Click here to Skip to main content
15,888,803 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Extracting numbers from a year Pin
Titan905-Mar-06 15:26
Titan905-Mar-06 15:26 
QuestionUsing .lib vs. .dll Pin
Eikthrynir5-Mar-06 12:12
Eikthrynir5-Mar-06 12:12 
AnswerRe: Using .lib vs. .dll Pin
Jörgen Sigvardsson5-Mar-06 12:44
Jörgen Sigvardsson5-Mar-06 12:44 
GeneralRe: Using .lib vs. .dll Pin
John R. Shaw5-Mar-06 16:08
John R. Shaw5-Mar-06 16:08 
AnswerRe: Using .lib vs. .dll Pin
Tim Smith5-Mar-06 14:05
Tim Smith5-Mar-06 14:05 
QuestionOpenGL MFC Pin
braveheartkenya5-Mar-06 11:14
braveheartkenya5-Mar-06 11:14 
AnswerRe: OpenGL MFC Pin
Steve Echols5-Mar-06 12:28
Steve Echols5-Mar-06 12:28 
Questionproblem calling NtQuerySystemInformation Pin
gamitech5-Mar-06 8:18
gamitech5-Mar-06 8:18 
So I want to enumerate the processes using NtQuerySystemInformation() native api.
I load it from ntdll.dll
i use the process structure below unlike the one documented by microsoft. but i've seen that others use it too.

typedef struct _SYSTEM_PROCESS_INFORMATION
{
DWORD dNext;
DWORD dThreadCount;
DWORD dReserved01;
DWORD dReserved02;
DWORD dReserved03;
DWORD dReserved04;
DWORD dReserved05;
DWORD dReserved06;
QWORD qCreateTime;
QWORD qUserTime;
QWORD qKernelTime;
UNICODE_STRING usName;
DWORD BasePriority;
DWORD dUniqueProcessId;
DWORD dInheritedFromUniqueProcessId;
DWORD dHandleCount;
DWORD dReserved07;
DWORD dReserved08;
VM_COUNTERS VmCounters;
DWORD dCommitCharge;
SYSTEM_THREAD Threads[1];
} SYSTEM_PROCESS_INFORMATION;

the thing is that when I call it I don't get any error code or null pointers but the structure's members are zeros.
the dNext member is not zero but I can't obtain the next pointer for another system_process_information because i get the invalid pointer error when I try this:

if (ProcessInfo->dNext!=0)
ProcessInfo=(SYSTEM_PROCESS_INFORMATION_DEF *)((ULONG *)ProcessInfo+ProcessInfo->dNext);



And I have another question.
How much space should I allocate for the ProcessInfo structure
i only allocate for one structure
SYSTEM_PROCESS_INFORMATION *ProcessInfo=(SYSTEM_PROCESS_INFORMATION *)malloc(sizeof(SYSTEM_PROCESS_INFORMATION));

or I shouldn't allocate at all. I will obtain a pointer to the structure anyway ?
here is the code I use:


HMODULE ntHinst;

ntHinst=LoadLibraryA(NTDLL);
if (ntHinst==NULL)
{
MessageBoxA(GetDesktopWindow(),"Error loading ntdll\nThe program will now end","ERROR",MB_ICONSTOP);
return 0;
}

_NtQuerySystemInformation=(NTQUERYSYSTEMINFORMATION)GetProcAddress(ntHinst,"NtQuerySystemInformation");
if(!_NtQuerySystemInformation)
{
MessageBoxA(GetDesktopWindow(),"Error obtaining function pointer\nThe program will now terminate","ERROR",MB_ICONSTOP);
return 0;
}


SYSTEM_PROCESS_INFORMATION *ProcessInfo=(SYSTEM_PROCESS_INFORMATION *)malloc(sizeof(SYSTEM_PROCESS_INFORMATION);
if (IsBadReadPtr(ProcessInfo,sizeof(SYSTEM_PROCESS_INFORMATION))||IsBadWritePtr(ProcessInfo,sizeof(SYSTEM_PROCESS_INFORMATION)))
return 0;

_NtQuerySystemInformation(SystemProcessInformation ,(PVOID)ProcessInfo,sizeof(SYSTEM_PROCESS_INFORMATION),&ret);

if (ret==0)
{
MessageBoxA(GetDesktopWindow(),"Function Call Failed: NtQuerySystemInformation\nThe program will now terminate","ERROR",MB_ICONSTOP);
return 0;
}
if(ProcessInfo==NULL)
{
MessageBoxA(GetDesktopWindow(),"Function Call Failed: NtQuerySystemInformation\nThe program will now terminate","ERROR",MB_ICONSTOP);
return 0;
}

while(ProcessInfo!=NULL)
{
//RtlUnicodeStringToOemString(usname,&ProcessInfo->usName,TRUE);
//MessageBoxA(0,usname->Buffer,"",MB_OK);
//RtlFreeOemString(usname);

HANDLE hProc;
hProc=OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,ProcessInfo->dUniqueProcessId);
if (hProc!=NULL)
{
HMODULE hmods[300];
DWORD retv;
char fname[1024];

EnumProcessModules(hProc,hmods,sizeof(hmods),&retv);
retv=retv/sizeof(DWORD);
GetModuleFileNameA(*hmods,fname,sizeof(fname));
MessageBoxA(GetDesktopWindow(),fname,"Process Name",MB_OK);
}
else if (ProcessInfo->dNext!=0)
ProcessInfo=(SYSTEM_PROCESS_INFORMATION_DEF *)((ULONG *)ProcessInfo+ProcessInfo->dNext);
else
ProcessInfo=NULL;

if (ProcessInfo->dNext!=0)
ProcessInfo=(SYSTEM_PROCESS_INFORMATION_DEF *)((ULONG *)ProcessInfo+ProcessInfo->dNext);
else
ProcessInfo=NULL;

}

free(ProcessInfo);

So I get no errors durin calling. but I also get a structure full of zero's.
What is the pb ?

gabby
QuestionCFileDialog Resource Pin
MON2055-Mar-06 6:26
MON2055-Mar-06 6:26 
AnswerRe: CFileDialog Resource Pin
Naveen5-Mar-06 16:10
Naveen5-Mar-06 16:10 
GeneralRe: CFileDialog Resource Pin
MON2055-Mar-06 20:03
MON2055-Mar-06 20:03 
Question2 classes Pin
Sam 20065-Mar-06 5:08
Sam 20065-Mar-06 5:08 
AnswerRe: 2 classes Pin
darkelv5-Mar-06 5:14
darkelv5-Mar-06 5:14 
AnswerRe: 2 classes Pin
Michael Dunn5-Mar-06 6:20
sitebuilderMichael Dunn5-Mar-06 6:20 
Answersolution Pin
Sam 20065-Mar-06 6:24
Sam 20065-Mar-06 6:24 
GeneralRe: solution Pin
John R. Shaw5-Mar-06 14:30
John R. Shaw5-Mar-06 14:30 
GeneralRe: solution Pin
Divyang Mithaiwala5-Mar-06 17:23
Divyang Mithaiwala5-Mar-06 17:23 
QuestionDisplaying OpenGL terrain in MFC Pin
amanoullah5-Mar-06 4:32
amanoullah5-Mar-06 4:32 
QuestionOverloaded functions in DLL Pin
Eikthrynir5-Mar-06 2:59
Eikthrynir5-Mar-06 2:59 
AnswerRe: Overloaded functions in DLL Pin
Gary R. Wheeler5-Mar-06 3:45
Gary R. Wheeler5-Mar-06 3:45 
AnswerRe: Overloaded functions in DLL Pin
Michael Dunn5-Mar-06 6:25
sitebuilderMichael Dunn5-Mar-06 6:25 
Questioninteger to string? Pin
Pacificat0r5-Mar-06 2:02
Pacificat0r5-Mar-06 2:02 
AnswerRe: integer to string? Pin
Gary R. Wheeler5-Mar-06 2:22
Gary R. Wheeler5-Mar-06 2:22 
AnswerRe: integer to string? Pin
Stephen Hewitt5-Mar-06 2:35
Stephen Hewitt5-Mar-06 2:35 
AnswerRe: integer to string? Pin
Michael Dunn5-Mar-06 6:27
sitebuilderMichael Dunn5-Mar-06 6:27 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.