admin/hakril-PythonForWindows
1
0
Fork 0
mirror of https://github.com/hakril/PythonForWindows synced 2026-06-08 14:31:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added a custom version of SYSTEM_PROCESS_INFORMATION

Browse Source
This commit is contained in:
clement rouault
2021-06-22 19:02:45 +02:00
parent 5fdcbee121
commit 6552312275
3 changed files with 197 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ctypes_generation/definitions/structures/system_info.txt
+71
View File
@@ -0,0 +1,71 @@
/* Based on
winternl.h
&
https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
*/
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[24];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ImageName;
LONG BasePriority;
HANDLE UniqueProcessId;
PVOID InheritedFromUniqueProcessId;
ULONG HandleCount;
BYTE Reserved4[4];
PVOID Reserved5[1];
PVOID PeakVirtualSize;
PVOID VirtualSize;
PVOID PageFaultCount;
PVOID PeakWorkingSetSize;
PVOID WorkingSetSize;
PVOID QuotaPeakPagedPoolUsage;
PVOID QuotaPagedPoolUsage;
PVOID QuotaPeakNonPagedPoolUsage;
PVOID QuotaNonPagedPoolUsage;
PVOID PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER Reserved1[2];
ULONG Reserved2;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;
typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION {
ULONG RegistryQuotaAllowed;
ULONG RegistryQuotaUsed;
PVOID Reserved1;
} SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION;
typedef struct _SYSTEM_BASIC_INFORMATION {
BYTE Reserved1[24];
PVOID Reserved2[4];
CHAR NumberOfProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;
typedef struct _SYSTEM_PROCESS_INFORMATION_ORIG {
ULONG NextEntryOffset;
BYTE Reserved1[52];
PVOID Reserved2[3];
HANDLE UniqueProcessId;
PVOID Reserved3;
ULONG HandleCount;
BYTE Reserved4[4];
PVOID Reserved5[11];
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION_ORIG, *PSYSTEM_PROCESS_INFORMATION_ORIG;
tests/test_generated_def.py
+48
View File
@@ -12,9 +12,13 @@ def assert_struct_offset(struct, field, offset):
if windows.current_process.bitness == 32:
PEB32 = windows.generated_def.PEB
PEB64 = rctypes.transform_type_to_remote64bits(windows.generated_def.PEB)
SYSTEM_PROCESS_INFORMATION32 = windows.generated_def.SYSTEM_PROCESS_INFORMATION
SYSTEM_PROCESS_INFORMATION64 = rctypes.transform_type_to_remote64bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION)
else:
PEB32 = rctypes.transform_type_to_remote32bits(windows.generated_def.PEB)
PEB64 = windows.generated_def.PEB
SYSTEM_PROCESS_INFORMATION32 = rctypes.transform_type_to_remote32bits(windows.generated_def.SYSTEM_PROCESS_INFORMATION)
SYSTEM_PROCESS_INFORMATION64 = windows.generated_def.SYSTEM_PROCESS_INFORMATION
def test_peb32_fields():
assert_peb_offset = lambda field, offset: assert_struct_offset(PEB32, field, offset)
@@ -49,6 +53,50 @@ def test_peb64_fields():
assert_peb_offset("CSDVersion", 0x02E8)
assert_peb_offset("MinimumStackCommit", 0x0318)
def test_system_process_information32_fields():
assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION32, field, offset)
# Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
# And some symbol files :)
assert_spi_offset("NextEntryOffset", 0)
assert_spi_offset('NumberOfThreads', 4)
assert_spi_offset('CreateTime', 0x20)
assert_spi_offset('UserTime', 0x28)
assert_spi_offset('KernelTime', 0x30)
assert_spi_offset('ImageName', 0x38)
assert_spi_offset('BasePriority', 0x40)
assert_spi_offset('UniqueProcessId', 0x44)
assert_spi_offset('InheritedFromUniqueProcessId', 0x48)
assert_spi_offset('PeakVirtualSize', 0x58)
assert_spi_offset('VirtualSize', 0x5C)
assert_spi_offset('PageFaultCount', 0x60)
assert_spi_offset('PeakWorkingSetSize', 0x64)
assert_spi_offset('WorkingSetSize', 0x68)
assert_spi_offset('PagefileUsage', 0x7C)
assert_spi_offset('PeakPagefileUsage', 0x80)
def test_system_process_information64_fields():
assert_spi_offset = lambda field, offset: assert_struct_offset(SYSTEM_PROCESS_INFORMATION64, field, offset)
# Mainly based on https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/process.htm
# And some symbol files :)
assert_spi_offset("NextEntryOffset", 0)
assert_spi_offset('NumberOfThreads', 4)
assert_spi_offset('CreateTime', 0x20)
assert_spi_offset('UserTime', 0x28)
assert_spi_offset('KernelTime', 0x30)
assert_spi_offset('ImageName', 0x38)
assert_spi_offset('BasePriority', 0x48)
assert_spi_offset('UniqueProcessId', 0x50)
assert_spi_offset('InheritedFromUniqueProcessId', 0x58)
assert_spi_offset('PeakVirtualSize', 0x70)
assert_spi_offset('VirtualSize', 0x78)
assert_spi_offset('PageFaultCount', 0x80)
assert_spi_offset('PeakWorkingSetSize', 0x88)
assert_spi_offset('WorkingSetSize', 0x90)
assert_spi_offset('PagefileUsage', 0xB8)
assert_spi_offset('PeakPagefileUsage', 0xC0)
def test_cs_custom_define():
assert windows.generated_def.CS_USER_32B == 0x23
assert windows.generated_def.CS_USER_64B == 0x33
windows/generated_def/winstructs.py
+78
View File
@@ -9331,6 +9331,84 @@ PEXPLICIT_ACCESSW = POINTER(_EXPLICIT_ACCESS_W)
PEXPLICIT_ACCESS_W = POINTER(_EXPLICIT_ACCESS_W)
EXPLICIT_ACCESS_W = _EXPLICIT_ACCESS_W
class _SYSTEM_PROCESS_INFORMATION(Structure):
_fields_ = [
("NextEntryOffset", ULONG),
("NumberOfThreads", ULONG),
("Reserved1", BYTE * (24)),
("CreateTime", LARGE_INTEGER),
("UserTime", LARGE_INTEGER),
("KernelTime", LARGE_INTEGER),
("ImageName", UNICODE_STRING),
("BasePriority", LONG),
("UniqueProcessId", HANDLE),
("InheritedFromUniqueProcessId", PVOID),
("HandleCount", ULONG),
("Reserved4", BYTE * (4)),
("Reserved5", PVOID * (1)),
("PeakVirtualSize", PVOID),
("VirtualSize", PVOID),
("PageFaultCount", PVOID),
("PeakWorkingSetSize", PVOID),
("WorkingSetSize", PVOID),
("QuotaPeakPagedPoolUsage", PVOID),
("QuotaPagedPoolUsage", PVOID),
("QuotaPeakNonPagedPoolUsage", PVOID),
("QuotaNonPagedPoolUsage", PVOID),
("PagefileUsage", PVOID),
("PeakPagefileUsage", SIZE_T),
("PrivatePageCount", SIZE_T),
("Reserved6", LARGE_INTEGER * (6)),
]
SYSTEM_PROCESS_INFORMATION = _SYSTEM_PROCESS_INFORMATION
PSYSTEM_PROCESS_INFORMATION = POINTER(_SYSTEM_PROCESS_INFORMATION)
class _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION(Structure):
_fields_ = [
("IdleTime", LARGE_INTEGER),
("KernelTime", LARGE_INTEGER),
("UserTime", LARGE_INTEGER),
("Reserved1", LARGE_INTEGER * (2)),
("Reserved2", ULONG),
]
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = POINTER(_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)
class _SYSTEM_REGISTRY_QUOTA_INFORMATION(Structure):
_fields_ = [
("RegistryQuotaAllowed", ULONG),
("RegistryQuotaUsed", ULONG),
("Reserved1", PVOID),
]
SYSTEM_REGISTRY_QUOTA_INFORMATION = _SYSTEM_REGISTRY_QUOTA_INFORMATION
PSYSTEM_REGISTRY_QUOTA_INFORMATION = POINTER(_SYSTEM_REGISTRY_QUOTA_INFORMATION)
class _SYSTEM_BASIC_INFORMATION(Structure):
_fields_ = [
("Reserved1", BYTE * (24)),
("Reserved2", PVOID * (4)),
("NumberOfProcessors", CHAR),
]
PSYSTEM_BASIC_INFORMATION = POINTER(_SYSTEM_BASIC_INFORMATION)
SYSTEM_BASIC_INFORMATION = _SYSTEM_BASIC_INFORMATION
class _SYSTEM_PROCESS_INFORMATION_ORIG(Structure):
_fields_ = [
("NextEntryOffset", ULONG),
("Reserved1", BYTE * (52)),
("Reserved2", PVOID * (3)),
("UniqueProcessId", HANDLE),
("Reserved3", PVOID),
("HandleCount", ULONG),
("Reserved4", BYTE * (4)),
("Reserved5", PVOID * (11)),
("PeakPagefileUsage", SIZE_T),
("PrivatePageCount", SIZE_T),
("Reserved6", LARGE_INTEGER * (6)),
]
SYSTEM_PROCESS_INFORMATION_ORIG = _SYSTEM_PROCESS_INFORMATION_ORIG
PSYSTEM_PROCESS_INFORMATION_ORIG = POINTER(_SYSTEM_PROCESS_INFORMATION_ORIG)
class _TIME_ZONE_INFORMATION(Structure):
_fields_ = [
("Bias", LONG),