Corrected system_threads and system_processes struct

Recently, a 32-bit program needs to be transplanted to a 64-bit system. The program uses the zwquerysysteminformation function to enumerate the process and thread information in the system, however, the transplanted program does not work properly in Windows x64. The process/thread information obtained is messy and incorrect. By querying the wrk and Win2k source code, the Members in the struct are modified, and the compiled program can be properly displayed.

Because zwquerysysteminformation is a Windows undocumented function, the structures that can be searched on the network are obtained reversely Based on Win32, so there may be some deviations.

The most obvious problem is the difference between handle and ulong. In Windows, the handle type is defined as typedef handle pvoid *. On a 32-bit platform, sizeof (handle) = sizeof (ulong) = 4. Therefore, it is possible that the human who reversed the handle type was written into the ulong type, in this way, writing on a 32-bit platform won't go wrong, but on a 64-bit platform, the handle type is changed to 8 bytes, the ulong type is defined in the compiler as a ulong32 type, that is, a 32-bit unsigned integer, resulting in a member offset deviation in the structure.

In Windows, the process ID is represented by the handle type, rather than the ulong type. Note This when porting the platform! Too many people like to express the process ID in the ulong type.

Typedef struct _ system_threads
{
Large_integer kerneltime;
Large_integer usertime;
Large_integer createtime;
Ulong waittime;
Pvoid startaddress;
Client_id clientid;
Kpriority priority;
Kpriority basepriority;
Ulong contextswitchcount;
Ulong threadstate;
Kwait_reason waitreason;
Ulong reserved; // Add
} System_threads, * psystem_threads;

Typedef struct _ system_processes
{
Ulong nextentrydelta;
Ulong threadcount;
Ulong reserved [6];
Large_integer createtime;
Large_integer usertime;
Large_integer kerneltime;
Unicode_string processname;
Kpriority basepriority;
Handle processid; // modify
Handle inheritedfromprocessid; // modify
Ulong handlecount;
Ulong sessionid;
Ulong_ptr pagedirectorybase;
Vm_counters vmcounters;
Size_t privatepagecount; // Add
Io_counters iocounters; // Windows 2000 only
Struct _ system_threads threads [1];
} System_processes, * psystem_processes;