysteminformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包括对某些信息的控制和设置。以下是这个函数的原型：

typedef NTSTATUS (__stdcall *NTQUERYSYsteminformatION)
                 (IN      SYstem_informatION_CLASS SysteminformationClass,IN OUT  PVOID                    Systeminformation,IN      ULONG                    SysteminformationLength,OUT     PULONG                   ReturnLength  OPTIONAL);
NTQUERYSYsteminformatION NtQuerySysteminformation;

从中可以看到，SysteminformationClass是一个类型信息，它大概提供了50余种信息，也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。Systeminformation是一个LPVOID型的指针，它为我们提供需要获得的信息，或是我们需要设置的系统信息。SysteminformationLength是Systeminformation的长度，它根据探测的信息类型来决定。至于ReturnLength则是系统返回的需要的长度，通常可以设置为空指针(NULL)。

首先，我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了，所以我就不在老生常谈了，呵呵。那么就提出这个结构类型的定义：

typedef struct _SYstem_PROCESSES
{
	ULONG          NextEntryDelta;          //构成结构序列的偏移量；
	ULONG          ThreadCount;             //线程数目；
	ULONG          Reserved1[6];           
	LARGE_INTEGER  CreateTime;              //创建时间；
	LARGE_INTEGER  UserTime;                //用户模式(Ring 3)的cpu时间；
	LARGE_INTEGER  KernelTime;              //内核模式(Ring 0)的cpu时间；
	UNICODE_STRING ProcessName;             //进程名称；
	KPRIORITY      BasePriority;            //进程优先权；
	ULONG          ProcessId;               //进程标识符；
	ULONG          InheritedFromProcessId;  //父进程的标识符；
	ULONG          HandleCount;             //句柄数目；
	ULONG          Reserved2[2];
	VM_COUNTERS    VmCounters;              //虚拟存储器的结构，见下；
	IO_COUNTERS    IoCounters;              //IO计数结构，见下；
	SYstem_THREADS Threads[1];              //进程相关线程的结构数组，见下；
}SYstem_PROCESSES,*PSYstem_PROCESSES;


typedef struct _SYstem_THREADS
{
	LARGE_INTEGER KernelTime;               //cpu内核模式使用时间；
	LARGE_INTEGER UserTime;                 //cpu用户模式使用时间；
	LARGE_INTEGER CreateTime;               //线程创建时间；
	ULONG         WaitTime;                 //等待时间；
	PVOID         StartAddress;             //线程开始的虚拟地址；
	CLIENT_ID     ClientId;                 //线程标识符；
	KPRIORITY     Priority;                 //线程优先级；
	KPRIORITY     BasePriority;             //基本优先级；
	ULONG         ContextSwitchCount;       //环境切换数目；
	THREAD_STATE  State;                    //当前状态；
	KWAIT_REASON  WaitReason;               //等待原因；
}SYstem_THREADS,*PSYstem_THREADS;


typedef struct _VM_COUNTERS
{
	ULONG PeakVirtualSize;                  //虚拟存储峰值大小；
	ULONG VirtualSize;                      //虚拟存储大小；
	ULONG PageFaultCount;                   //页故障数目；
	ULONG PeakWorkingSetSize;               //工作集峰值大小；
	ULONG WorkingSetSize;                   //工作集大小；
	ULONG QuotaPeakPagedPoolUsage;          //分页池使用配额峰值；
	ULONG QuotaPagedPoolUsage;              //分页池使用配额；
	ULONG QuotaPeakNonPagedPoolUsage;       //非分页池使用配额峰值；
	ULONG QuotaNonPagedPoolUsage;           //非分页池使用配额；
	ULONG PagefileUsage;                    //页文件使用情况；
	ULONG PeakPagefileUsage;                //页文件使用峰值；
}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS
{
	LARGE_INTEGER ReadOperationCount;       //I/O读操作数目；
	LARGE_INTEGER WriteOperationCount;      //I/O写操作数目；
	LARGE_INTEGER OtherOperationCount;      //I/O其他操作数目；
	LARGE_INTEGER ReadTransferCount;        //I/O读数据数目；
	LARGE_INTEGER WriteTransferCount;       //I/O写数据数目；
	LARGE_INTEGER OtherTransferCount;       //I/O其他操作数据数目；
}IO_COUNTERS,*PIO_COUNTERS;

以上这些信息应该是比较全面的了，在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式，在Windows2K/XP/2003都支持它们。

现在，我们来看看系统的性能信息，性能结构SYstem_PERFORMANCE_informatION为我们提供了70余种系统性能方面的信息，真是太丰富了，请慢慢体会~

typedef struct _SYstem_PERFORMANCE_informatION
{
	LARGE_INTEGER  IdleTime;                    //cpu空闲时间；
	LARGE_INTEGER  ReadTransferCount;           //I/O读操作数目；
	LARGE_INTEGER  WriteTransferCount;          //I/O写操作数目；
	LARGE_INTEGER  OtherTransferCount;          //I/O其他操作数目；
	ULONG          ReadOperationCount;          //I/O读数据数目；
	ULONG          WriteOperationCount;         //I/O写数据数目；
	ULONG          OtherOperationCount;         //I/O其他操作数据数目；
	ULONG          AvailablePages;              //可获得的页数目；
	ULONG          TotalCommittedPages;         //总共提交页数目；
	ULONG          TotalCommitLimit;            //已提交页数目；
	ULONG          PeakCommitment;              //页提交峰值；
	ULONG          PageFaults;                  //页故障数目；
	ULONG          WritecopyFaults;             //copy-On-Write故障数目；
	ULONG          TransitionFaults;            //软页故障数目；
	ULONG          Reserved1;
	ULONG          DemandZeroFaults;            //需求0故障数；
	ULONG          PagesRead;                   //读页数目；
	ULONG          PageReadios;                 //读页I/O操作数；
	ULONG          Reserved2[2];
	ULONG          PagefilePagesWritten;        //已写页文件页数；
	ULONG          PagefilePageWriteIos;        //已写页文件操作数；
	ULONG          MappedFilePagesWritten;      //已写映射文件页数；
	ULONG          MappedFileWriteIos;          //已写映射文件操作数；
	ULONG          PagedPoolUsage;              //分页池使用；
	ULONG          NonPagedPoolUsage;           //非分页池使用；
	ULONG          PagedPoolAllocs;             //分页池分配情况；
	ULONG          PagedPoolFrees;              //分页池释放情况；
	ULONG          NonPagedPoolAllocs;          //非分页池分配情况；
	ULONG          NonPagedPoolFress;           //非分页池释放情况；
	ULONG          TotalFreeSystemPtes;         //系统页表项释放总数；
	ULONG          SystemCodePage;              //操作系统代码页数；
	ULONG          TotalSystemDriverPages;      //可分页驱动程序页数；
	ULONG          TotalSystemCodePages;        //操作系统代码页总数；
	ULONG          SmallNonPagedLookasideListAllocateHits; //小非分页侧视列表分配次数；
	ULONG          SmallPagedLookasideListAllocateHits;    //小分页侧视列表分配次数；
	ULONG          Reserved3;                   
	ULONG          MmSystemCachePage;          //系统缓存页数；
	ULONG          PagedPoolPage;              //分页池页数；
	ULONG          SystemDriverPage;           //可分页驱动页数；
	ULONG          FastReadNowait;             //异步快速读数目；
	ULONG          FastReadWait;               //同步快速读数目；
	ULONG          FastReadResourceMiss;       //快速读资源冲突数；
	ULONG          FastReadNotPossible;        //快速读失败数；
	ULONG          FastMdlReadNowait;          //异步MDL快速读数目；
	ULONG          FastMdlReadWait;            //同步MDL快速读数目；
	ULONG          FastMdlReadResourceMiss;    //MDL读资源冲突数；
	ULONG          FastMdlReadNotPossible;     //MDL读失败数；
	ULONG          MapDatanoWait;              //异步映射数据次数；
	ULONG          MapDataWait;                //同步映射数据次数；
	ULONG          MapDatanoWaitMiss;          //异步映射数据冲突次数；
	ULONG          MapDataWaitMiss;            //同步映射数据冲突次数；
	ULONG          PinMappedDataCount;         //牵制映射数据数目；
	ULONG          PinReadNowait;              //牵制异步读数目；
	ULONG          PinReadWait;                //牵制同步读数目；
	ULONG          PinReadNowaitMiss;          //牵制异步读冲突数目；
	ULONG          PinReadWaitMiss;            //牵制同步读冲突数目；
	ULONG          copyReadNowait;             //异步拷贝读次数；
	ULONG          copyReadWait;               //同步拷贝读次数；
	ULONG          copyReadNowaitMiss;         //异步拷贝读故障次数；
	ULONG          copyReadWaitMiss;           //同步拷贝读故障次数；
	ULONG          MdlReadNowait;              //异步MDL读次数；
	ULONG          MdlReadWait;                //同步MDL读次数；
	ULONG          MdlReadNowaitMiss;          //异步MDL读故障次数；

	ULONG          MdlReadWaitMiss;            //同步MDL读故障次数；
	ULONG          ReadAheadios;               //向前读操作数目；
	ULONG          LazyWriteIos;               //LAZY写操作数目；
	ULONG          LazyWritePages;             //LAZY写页文件数目；
	ULONG          DataFlushes;                //缓存刷新次数；
	ULONG          DataPages;                  //缓存刷新页数；
	ULONG          ContextSwitches;            //环境切换数目；
	ULONG          FirstLevelTbFills;          //第一层缓冲区填充次数；
	ULONG          SecondLevelTbFills;         //第二层缓冲区填充次数；
	ULONG          SystemCall;                 //系统调用次数；
}SYstem_PERFORMANCE_informatION,*PSYstem_PERFORMANCE_informatION;

现在看到的是结构SYstem_PROCESSOR_TIMES提供的系统处理器的使用情况，包括各种情况下的使用时间及中断数目：

typedef struct __SYstem_PROCESSOR_TIMES
{
	LARGE_INTEGER IdleTime;               //空闲时间；
	LARGE_INTEGER KernelTime;             //内核模式时间；
	LARGE_INTEGER UserTime;               //用户模式时间；
	LARGE_INTEGER DpcTime;                //延迟过程调用时间；
	LARGE_INTEGER InterruptTime;          //中断时间；
	ULONG         InterruptCount;         //中断次数；
}SYstem_PROCESSOR_TIMES,*PSYstem_PROCESSOR_TIMES;

页文件的使用情况，SYstem_PAGEFILE_informatION提供了所需的相关信息：

typedef struct _SYstem_PAGEFILE_informatION
{
	ULONG NetxEntryOffset;                //下一个结构的偏移量；
	ULONG CurrentSize;                    //当前页文件大小；
	ULONG TotalUsed;                      //当前使用的页文件数；
	ULONG PeakUsed;                       //当前使用的页文件峰值数；
	UNICODE_STRING FileName;              //页文件的文件名称；
}SYstem_PAGEFILE_informatION,*PSYstem_PAGEFILE_informatION;

系统高速缓存的使用情况参见结构SYstem_CACHE_informatION提供的信息：

typedef struct _SYstem_CACHE_informatION
{
	ULONG SystemCacheWsSize;              //高速缓存大小；
	ULONG SystemCacheWsPeakSize;          //高速缓存峰值大小；
	ULONG SystemCacheWsFaults;            //高速缓存页故障数目；
	ULONG SystemCacheWsMinimum;           //高速缓存最小页大小；
	ULONG SystemCacheWsMaximum;           //高速缓存最大页大小；
	ULONG TransitionSharedPages;          //共享页数目；
	ULONG TransitionSharedPagesPeak;      //共享页峰值数目；
	ULONG Reserved[2];
}SYstem_CACHE_informatION,*PSYstem_CACHE_informatION;

1.T-PMList的头文件源代码：

#ifndef T_PMLIST_H
#define T_PMLIST_H

#include <windows.h>
#include <stdio.h>

#define NT_PROCEsstHREAD_INFO        0x05
#define MAX_INFO_BUF_LEN             0x500000
#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH  ((NTSTATUS)0xC0000004L)

typedef LONG NTSTATUS;

typedef struct _LSA_UNICODE_STRING
{
	USHORT  Length;
	USHORT  MaximumLength;
	PWSTR   Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING,*PUNICODE_STRING;

typedef struct _CLIENT_ID
{
	HANDLE UniqueProcess;
	HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;

typedef struct _VM_COUNTERS
{
	ULONG PeakVirtualSize;
	ULONG VirtualSize;
	ULONG PageFaultCount;
	ULONG PeakWorkingSetSize;
	ULONG WorkingSetSize;
	ULONG QuotaPeakPagedPoolUsage;
	ULONG QuotaPagedPoolUsage;
	ULONG QuotaPeakNonPagedPoolUsage;
	ULONG QuotaNonPagedPoolUsage;
	ULONG PagefileUsage;
	ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS
{
	LARGE_INTEGER ReadOperationCount;
	LARGE_INTEGER WriteOperationCount;
	LARGE_INTEGER OtherOperationCount;
	LARGE_INTEGER ReadTransferCount;
	LARGE_INTEGER WriteTransferCount;
	LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;

typedef enum _THREAD_STATE
{
	StateInitialized,StateReady,StateRunning,StateStandby,StateTerminated,StateWait,StateTransition,StateUnkNown
}THREAD_STATE;

typedef enum _KWAIT_REASON
{
	Executive,FreePage,PageIn,PoolAllocation,DelayExecution,Suspended,UserRequest,WrExecutive,WrFreePage,WrPageIn,WrPoolAllocation,WrDelayExecution,WrSuspended,WrUserRequest,WrEventPair,WrQueue,WrLpcReceive,WrLpcReply,WrVertualMemory,WrPageOut,WrRendezvous,Spare2,Spare3,Spare4,Spare5,Spare6,WrKernel
}KWAIT_REASON;

typedef struct _SYstem_THREADS
{
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG         WaitTime;
	PVOID         StartAddress;
	CLIENT_ID     ClientId;
	KPRIORITY     Priority;
	KPRIORITY     BasePriority;
	ULONG         ContextSwitchCount;
	THREAD_STATE  State;
	KWAIT_REASON  WaitReason;
}SYstem_THREADS,*PSYstem_THREADS;

typedef struct _SYstem_PROCESSES
{
	ULONG          NextEntryDelta;
	ULONG          ThreadCount;
	ULONG          Reserved1[6];
	LARGE_INTEGER  CreateTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  KernelTime;
	UNICODE_STRING ProcessName;
	KPRIORITY      BasePriority;
	ULONG          ProcessId;
	ULONG          InheritedFromProcessId;
	ULONG          HandleCount;
	ULONG          Reserved2[2];
	VM_COUNTERS    VmCounters;
	IO_COUNTERS    IoCounters;
	SYstem_THREADS Threads[1];
}SYstem_PROCESSES,*PSYstem_PROCESSES;

typedef DWORD    SYstem_informatION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYsteminformatION)
                 (IN     SYstem_informatION_CLASS,IN OUT PVOID,IN     ULONG,OUT    PULONG OPTIONAL);
NTQUERYSYsteminformatION NtQuerySysteminformation;

DWORD EnumProcess()
{
       PSYstem_PROCESSES  pSystemProc;
	HMODULE            hNtDll         = NULL;
	LPVOID             lpSystemInfo   = NULL;
	DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
	DWORD              dwTotalProcess = 0;
	DWORD              dwReturnLength;
	NTSTATUS           Status; 
	LONGLONG           llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
           	if(hNtDll == NULL)
		{
            		printf("LoadLibrary Error: %d\n",GetLastError());
       		__leave;
		}

		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,"NtQuerySysteminformation");
          	if(NtQuerySysteminformation == NULL)
		{
       		printf("GetProcAddress for NtQuerySysteminformation Error: %d\n",GetLastError());
        		__leave;
		}

		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
		Status = NtQuerySysteminformation(NT_PROCEsstHREAD_INFO,lpSystemInfo,dwNumberBytes,&dwReturnLength);
		if(Status == STATUS_INFO_LENGTH_MISMATCH)
		{
			printf("STATUS_INFO_LENGTH_MISMATCH\n");
			__leave;
		}
		else if(Status != STATUS_SUCCESS)
		{
			printf("NtQuerySysteminformation Error: %d\n",GetLastError());
			__leave;
		}

		printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","Prio.","Thread","Handle","cpu Time");
		printf("--------------------------------------------------------------------------\n");
		pSystemProc = (PSYstem_PROCESSES)lpSystemInfo;
		while(pSystemProc->NextEntryDelta != 0)
		{
			if(pSystemProc->ProcessId != 0)
			{
				wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);
			}
			else
			{
				wprintf(L"%-20s",L"System Idle Process");
			}
			printf("%6d",pSystemProc->ProcessId);
			printf("%7d",pSystemProc->InheritedFromProcessId);
			printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);
			printf("%6d",pSystemProc->BasePriority);
			printf("%7d",pSystemProc->ThreadCount);
			printf("%7d",pSystemProc->HandleCount);
			llTempTime  = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart;
			llTempTime /= 10000;
			printf("%3d:",llTempTime/(60*60*1000));
			llTempTime %= 60*60*1000;
			printf("%.2d:",llTempTime/(60*1000));
			llTempTime %= 60*1000;
			printf("%.2d.",llTempTime/1000);
			llTempTime %= 1000;
			printf("%.3d",llTempTime);

			printf("\n");
			dwTotalProcess ++;
			pSystemProc = (PSYstem_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
		}
		printf("--------------------------------------------------------------------------\n");
		printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);
		printf("PID\t ==> Process Identification\n");
		printf("PPID\t ==> Parent Process Identification\n");
		printf("WsSize\t ==> Working Set Size\n");
		printf("Prio.\t ==> Base Priority\n");
		printf("Thread\t ==> Thread Count\n");
		printf("Handle\t ==> Handle Count\n");
		printf("cpu Time ==> Processor Time\n");
	}
	__finally
	{
		if(lpSystemInfo != NULL)
		{
			free(lpSystemInfo);
		}
		if(hNtDll != NULL)
		{
       		FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD SpeciProcess(DWORD dwPID)
{
       PSYstem_PROCESSES  pSystemProc    = NULL;
	PSYstem_THREADS    pSystemThre    = NULL;  
	HMODULE            hNtDll         = NULL;
	LPVOID             lpSystemInfo   = NULL;
	DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
	DWORD              dwTotalProcess = 0;
	DWORD              dwReturnLength;
	NTSTATUS           Status; 
	LONGLONG           llTempTime;
	ULONG              ulIndex;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
           	if(hNtDll == NULL)
		{
           		printf("LoadLibrary Error: %d\n",GetLastError());
      	       	__leave;
		}

		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,"NtQuerySysteminformation");
     	if(NtQuerySysteminformation == NULL)
		{
       		printf("GetProcAddress for NtQuerySysteminformation Error: %d\n",GetLastError());
    	       	__leave;
		}

		lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
		Status = NtQuerySysteminformation(NT_PROCEsstHREAD_INFO,GetLastError());
			__leave;
		}

		pSystemProc = (PSYstem_PROCESSES)lpSystemInfo;
		while(pSystemProc->NextEntryDelta != 0)
		{
			if(pSystemProc->ProcessId == dwPID)
			{
				printf("ProcessName:\t\t ");
				if(pSystemProc->ProcessId != 0)
				{
					wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);
				}
				else
				{
					wprintf(L"%-20s\n",L"System Idle Process");
				}
				printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);
				printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);

				printf("KernelTime:\t\t ");
				llTempTime  = pSystemProc->KernelTime.QuadPart;
				llTempTime /= 10000;
				printf("%d:",llTempTime/(60*60*1000));
				llTempTime %= 60*60*1000;
				printf("%.2d:",llTempTime/(60*1000));
				llTempTime %= 60*1000;
				printf("%.2d.",llTempTime/1000);
				llTempTime %= 1000;
				printf("%.3d\t",llTempTime);

				printf("UserTime:\t\t");
				llTempTime  = pSystemProc->UserTime.QuadPart;
				llTempTime /= 10000;
				printf("%d:",llTempTime/1000);
				llTempTime %= 1000;
				printf("%.3d\n",llTempTime);

				printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
				printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

				printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);
				printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);

				printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);
				printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount);

				printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorkingSetSize/1024);
				printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize/1024);

				printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPagedPoolUsage/1024);
				printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);

				printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage/1024);
				printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);

				printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsage/1024);
				printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);

				printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualSize/1024);
				printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);

				printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCount);
				printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperationCount);

				printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCount);
				printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);

				printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCount);
				printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);

				printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv","User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason");
           		printf("-------------------------------------------------------------------------------\n");

				for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
				{
					pSystemThre = &pSystemProc->Threads[ulIndex];
					printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);

				       printf("%3d",pSystemProc->Threads[ulIndex].Priority);
					printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);

	    			printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
	     			printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

					llTempTime  = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
					llTempTime /= 10000;
					printf("%2d:",llTempTime/(60*60*1000));
					llTempTime %= 60*60*1000;
					printf("%.2d.",llTempTime/(60*1000));
					llTempTime %= 60*1000;
					printf("%.2d.",llTempTime/1000);
					llTempTime %= 100;
					printf("%.2d ",llTempTime);

					llTempTime  = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
					llTempTime /= 10000;
					printf("%2d:",llTempTime);

					printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);
					printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);

					switch(pSystemProc->Threads[ulIndex].State)
					{
					case StateInitialized:
						printf("%6s","Init.");
						break;
					case StateReady:
						printf("%6s","Ready");
						break;
					case StateRunning:
						printf("%6s","Run");
						break;
					case StateStandby:
						printf("%6s","StBy.");
						break;
					case StateTerminated:
						printf("%6s","Term.");
						break;
					case StateWait:
						printf("%6s","Wait");
						break;
					case StateTransition:
						printf("%6s","Tran.");
						break;
					case StateUnkNown:
						printf("%6s","Unkn.");
						break;
					default:
						printf("%6s","Unkn.");
						break;
					}

					switch(pSystemProc->Threads[ulIndex].WaitReason)
					{
					case Executive:
						printf(" %-8s","Executi.");
						break;
					case FreePage:
						printf(" %-8s","FreePag.");
						break;
					case PageIn:
						printf(" %-8s","PageIn");
						break;
					case PoolAllocation:
						printf(" %-8s","PoolAll.");
						break;
					case DelayExecution:
						printf(" %-8s","DelayEx.");
						break;
					case Suspended:
						printf(" %-8s","Suspend.");
						break;
					case UserRequest:
						printf(" %-8s","UserReq.");
						break;
					case WrExecutive:
						printf(" %-8s","WrExect.");
						break;
					case WrFreePage:
						printf(" %-8s","WrFrePg.");
						break;
					case WrPageIn:
						printf(" %-8s","WrPageIn");
						break;
					case WrPoolAllocation:
						printf(" %-8s","WrPoolA.");
						break;
					case WrSuspended:
						printf(" %-8s","WrSuspe.");
						break;
					case WrUserRequest:
						printf(" %-8s","WrUsReq.");
						break;
					case WrEventPair:
						printf(" %-8s","WrEvent.");
						break;
					case WrQueue:
						printf(" %-8s","WrQueue");
						break;
					case WrLpcReceive:
						printf(" %-8s","WrLpcRv.");
						break;
					case WrLpcReply:
						printf(" %-8s","WrLpcRp.");
						break;
					case WrVertualMemory:
						printf(" %-8s","WrVerMm.");
						break;
					case WrPageOut:
						printf(" %-8s","WrPgOut.");
						break;
					case WrRendezvous:
						printf(" %-8s","WrRende.");
						break;
					case WrKernel:
						printf(" %-8s","WrKernel");
						break;
					default:
						printf(" %-8s","UnkNown");
						break;
					}
        		       	printf("\n");
				}
        	        	printf("-------------------------------------------------------------------------------\n\n");
        	          	printf("Total %d Thread(s) !\n\n",ulIndex);

				dwTotalProcess ++;
				break;
			}
			pSystemProc = (PSYstem_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);
		}
	}
	__finally
	{
		if(dwTotalProcess == 0)
		{
			printf("Could not found the %d Process !\n",dwPID);
		}
		else
		{
			printf("TID:\t\t====>\tThread Identification\n");
			printf("Pri:\t\t====>\tPriority\n");
			printf("BPr:\t\t====>\tBase Priority\n");
			printf("Priv:\t\t====>\tPrivilege\n");
			printf("StartAddr:\t====>\tThread Start Address\n");
			printf("CSwitC:\t\t====>\tContext Switch Count\n");
			printf("WtReason:\t====>\tWait Reason\n");
		}
		if(lpSystemInfo != NULL)
		{
			free(lpSystemInfo);
		}
		if(hNtDll != NULL)
		{
       		FreeLibrary(hNtDll);
		}
	}

	return 0;
}

VOID Start()
{
	printf("T-PMList,by TOo2y\n");
	printf("E-mail: TOo2y@safechina.net\n");
	printf("HomePage: www.safechina.net\n");
	printf("Date: 05-10-2003\n\n");
	return ;
}

VOID Usage()
{
	printf("Usage:\tT-PMList  [-e] | [-s PID]\n"); 
	printf("  -e\t  Enumerate All Processes\n");
	printf("  -s PID  Show Special Process information with PID\n\n");
	return ;
}

#endif

2.T-PMPerf的头文件源代码 
#ifndef T_PMPERF_H
#define T_PMPERF_H

#include "windows.h"
#include "stdio.h"

#define SYstem_PERF_INFO             0x02
#define SYstem_PROC_TIME             0x08
#define SYstem_PAGE_INFO             0x12
#define SYstem_CACHE_INFO            0x15
#define MAX_INFO_BUF_LEN             0x500000
#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)

typedef LONG  NTSTATUS;
typedef DWORD SYstem_informatION_CLASS;

typedef struct _LSA_UNICODE_STRING
{
	USHORT  Length;
	USHORT  MaximumLength;
	PWSTR   Buffer;
}LSA_UNICODE_STRING,*PUNICODE_STRING;

typedef struct _SYstem_PERFORMANCE_informatION
{
	LARGE_INTEGER  IdleTime;
	LARGE_INTEGER  ReadTransferCount;
	LARGE_INTEGER  WriteTransferCount;
	LARGE_INTEGER  OtherTransferCount;
	ULONG          ReadOperationCount;
	ULONG          WriteOperationCount;
	ULONG          OtherOperationCount;
	ULONG          AvailablePages;
	ULONG          TotalCommittedPages;
	ULONG          TotalCommitLimit;
	ULONG          PeakCommitment;
	ULONG          PageFaults;
	ULONG          WritecopyFaults;
	ULONG          TransitionFaults;
	ULONG          Reserved1;
	ULONG          DemandZeroFaults;
	ULONG          PagesRead;
	ULONG          PageReadios;
	ULONG          Reserved2[2];
	ULONG          PagefilePagesWritten;
	ULONG          PagefilePageWriteIos;
	ULONG          MappedFilePagesWritten;
	ULONG          MappedFileWriteIos;
	ULONG          PagedPoolUsage;
	ULONG          NonPagedPoolUsage;
	ULONG          PagedPoolAllocs;
	ULONG          PagedPoolFrees;
	ULONG          NonPagedPoolAllocs;
	ULONG          NonPagedPoolFress;
	ULONG          TotalFreeSystemPtes;
	ULONG          SystemCodePage;
	ULONG          TotalSystemDriverPages;
	ULONG          TotalSystemCodePages;
	ULONG          SmallNonPagedLookasideListAllocateHits;
	ULONG          SmallPagedLookasideListAllocateHits;
	ULONG          Reserved3;
	ULONG          MmSystemCachePage;
	ULONG          PagedPoolPage;
	ULONG          SystemDriverPage;
	ULONG          FastReadNowait;
	ULONG          FastReadWait;
	ULONG          FastReadResourceMiss;
	ULONG          FastReadNotPossible;
	ULONG          FastMdlReadNowait;
	ULONG          FastMdlReadWait;
	ULONG          FastMdlReadResourceMiss;
	ULONG          FastMdlReadNotPossible;
	ULONG          MapDatanoWait;
	ULONG          MapDataWait;
	ULONG          MapDatanoWaitMiss;
	ULONG          MapDataWaitMiss;
	ULONG          PinMappedDataCount;
	ULONG          PinReadNowait;
	ULONG          PinReadWait;
	ULONG          PinReadNowaitMiss;
	ULONG          PinReadWaitMiss;
	ULONG          copyReadNowait;
	ULONG          copyReadWait;
	ULONG          copyReadNowaitMiss;
	ULONG          copyReadWaitMiss;
	ULONG          MdlReadNowait;
	ULONG          MdlReadWait;
	ULONG          MdlReadNowaitMiss;
	ULONG          MdlReadWaitMiss;
	ULONG          ReadAheadios;
	ULONG          LazyWriteIos;
	ULONG          LazyWritePages;
	ULONG          DataFlushes;
	ULONG          DataPages;
	ULONG          ContextSwitches;
	ULONG          FirstLevelTbFills;
	ULONG          SecondLevelTbFills;
	ULONG          SystemCall;
}SYstem_PERFORMANCE_informatION,*PSYstem_PERFORMANCE_informatION;

typedef struct __SYstem_PROCESSOR_TIMES
{
	LARGE_INTEGER IdleTime;
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER DpcTime;
	LARGE_INTEGER InterruptTime;
	ULONG         InterruptCount;
}SYstem_PROCESSOR_TIMES,*PSYstem_PROCESSOR_TIMES;

typedef struct _SYstem_PAGEFILE_informatION
{
	ULONG NetxEntryOffset;
	ULONG CurrentSize;
	ULONG TotalUsed;
	ULONG PeakUsed;
	UNICODE_STRING FileName;
}SYstem_PAGEFILE_informatION,*PSYstem_PAGEFILE_informatION;

typedef struct _SYstem_CACHE_informatION
{
	ULONG SystemCacheWsSize;
	ULONG SystemCacheWsPeakSize;
	ULONG SystemCacheWsFaults;
	ULONG SystemCacheWsMinimum;
	ULONG SystemCacheWsMaximum;
	ULONG TransitionSharedPages;
	ULONG TransitionSharedPagesPeak;
	ULONG Reserved[2];
}SYstem_CACHE_informatION,*PSYstem_CACHE_informatION;

typedef NTSTATUS (__stdcall * NTQUERYSYsteminformatION)
                 (IN     SYstem_informatION_CLASS,INT    ULONG,OUT    PULONG OPTION);
NTQUERYSYsteminformatION NtQuerySysteminformation;

DWORD PerfInfo()
{
	SYstem_PERFORMANCE_informatION SystemPerfInfo;
	HMODULE         hNtDll = NULL;
	DWORD           dwNumberBytes;
	DWORD           dwReturnLength;
	NTSTATUS        Status;
	LONGLONG        llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
	       if(hNtDll == NULL)
		{
	           	printf("LoadLibrary Error: %d\n",GetLastError());
	          	__leave;
		}

		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,"NtQuerySysteminformation");
		if(NtQuerySysteminformation == NULL)
		{
			printf("GetProcAddress for NtQuerySysteminformation Error: %d\n",GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYstem_PERFORMANCE_informatION);
		Status = NtQuerySysteminformation(SYstem_PERF_INFO,&SystemPerfInfo,&dwReturnLength);
		if(Status != STATUS_SUCCESS)
		{
			printf("NtQuerySysteminformation for Performance Error: %d\n",GetLastError());
			__leave;
		}

		printf("IdleTime:\t\t");
		llTempTime  = SystemPerfInfo.IdleTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime/(60*60*1000));
		llTempTime %= 60*60*1000;
		printf("%.2d:",llTempTime/(60*1000));
		llTempTime %= 60*1000;
		printf("%.2d.",llTempTime/1000);
		llTempTime %= 1000;
		printf("%.3d\n",llTempTime);

		printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);
		printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);
		printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);
		printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);
		printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);
		printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);

		printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);
		printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);
		printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);
		printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);

		printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);
		printf("WritecopyFault:\t\t%d\n",SystemPerfInfo.WritecopyFaults);
		printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);
		printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);

		printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);
		printf("PageReadios:\t\t%d\n",SystemPerfInfo.PageReadios);
		printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);
		printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);
		printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWritten);
		printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);

		printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);
		printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);
		printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);
		printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);
		printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);
		printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);

		printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);
		printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);
		printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);
		printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages);
		printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);
		printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);

		printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);
		printf("FastReadNowait:\t\t%d\n",SystemPerfInfo.FastReadNowait);
		printf("FastReadnopossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);
		printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);
		printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);
		printf("FastMdlReadNowait:\t%d\n",SystemPerfInfo.FastMdlReadNowait);
		printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossible);
		printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss);


		printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);
		printf("MapDatanoWait:\t\t%d\n",SystemPerfInfo.MapDatanoWait);
		printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);
		printf("MapDatanoWaitMiss:\t%d\n",SystemPerfInfo.MapDatanoWaitMiss);

		printf("ReadAheadios:\t\t%-10d\t",SystemPerfInfo.ReadAheadios);
		printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);
		printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);
		printf("PinReadNowait:\t\t%d\n",SystemPerfInfo.PinReadNowait);
		printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);
		printf("PinReadNowaitMiss:\t%d\n",SystemPerfInfo.PinReadNowaitMiss);

		printf("copyReadWait:\t\t%-10d\t",SystemPerfInfo.copyReadWait);
		printf("copyReadNowait:\t\t%d\n",SystemPerfInfo.copyReadNowait);
		printf("copyReadWaitMiss:\t%-10d\t",SystemPerfInfo.copyReadWaitMiss);
		printf("copyReadNowaitMiss:\t%-10d\n",SystemPerfInfo.copyReadNowaitMiss);
		printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);
		printf("MdlReadNowait:\t\t%d\n",SystemPerfInfo.MdlReadNowait);
		printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);
		printf("MdlReadNowaitMiss:\t%d\n",SystemPerfInfo.MdlReadNowaitMiss);

		printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);
		printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);
		printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);
		printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);
		printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);
		printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);
		printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);
		printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);

		printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);
		printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPagedLookasideListAllocateHits);
		printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);

	}
	__finally
	{
		if(hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD ProcTime()
{
	SYstem_PROCESSOR_TIMES  SystemProcTime;
	HMODULE                 hNtDll = NULL;
	DWORD                   dwNumberBytes;
	DWORD                   dwReturnLength;
	NTSTATUS                Status;
	LONGLONG                llTempTime;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
	       if(hNtDll == NULL)
		{
	         	printf("LoadLibrary Error: %d\n",GetLastError());
	       	__leave;
		}

		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYstem_PROCESSOR_TIMES);
		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,"NtQuerySysteminformation");
		if(NtQuerySysteminformation == NULL)
		{
			printf("GetProcAddress Error: %d\n",GetLastError());
			__leave;
		}

		Status = NtQuerySysteminformation(SYstem_PROC_TIME,&SystemProcTime,&dwReturnLength);
		if(Status != STATUS_SUCCESS)
		{
			printf("NtQuerySysteminformation for Processor Time Error: %d\n",GetLastError());
			__leave;
		}

		printf("IdleTime:\t\t");
		llTempTime  = SystemProcTime.IdleTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime);

		printf("KernelTime:\t\t");
		llTempTime  = SystemProcTime.KernelTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime);

		printf("UserTime:\t\t");
		llTempTime  = SystemProcTime.UserTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime);

		printf("DpcTime:\t\t");
		llTempTime  = SystemProcTime.DpcTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime);

		printf("InterruptTime:\t\t");
		llTempTime  = SystemProcTime.InterruptTime.QuadPart;
		llTempTime /= 10000;
		printf("%d:",llTempTime);

		printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);

	}
	__finally
	{
		if(hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD PagefileInfo()
{
	PSYstem_PAGEFILE_informatION   pSystemPagefileInfo;
	PVOID                          pBuffer;
	HMODULE                        hNtDll = NULL;
	DWORD                          dwNumberBytes;
	DWORD                          dwReturnLength;
       NTSTATUS                       Status;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
	       if(hNtDll == NULL)
		{
	         	printf("LoadLibrary Error: %d\n",GetLastError());
	        	__leave;
		}

		NtQuerySysteminformation = (NTQUERYSYsteminformatION)GetProcAddress(hNtDll,GetLastError());
			__leave;
		}

		dwNumberBytes = MAX_INFO_BUF_LEN;
		pBuffer = (LPVOID)malloc(dwNumberBytes);
		Status  = NtQuerySysteminformation(SYstem_PAGE_INFO,pBuffer,&dwReturnLength);
		if(Status != STATUS_SUCCESS)
		{
			printf("NtQuerySysteminformation for Pagefile Error: %d\n",GetLastError());
			__leave;
		}

		pSystemPagefileInfo = (PSYstem_PAGEFILE_informatION)pBuffer;
		do
		{
			printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);
			printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);
			printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);
			wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer);

			pSystemPagefileInfo = (PSYstem_PAGEFILE_informatION)((char *)pBuffer + pSystemPagefileInfo->NetxEntryOffset);
		}while(pSystemPagefileInfo->NetxEntryOffset != 0);
	}
	__finally
	{
		if(pBuffer != NULL)
		{
			free(pBuffer);
		} 
		if(hNtDll  != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

DWORD CacheInfo()
{
	SYstem_CACHE_informatION       SystemCacheInfo;
	HMODULE                        hNtDll = NULL;
	DWORD                          dwNumberBytes;
	DWORD                          dwReturnLength;
       NTSTATUS                       Status;

	__try
	{
		hNtDll = LoadLibrary("NtDll.dll");
	       if(hNtDll == NULL)
		{
	        	printf("LoadLibrary Error: %d\n",GetLastError());
			__leave;
		}

		dwNumberBytes = sizeof(SYstem_CACHE_informatION);
		Status  = NtQuerySysteminformation(SYstem_CACHE_INFO,&SystemCacheInfo,&dwReturnLength);
		if(Status != STATUS_SUCCESS)
		{
			printf("NtQuerySysteminformation for Cache Error: %d\n",GetLastError());
			__leave;
		}

		printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize/1024);
		printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024);
		printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults);
		printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum);
		printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum);
		printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages);
		printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);

	}
	__finally
	{
		if(hNtDll != NULL)
		{
			FreeLibrary(hNtDll);
		}
	}

	return 0;
}

VOID Start()
{
	printf("T-PMPerf,by TOo2y\n");
	printf("E-mail: TOo2y@safechina.net\n");
	printf("HomePage: www.safechina.net\n");
	printf("Date: 05-09-2003\n\n");
	return ;
}

VOID Usage()
{
	printf("Usage:\tT-PMPerf <Option>\n");
	printf("Option:\n");
	printf("  -Perf   System Performance information\n");
	printf("  -Proc   System Processor information\n");
	printf("  -Page   System Pagefile information\n");
	printf("  -Cache  System Cache information\n");
	return ;
}

#endif


版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

如何用django开发一个简易个人Blog
功能概要：（目前已实现功能）公共展示部分：1.网站首页展示已发布的博客记录，包括名称、摘要信息、发布日期、阅读量及评论数。2.首页文章列表可按照分类筛选。3.点击标题或阅读全文链接，进入博客阅读页面，展示文章标题、内容及评论内容。博客后台管理部分：（后台套用了一个叫做ACE的后台模板，改造成了dja
Python中的几种数据类型
大体上把Python中的数据类型分为如下几类： Number（数字） 包括int,long,float,complex String（字符串） 例如：hello,&quot;hello&quot;,hello List（列表） 例如：[1,2,3],[1,2,3,[1,2,3],4] Diction
django开发个人简易Blog——构建项目结构
开发之前第一步，就是构造整个的项目结构。这就好比作一幅画，第一步就是描绘轮廓，有了轮廓，剩下的就是慢慢的填充细节。项目结构规划如下图：项目结构描述:本项目以fengzhengBlog为根目录。admin、blogapp是两个app目录,用于实现项目主要功能：包括模型定义、视图定义等css、js、im
Linux下安装Apache并以mod_wsgi方式部署django站点
源码编译方式安装Apache首先下载Apache源码压缩包，地址为http://mirror.bit.edu.cn/apache/httpd/继续下载apr和apr-util压缩包，地址为http://mirror.bit.edu.cn/apache/apr/下载pcre压缩包，地址为http://
django开发个人简易Blog—nginx+uwsgin+django1.6+mysql 部署到CentOS6.5
前面说完了此项目的创建及数据模型设计的过程。如果未看过，可以到这里查看，并且项目源码已经放大到github上,可以去这里下载。代码也已经部署到sina sea上，地址为http://fengzheng.sinaapp.com/先跳过视图展示及表单处理的部分，先介绍一下如何部署。标题中已经把部署环境介
Scrapy爬取自己的博客内容
python中常用的写爬虫的库有urllib2、requests,对于大多数比较简单的场景或者以学习为目的，可以用这两个库实现。这里有一篇我之前写过的用urllib2𫯪utifulSoup做的一个抓取百度音乐热门歌曲的例子，有兴趣可以看一下。本文介绍用Scrapy抓取我在博客园的博客列表，只抓
用python实现的百度音乐下载器-python-pyqt-改进版
之前写过一个用python实现的百度新歌榜、热歌榜下载器的博文，实现了百度新歌、热门歌曲的爬取与下载。但那个采用的是单线程，网络状况一般的情况下，扫描前100首歌的时间大概得到40来秒。而且用Pyqt做的界面，在下载的过程中进行窗口操作，会出现UI阻塞的现象。 前两天有时间调整了一下，做了几方面的改
Python:解决中文字符串问题
本人安装的是Python 2.7版本，由于编写程序的过程中会碰到中文字符串，但由于Python默认采用ASCII编码方式，所以对中文不支持。要解决此问题，必须设置当前编码方式为Unicode方式。默认ASCII编码方式对中文字符产生的异常为：UnicodeDecodeError: &#39;asci
Django集成百度富文本编辑器uEditor
UEditor是由百度web前端研发部开发所见即所得富文本web编辑器，具有轻量，可定制，注重用户体验等特点，开源基于MIT协议，允许自由使用和修改代码。首先从ueEditor官网下载最新版本的包，目前官网上提供了ASP、.NET、PHP、JSP版本的，django版本只有一个第三方个人开发的，但看
django开发个人简易Blog——数据模型
提到数据模型，一定要说一下MVC,MVC框架是现代web开发中最流行的开发框架，它将数据与业务逻辑分开，减小了应用之间的高度耦合。个人非常喜欢MVC开发框架，除了具有上述特性，它使得web开发变得非常灵活，在ASP.NET上表现的尤为强烈，传统的ASP.NET开发常常用到好多臃肿的服务器端控件，定制
苹果市值2025年有望达4万亿美元
pythonJavaScriptjavaHTMLreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-bootreact-native