typedef LONG NTSTATUS;

typedef struct _LSA_UNICODE_STRING
{
USHORT  Length;
USHORT  MaximumLength;
PWSTR   Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

typedef LONG KPRIORITY;

typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
ULONG QuotaPeakPagedPoolUsage;
ULONG QuotaPagedPoolUsage;
ULONG QuotaPeakNonPagedPoolUsage;
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;

typedef enum _THREAD_STATE
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
}THREAD_STATE;

typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVertualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel
}KWAIT_REASON;

typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG         WaitTime;
PVOID         StartAddress;
CLIENT_ID     ClientId;
KPRIORITY     Priority;
KPRIORITY     BasePriority;
ULONG         ContextSwitchCount;
THREAD_STATE  State;
KWAIT_REASON  WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESSES
{
ULONG          NextEntryDelta;
ULONG          ThreadCount;
ULONG          Reserved1[6];
LARGE_INTEGER  CreateTime;
LARGE_INTEGER  UserTime;
LARGE_INTEGER  KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY      BasePriority;
ULONG          ProcessId;
ULONG          InheritedFromProcessId;
ULONG          HandleCount;
ULONG          Reserved2[2];
VM_COUNTERS    VmCounters;
IO_COUNTERS    IoCounters;
SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

typedef DWORD    SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
                 (IN     SYSTEM_INFORMATION_CLASS,
       IN OUT PVOID,
       IN     ULONG,
       OUT    PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

DWORD EnumProcess()
{
           PSYSTEM_PROCESSES  pSystemProc;
HMODULE            hNtDll         = NULL;
LPVOID             lpSystemInfo   = NULL;
DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
DWORD              dwTotalProcess = 0;
DWORD              dwReturnLength;
NTSTATUS           Status; 
LONGLONG           llTempTime;

__try
{
hNtDll = LoadLibrary("NtDll.dll");
           if(hNtDll == NULL)
{
            printf("LoadLibrary Error: %d\n",GetLastError());
                  __leave;
}

NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)
GetProcAddress(hNtDll,"NtQuerySystemInformation");
           if(NtQuerySystemInformation == NULL)
{
                  printf("GetProcAddress for NtQuerySystemInformation 
Error: %d\n",GetLastError());
                    __leave;
}

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                       lpSystemInfo,
                                                 dwNumberBytes,
  &dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH\n");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}

printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID",
"WsSize","Prio.","Thread","Handle","CPU Time");
printf("-----------------------------------\n");
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s",L"System Idle Process");
}
printf("%6d",pSystemProc->ProcessId);
printf("%7d",pSystemProc->InheritedFromProcessId);
printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);
printf("%6d",pSystemProc->BasePriority);
printf("%7d",pSystemProc->ThreadCount);
printf("%7d",pSystemProc->HandleCount);
llTempTime  = pSystemProc->KernelTime.QuadPart + 
pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf("%3d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d",llTempTime);

printf("\n");
dwTotalProcess ++;
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + 
pSystemProc->NextEntryDelta);
}
printf("--------------------------------------------\n");
printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);
printf("PID\t ==> Process Identification\n");
printf("PPID\t ==> Parent Process Identification\n");
printf("WsSize\t ==> Working Set Size\n");
printf("Prio.\t ==> Base Priority\n");
printf("Thread\t ==> Thread Count\n");
printf("Handle\t ==> Handle Count\n");
printf("CPU Time ==> Processor Time\n");
}
__finally
{
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
                  FreeLibrary(hNtDll);
}
}

return 0;
}

DWORD SpeciProcess(DWORD dwPID)
{
           PSYSTEM_PROCESSES  pSystemProc    = NULL;
PSYSTEM_THREADS    pSystemThre    = NULL;  
HMODULE            hNtDll         = NULL;
LPVOID             lpSystemInfo   = NULL;
DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
DWORD              dwTotalProcess = 0;
DWORD              dwReturnLength;
NTSTATUS           Status; 
LONGLONG           llTempTime;
ULONG              ulIndex;

__try
{
hNtDll = LoadLibrary("NtDll.dll");
           if(hNtDll == NULL)
{
           printf("LoadLibrary Error: %d\n",GetLastError());
                      __leave;
}

NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)
GetProcAddress(hNtDll,"NtQuerySystemInformation");
                if(NtQuerySystemInformation == NULL)
{
                  printf("GetProcAddress for NtQuerySystemInformation 
Error: %d\n",GetLastError());
                   __leave;
}

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                       lpSystemInfo,
 dwNumberBytes,
 &dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf("STATUS_INFO_LENGTH_MISMATCH\n");
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf("NtQuerySystemInformation Error: %d\n",GetLastError());
__leave;
}

pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId == dwPID)
{
printf("ProcessName:\t\t ");
if(pSystemProc->ProcessId != 0)
{
wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L"%-20s\n",L"System Idle Process");
}
printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);
printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);

printf("KernelTime:\t\t ");
llTempTime  = pSystemProc->KernelTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\t",llTempTime);

printf("UserTime:\t\t");
llTempTime  = pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf("%d:",llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf("%.2d:",llTempTime/(60*1000));
llTempTime %= 60*1000;
printf("%.2d.",llTempTime/1000);
llTempTime %= 1000;
printf("%.3d\n",llTempTime);

printf("Privilege:\t\t %d%%\t\t",(pSystemProc->
KernelTime.QuadPart * 100)/
(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));
printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/
(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);
printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);

printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);
printf("PageFaultCount:\t\t%d\n\n",pSystemProc->
VmCounters.PageFaultCount);

printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorkingSetSize/1024);
printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->
VmCounters.WorkingSetSize/1024);

printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPagedPoolUsage/1024);
printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);

printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNonPagedPoolUsage/1024);
printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);

printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsage/1024);
printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);

printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualSize/1024);
printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);

printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCount);
printf("ReadOperationCount:\t%-8d\n",pSystemProc->
IoCounters.ReadOperationCount);

printf("WriteTransfer:\t\t %-8d\t",pSystemProc->
IoCounters.WriteTransferCount);
printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);

printf("OtherTransfer:\t\t %-8d\t",pSystemProc->
IoCounters.OtherTransferCount);
printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);

printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr",
"Priv","User","KernelTime","UserTime","StartAddr","CSwitC","
State","WtReason");
           printf("------------------------------------------------\n");

文章转载地址：http://www.cnpaf.net/Class/hack/05121820345163894959.htm