Fix Process/Thread information structures to match Windows 2000 and have proper structure. Fix bug in ntdll related to OpenProcess

svn path=/trunk/; revision=14674
This commit is contained in:
Alex Ionescu 2005-04-18 17:46:59 +00:00
parent db6c8885b6
commit 5817ae7a54
5 changed files with 147 additions and 206 deletions

View file

@ -32,10 +32,10 @@
/* OBJECTS */
/* TYPES */
typedef NTSTATUS (NTAPI *PPROC_ENUM_ROUTINE)(IN PSYSTEM_PROCESSES CurrentProcess,
typedef NTSTATUS (NTAPI *PPROC_ENUM_ROUTINE)(IN PSYSTEM_PROCESS_INFORMATION CurrentProcess,
IN OUT PVOID CallbackContext);
typedef NTSTATUS (NTAPI *PTHREAD_ENUM_ROUTINE)(IN PSYSTEM_THREADS CurrentThread,
typedef NTSTATUS (NTAPI *PTHREAD_ENUM_ROUTINE)(IN PSYSTEM_THREAD_INFORMATION CurrentThread,
IN OUT PVOID CallbackContext);
typedef NTSTATUS (NTAPI *PSYSMOD_ENUM_ROUTINE)(IN PSYSTEM_MODULE_INFORMATION_ENTRY CurrentModule,
@ -67,36 +67,36 @@ PsaEnumerateThreads(IN PTHREAD_ENUM_ROUTINE Callback,
/* capturing & walking */
NTSTATUS NTAPI
PsaCaptureProcessesAndThreads(OUT PSYSTEM_PROCESSES * ProcessesAndThreads);
PsaCaptureProcessesAndThreads(OUT PSYSTEM_PROCESS_INFORMATION * ProcessesAndThreads);
NTSTATUS NTAPI
PsaWalkProcessesAndThreads(IN PSYSTEM_PROCESSES ProcessesAndThreads,
PsaWalkProcessesAndThreads(IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads,
IN PPROC_ENUM_ROUTINE ProcessCallback,
IN OUT PVOID ProcessCallbackContext,
IN PTHREAD_ENUM_ROUTINE ThreadCallback,
IN OUT PVOID ThreadCallbackContext);
NTSTATUS NTAPI
PsaWalkProcesses(IN PSYSTEM_PROCESSES ProcessesAndThreads,
PsaWalkProcesses(IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads,
IN PPROC_ENUM_ROUTINE Callback,
IN OUT PVOID CallbackContext);
NTSTATUS NTAPI
PsaWalkThreads(IN PSYSTEM_PROCESSES ProcessesAndThreads,
PsaWalkThreads(IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads,
IN PTHREAD_ENUM_ROUTINE Callback,
IN OUT PVOID CallbackContext);
PSYSTEM_PROCESSES FASTCALL
PsaWalkFirstProcess(IN PSYSTEM_PROCESSES ProcessesAndThreads);
PSYSTEM_PROCESS_INFORMATION FASTCALL
PsaWalkFirstProcess(IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads);
PSYSTEM_PROCESSES FASTCALL
PsaWalkNextProcess(IN PSYSTEM_PROCESSES CurrentProcess);
PSYSTEM_PROCESS_INFORMATION FASTCALL
PsaWalkNextProcess(IN PSYSTEM_PROCESS_INFORMATION CurrentProcess);
PSYSTEM_THREADS FASTCALL
PsaWalkFirstThread(IN PSYSTEM_PROCESSES CurrentProcess);
PSYSTEM_THREAD_INFORMATION FASTCALL
PsaWalkFirstThread(IN PSYSTEM_PROCESS_INFORMATION CurrentProcess);
PSYSTEM_THREADS FASTCALL
PsaWalkNextThread(IN PSYSTEM_THREADS CurrentThread);
PSYSTEM_THREAD_INFORMATION FASTCALL
PsaWalkNextThread(IN PSYSTEM_THREAD_INFORMATION CurrentThread);
/* System modules */
/* enumeration */

View file

@ -326,39 +326,46 @@ typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
ULONG SystemCalls;
} SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION;
#ifndef __USE_W32API
// SystemProcessThreadInfo (5)
typedef struct _SYSTEM_THREAD_INFORMATION
{
TIME KernelTime;
TIME UserTime;
TIME CreateTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
LONG BasePriority;
ULONG ContextSwitches;
LONG ThreadState;
KWAIT_REASON WaitReason;
ULONG ThreadState;
ULONG WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
typedef struct SYSTEM_PROCESS_INFORMATION
typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG NextEntryOffset;
ULONG NumberOfThreads;
LARGE_INTEGER SpareLi1;
LARGE_INTEGER SpareLi2;
LARGE_INTEGER SpareLi3;
TIME CreateTime;
TIME UserTime;
TIME KernelTime;
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
ULONG BasePriority;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG SpareUl3;
ULONG PageDirectoryFrame;
/*
* This part corresponds to VM_COUNTERS_EX.
* NOTE: *NOT* THE SAME AS VM_COUNTERS!
*/
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
@ -370,9 +377,22 @@ typedef struct SYSTEM_PROCESS_INFORMATION
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
ULONG PrivatePageCount;
ULONG PrivateUsage;
/* This part corresponds to IO_COUNTERS */
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
/* Finally, the array of Threads */
SYSTEM_THREAD_INFORMATION TH[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
#endif
// SystemModuleInformation (11)
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY {
ULONG Unknown1;
@ -1300,69 +1320,6 @@ struct _SYSTEM_PATH_INFORMATION
} SYSTEM_PATH_INFORMATION, * PSYSTEM_PATH_INFORMATION;
// SystemProcessInformation (5)
#ifndef __USE_W32API
typedef struct _SYSTEM_THREADS {
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
ULONG State;
KWAIT_REASON WaitReason;
} SYSTEM_THREADS, *PSYSTEM_THREADS;
#endif /* __USE_W32API */
typedef struct _SYSTEM_PROCESSES_NT4
{
SIZE_T NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
SYSTEM_THREADS Threads[ANYSIZE_ARRAY];
} SYSTEM_PROCESSES_NT4, *PSYSTEM_PROCESSES_NT4;
typedef struct _SYSTEM_PROCESSES_NT5
{
SIZE_T NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREADS Threads[ANYSIZE_ARRAY];
} SYSTEM_PROCESSES_NT5, *PSYSTEM_PROCESSES_NT5;
#ifndef __USE_W32API
/* Not sure. What version are we emulating? */
typedef SYSTEM_PROCESSES_NT5 SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
#endif /* __USE_W32API */
// SystemCallCountInformation (6)
typedef

View file

@ -349,14 +349,13 @@ else
Buf->Unknown[0] = (ULONG)NtCurrentProcess();
ClientId.UniqueThread = INVALID_HANDLE_VALUE;
ClientId.UniqueThread = 0;
ClientId.UniqueProcess = (HANDLE)ProcessId;
ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
ObjectAttributes.RootDirectory = (HANDLE)NULL;
ObjectAttributes.SecurityDescriptor = NULL;
ObjectAttributes.SecurityQualityOfService = NULL;
ObjectAttributes.ObjectName = NULL;
ObjectAttributes.Attributes = 0;
InitializeObjectAttributes(&ObjectAttributes,
NULL,
0,
NULL,
NULL);
Status = NtOpenProcess( &hProcess,
(PROCESS_ALL_ACCESS),

View file

@ -71,7 +71,7 @@ typedef struct _ENUM_PROCESSES_CONTEXT
} ENUM_PROCESSES_CONTEXT, *PENUM_PROCESSES_CONTEXT;
NTSTATUS STDCALL
EnumProcessesCallback(IN PSYSTEM_PROCESSES CurrentProcess,
EnumProcessesCallback(IN PSYSTEM_PROCESS_INFORMATION CurrentProcess,
IN OUT PVOID CallbackContext)
{
PENUM_PROCESSES_CONTEXT Context = (PENUM_PROCESSES_CONTEXT)CallbackContext;
@ -83,7 +83,7 @@ EnumProcessesCallback(IN PSYSTEM_PROCESSES CurrentProcess,
}
/* return current process */
*Context->lpidProcess = (DWORD)CurrentProcess->ProcessId;
*Context->lpidProcess = (DWORD)CurrentProcess->UniqueProcessId;
/* go to next array slot */
Context->lpidProcess++;

View file

@ -264,48 +264,16 @@ typedef struct _VM_COUNTERS {
} VM_COUNTERS;
typedef enum _THREAD_STATE {
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
Initialized,
Ready,
Running,
Standby,
Terminated,
Wait,
Transition,
DeferredReady
} THREAD_STATE;
typedef struct _SYSTEM_THREADS {
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
THREAD_STATE State;
KWAIT_REASON WaitReason;
} SYSTEM_THREADS, *PSYSTEM_THREADS;
typedef struct _SYSTEM_PROCESSES {
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREADS Threads[1];
} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;
typedef struct _SYSTEM_CALLS_INFORMATION {
ULONG Size;
ULONG NumberOfDescriptorTables;
@ -659,6 +627,7 @@ typedef struct _SYSTEM_MEMORY_USAGE_INFORMATION {
SYSTEM_MEMORY_USAGE MemoryUsage[1];
} SYSTEM_MEMORY_USAGE_INFORMATION, *PSYSTEM_MEMORY_USAGE_INFORMATION;
// SystemProcessThreadInfo (5)
typedef struct _SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime;
@ -671,10 +640,10 @@ typedef struct _SYSTEM_THREAD_INFORMATION
LONG BasePriority;
ULONG ContextSwitches;
ULONG ThreadState;
KWAIT_REASON WaitReason;
ULONG WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;
typedef struct SYSTEM_PROCESS_INFORMATION
typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG NextEntryOffset;
ULONG NumberOfThreads;
@ -685,12 +654,17 @@ typedef struct SYSTEM_PROCESS_INFORMATION
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
ULONG BasePriority;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
ULONG HandleCount;
ULONG SessionId;
ULONG SpareUl3;
ULONG PageDirectoryFrame;
/*
* This part corresponds to VM_COUNTERS_EX.
* NOTE: *NOT* THE SAME AS VM_COUNTERS!
*/
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
@ -702,7 +676,18 @@ typedef struct SYSTEM_PROCESS_INFORMATION
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
ULONG PrivatePageCount;
ULONG PrivateUsage;
/* This part corresponds to IO_COUNTERS */
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
/* Finally, the array of Threads */
SYSTEM_THREAD_INFORMATION TH[1];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
NTOSAPI