Windows擷取實體記憶體的2種方式 - 隨筆記錄

標籤：shared   處理器   mirror   cat   lis   char*   sep   pack   contains   

  1 typedef enum _SYSTEM_INFORMATION_CLASS {  2     SystemBasicInformation,  3     SystemProcessorInformation,             // obsolete...delete  4     SystemPerformanceInformation,  5     SystemTimeOfDayInformation,  6     SystemPathInformation,  7     SystemProcessInformation,  8     SystemCallCountInformation,  9     SystemDeviceInformation, 10     SystemProcessorPerformanceInformation, 11     SystemFlagsInformation, 12     SystemCallTimeInformation, 13     SystemModuleInformation, 14     SystemLocksInformation, 15     SystemStackTraceInformation, 16     SystemPagedPoolInformation, 17     SystemNonPagedPoolInformation, 18     SystemHandleInformation, 19     SystemObjectInformation, 20     SystemPageFileInformation, 21     SystemVdmInstemulInformation, 22     SystemVdmBopInformation, 23     SystemFileCacheInformation, 24     SystemPoolTagInformation, 25     SystemInterruptInformation, 26     SystemDpcBehaviorInformation, 27     SystemFullMemoryInformation, 28     SystemLoadGdiDriverInformation, 29     SystemUnloadGdiDriverInformation, 30     SystemTimeAdjustmentInformation, 31     SystemSummaryMemoryInformation, 32     SystemMirrorMemoryInformation, 33     SystemPerformanceTraceInformation, 34     SystemObsolete0, 35     SystemExceptionInformation, 36     SystemCrashDumpStateInformation, 37     SystemKernelDebuggerInformation, 38     SystemContextSwitchInformation, 39     SystemRegistryQuotaInformation, 40     SystemExtendServiceTableInformation, 41     SystemPrioritySeperation, 42     SystemVerifierAddDriverInformation, 43     SystemVerifierRemoveDriverInformation, 44     SystemProcessorIdleInformation, 45     SystemLegacyDriverInformation, 46     SystemCurrentTimeZoneInformation, 47     SystemLookasideInformation, 48     SystemTimeSlipNotification, 49     SystemSessionCreate, 50     SystemSessionDetach, 51     SystemSessionInformation, 52     SystemRangeStartInformation, 53     SystemVerifierInformation, 54     SystemVerifierThunkExtend, 55     SystemSessionProcessInformation, 56     SystemLoadGdiDriverInSystemSpace, 57     SystemNumaProcessorMap, 58     SystemPrefetcherInformation, 59     SystemExtendedProcessInformation, 60     SystemRecommendedSharedDataAlignment, 61     SystemComPlusPackage, 62     SystemNumaAvailableMemory, 63     SystemProcessorPowerInformation, 64     SystemEmulationBasicInformation, 65     SystemEmulationProcessorInformation, 66     SystemExtendedHandleInformation, 67     SystemLostDelayedWriteInformation, 68     SystemBigPoolInformation, 69     SystemSessionPoolTagInformation, 70     SystemSessionMappedViewInformation, 71     SystemHotpatchInformation, 72     SystemObjectSecurityMode, 73     SystemWatchdogTimerHandler, 74     SystemWatchdogTimerInformation, 75     SystemLogicalProcessorInformation, 76     SystemWow64SharedInformation, 77     SystemRegisterFirmwareTableInformationHandler, 78     SystemFirmwareTableInformation, 79     SystemModuleInformationEx, 80     SystemVerifierTriageInformation, 81     SystemSuperfetchInformation, 82     SystemMemoryListInformation, 83     SystemFileCacheInformationEx, 84     MaxSystemInfoClass,  // MaxSystemInfoClass should always be the last enum 85  86     SystemPageMemoryInformation = 123 87 } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; 88  89 typedef struct _SYSTEM_BASIC_INFORMATION 90 { 91     ULONG Unknown; //Always contains zero 92     ULONG MaximumIncrement; //一個時鐘的計量單位 93     ULONG PhysicalPageSize; //一個記憶體頁的大小 94     ULONG NumberOfPhysicalPages; //系統管理著多少個頁 95     ULONG LowestPhysicalPage; //低端記憶體頁 96     ULONG HighestPhysicalPage; //高端記憶體頁 97     ULONG AllocationGranularity; 98     ULONG LowestUserAddress; //地端使用者地址 99     ULONG HighestUserAddress; //高端使用者地址100     ULONG ActiveProcessors; //啟用的處理器101     UCHAR NumberProcessors; //有多少個處理器102 }SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;103 104 NTSTATUS (__stdcall *ZwQuerySystemInformation)(105     _In_      SYSTEM_INFORMATION_CLASS SystemInformationClass,106     _Inout_   PVOID                    SystemInformation,107     _In_      ULONG                    SystemInformationLength,108     _Out_opt_ PULONG                   ReturnLength) = 0;109 110 111 int _tmain(int argc, _TCHAR* argv[])112 {113     //方式一 ZwQuerySystemInformation114     HMODULE hNtdll = GetModuleHandle(_T("ntdll.dll"));115     *(LPVOID *)&ZwQuerySystemInformation = GetProcAddress(hNtdll, "ZwQuerySystemInformation");116 117     SYSTEM_BASIC_INFORMATION sbi = { 0 };118     ZwQuerySystemInformation(119         SystemBasicInformation,120         &sbi,121         sizeof(sbi),122         NULL);123 124     unsigned __int64 nsize = (unsigned __int64)sbi.NumberOfPhysicalPages * sbi.PhysicalPageSize;125 126 127     //方式二 GlobalMemoryStatusEx128     MEMORYSTATUSEX msex;129     msex.dwLength = sizeof(msex);130     GlobalMemoryStatusEx(&msex);131     msex.ullTotalPhys;//實體記憶體大小132 133     return 0;134 }

 

Windows擷取實體記憶體的2種方式 - 隨筆記錄