admin/zodiacon-winnativeapibooksamples
1
0
Fork 0
mirror of https://github.com/zodiacon/winnativeapibooksamples synced 2026-06-08 18:39:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

using updated phnt headers

Browse Source 
minor fixes
This commit is contained in:
Pavel Yosifovich
2025-04-04 16:28:15 -04:00
parent ef3a8ac19e
commit a1d445026a
3 changed files with 21 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Chapter07/AllObjects/AllObjects.cpp
+6 -2
View File
@@ -12,6 +12,10 @@ int main() {
while ((status = NtQuerySystemInformation(SystemObjectInformation, buffer.get(), size, nullptr)) == STATUS_INFO_LENGTH_MISMATCH) {
size *= 2;
buffer = std::make_unique<BYTE[]>(size);
if (!buffer) {
printf("Out of memory!\n");
return -1;
}
}
if (!NT_SUCCESS(status)) {
printf("Object tracking is not turned on.\n");
@@ -20,12 +24,12 @@ int main() {
auto type = (SYSTEM_OBJECTTYPE_INFORMATION*)buffer.get();
for(;;) {
printf("%wZ O: %u H: %u\n",
printf("%wZ O: %lu H: %lu\n",
&type->TypeName, type->NumberOfObjects, type->NumberOfHandles);
auto obj = (SYSTEM_OBJECT_INFORMATION*)((PBYTE)type + sizeof(*type) + type->TypeName.MaximumLength);
for (;;) {
printf("0x%p (%wZ) P: 0x%X H: %u PID: %u EPID: %u\n",
printf("0x%p (%wZ) P: %ld H: %ld PID: %ld EPID: %ld\n",
obj->Object, &obj->NameInfo, obj->PointerCount, obj->HandleCount,
HandleToULong(obj->CreatorUniqueProcess), HandleToULong(obj->ExclusiveProcessId));
if (obj->NextEntryOffset == 0)
Chapter08/Heaps/Heaps.cpp
+12 -36
View File
@@ -5,6 +5,15 @@
#pragma comment(lib, "ntdll")
#define HEAP_RANGE_TYPE_COMMITTED 1
#define HEAP_RANGE_TYPE_RESERVED 2
#define HEAP_BLOCK_BUSY 1
#define HEAP_BLOCK_EXTRA_INFORMATION 2
#define HEAP_BLOCK_LARGE_BLOCK 4
#define HEAP_BLOCK_LFH_BLOCK 8
typedef enum _HEAP_INFORMATION_LEVEL {
HEAP_INFORMATION_LEVEL_PROCESS = 1,
HEAP_INFORMATION_LEVEL_HEAP = 2,
@@ -19,39 +28,6 @@ typedef enum _HEAP_INFORMATION_LEVEL {
HEAP_INFORMATION_LEVEL_INTERNAL_PROCESS_INFO = 0x08000000,
} HEAP_INFORMATION_LEVEL;
typedef struct _HEAP_REGION_INFORMATION {
ULONG_PTR Address;
SIZE_T ReserveSize;
SIZE_T CommitSize;
ULONG_PTR FirstRangeInformationOffset;
ULONG_PTR NextRegionInformationOffset;
} HEAP_REGION_INFORMATION, * PHEAP_REGION_INFORMATION;
#define HEAP_RANGE_TYPE_COMMITTED 1
#define HEAP_RANGE_TYPE_RESERVED 2
typedef struct _HEAP_RANGE_INFORMATION {
ULONG_PTR Address;
SIZE_T Size;
ULONG Type;
ULONG Protection;
ULONG_PTR FirstBlockInformationOffset;
ULONG_PTR NextRangeInformationOffset;
} HEAP_RANGE_INFORMATION, * PHEAP_RANGE_INFORMATION;
#define HEAP_BLOCK_BUSY 1
#define HEAP_BLOCK_EXTRA_INFORMATION 2
#define HEAP_BLOCK_LARGE_BLOCK 4
#define HEAP_BLOCK_LFH_BLOCK 8
typedef struct _HEAP_BLOCK_INFORMATION {
ULONG_PTR Address;
ULONG Flags; // see flags above
SIZE_T DataSize;
SIZE_T OverheadSize;
ULONG_PTR NextBlockInformationOffset;
} HEAP_BLOCK_INFORMATION, * PHEAP_BLOCK_INFORMATION;
const char* RangeTypeToString(ULONG type) {
switch (type) {
case HEAP_RANGE_TYPE_COMMITTED: return "Committed";
@@ -162,7 +138,7 @@ bool DumpHeaps(HANDLE hProcess, ULONG level) {
for (;;) {
buffer = std::make_unique<BYTE[]>(size);
info = (HEAP_EXTENDED_INFORMATION*)buffer.get();
info->Process = hProcess;
info->ProcessHandle = hProcess;
info->Level = level;
status = RtlQueryHeapInformation(nullptr, (HEAP_INFORMATION_CLASS)HeapExtendedInformation, buffer.get(), size, &len);
if (NT_SUCCESS(status))
@@ -178,12 +154,12 @@ bool DumpHeaps(HANDLE hProcess, ULONG level) {
auto hi = (HEAP_INFORMATION*)(buffer.get() + info->ProcessHeapInformation.FirstHeapInformationOffset);
auto heaps = info->ProcessHeapInformation.NumberOfHeaps;
printf("Total heaps: %u Commit: 0x%zX Reserved: 0x%zX\n",
printf("Total heaps: %lu Commit: 0x%zX Reserved: 0x%zX\n",
heaps, info->ProcessHeapInformation.CommitSize, info->ProcessHeapInformation.ReserveSize);
for (ULONG i = 0; i < heaps; i++) {
printf("Heap %2d: Addr: 0x%p Commit: 0x%08zX Reserve: 0x%08zX %s\n", i + 1,
(PVOID)hi->Address, hi->CommitSize, hi->ReserveSize, hi->Mode ? "(LFH)" : "");
hi->Address, hi->CommitSize, hi->ReserveSize, hi->Mode ? "(LFH)" : "");
DisplayRegions(buffer.get(), hi);
hi = (HEAP_INFORMATION*)(buffer.get() + hi->NextHeapInformationOffset);
}
Chapter08/QueryVM/QueryVM.cpp
+3 -3
View File
@@ -57,7 +57,7 @@ std::wstring MemoryRegionFlagsToString(ULONG flags) {
const char* StateToString(DWORD state) {
switch (state) {
case MEM_FREE: return "Free";
case MEM_FREE: return "Free";
case MEM_COMMIT: return "Committed";
case MEM_RESERVE: return "Reserved";
}
@@ -66,7 +66,7 @@ const char* StateToString(DWORD state) {
const char* TypeToString(DWORD type) {
switch (type) {
case MEM_IMAGE: return "Image";
case MEM_IMAGE: return "Image";
case MEM_MAPPED: return "Mapped";
case MEM_PRIVATE: return "Private";
}
@@ -169,7 +169,7 @@ std::wstring Details(HANDLE hProcess, MEMORY_BASIC_INFORMATION const& mbi) {
MEMORY_WORKING_SET_EX_INFORMATION ws;
ws.VirtualAddress = mbi.BaseAddress;
if (NT_SUCCESS(NtQueryVirtualMemory(hProcess, nullptr, MemoryWorkingSetExInformation, &ws, sizeof(ws), nullptr))) {
details += VirtualAttributesToString(ws.u1.VirtualAttributes);
details += VirtualAttributesToString(ws.VirtualAttributes);
}
//MEMORY_PHYSICAL_CONTIGUITY_INFORMATION pm{};