今天，我们主要讨论的是一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然，你不要小看这么一个函数，它却为我们提供了丰富的系统信息，同时还包
括对某些信息的控制和设置。以下是这个函数的原型：typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL); NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;从中可以看到，SystemInformationClass是一个类型信息，它大概提供了50余种信息，也就是我们可以通过这个函数对大约50多种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针，它为我们提供需要获得的信息，或是我们需要设置的系统信息。SystemInformationLength是SystemInformation的长度，它根据探测的信息类型来决
定。至于ReturnLength则是系统返回的需要的长度，通常可以设置为空指针(NULL)。首先，我们来看看大家比较熟悉的系统进程/线程相关的信息。这个题目在网上已经讨论了N多年了，所以我就不在老生常谈了，呵呵。那么就提出这个结构类型的定义：
typedef struct _SYSTEM_PROCESSES
{ ULONG NextEntryDelta; //构成结构序列的偏移量； ULONG ThreadCount; //线程数目； ULONG Reserved1[6]; LARGE_INTEGER CreateTime; //创建时间； LARGE_INTEGER UserTime; //用户模式(Ring 3)的CPU时间； LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间； UNICODE_STRING ProcessName; //进程名称； KPRIORITY BasePriority; //进程优先权； ULONG ProcessId; //进程标识符； ULONG InheritedFromProcessId; //父进程的标识符； ULONG HandleCount; //句柄数目； ULONG Reserved2[2]; VM_COUNTERS VmCounters; //虚拟存储器的结构，见下； IO_COUNTERS IoCounters; //IO计数结构，见下； SYSTEM_THREADS Threads[1]; //进程相关线程的结构数组，见下； }SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;typedef struct _SYSTEM_THREADS
{ LARGE_INTEGER KernelTime; //CPU内核模式使用时间； LARGE_INTEGER UserTime; //CPU用户模式使用时间； LARGE_INTEGER CreateTime; //线程创建时间； ULONG WaitTime; //等待时间； PVOID StartAddress; //线程开始的虚拟地址； CLIENT_ID ClientId; //线程标识符； KPRIORITY Priority; //线程优先级； KPRIORITY BasePriority; //基本优先级； ULONG ContextSwitchCount; //环境切换数目； THREAD_STATE State; //当前状态； KWAIT_REASON WaitReason; //等待原因； }SYSTEM_THREADS,*PSYSTEM_THREADS;typedef struct _VM_COUNTERS
{ ULONG PeakVirtualSize; //虚拟存储峰值大小； ULONG VirtualSize; //虚拟存储大小； ULONG PageFaultCount; //页故障数目； ULONG PeakWorkingSetSize; //工作集峰值大小； ULONG WorkingSetSize; //工作集大小； ULONG QuotaPeakPagedPoolUsage; //分页池使用配额峰值； ULONG QuotaPagedPoolUsage; //分页池使用配额； ULONG QuotaPeakNonPagedPoolUsage; //非分页池使用配额峰值； ULONG QuotaNonPagedPoolUsage; //非分页池使用配额； ULONG PagefileUsage; //页文件使用情况； ULONG PeakPagefileUsage; //页文件使用峰值； }VM_COUNTERS,*PVM_COUNTERS;typedef struct _IO_COUNTERS
{ LARGE_INTEGER ReadOperationCount; //I/O读操作数目； LARGE_INTEGER WriteOperationCount; //I/O写操作数目； LARGE_INTEGER OtherOperationCount; //I/O其他操作数目； LARGE_INTEGER ReadTransferCount; //I/O读数据数目； LARGE_INTEGER WriteTransferCount; //I/O写数据数目； LARGE_INTEGER OtherTransferCount; //I/O其他操作数据数目； }IO_COUNTERS,*PIO_COUNTERS;以上这些信息应该是比较全面的了，在Win32 API里为我们提供了PSAPI(进程状态)和ToolHelp32这两种探测系统进程/线程信息的方式，在Windows2K/XP/2003都支持它们。
现在，我们来看看系统的性能信息，性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70余种系统性能方面的信息，真是太丰富了，请慢慢体会~typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{ LARGE_INTEGER IdleTime; //CPU空闲时间； LARGE_INTEGER ReadTransferCount; //I/O读操作数目； LARGE_INTEGER WriteTransferCount; //I/O写操作数目； LARGE_INTEGER OtherTransferCount; //I/O其他操作数目； ULONG ReadOperationCount; //I/O读数据数目； ULONG WriteOperationCount; //I/O写数据数目； ULONG OtherOperationCount; //I/O其他操作数据数目； ULONG AvailablePages; //可获得的页数目； ULONG TotalCommittedPages; //总共提交页数目； ULONG TotalCommitLimit; //已提交页数目； ULONG PeakCommitment; //页提交峰值； ULONG PageFaults; //页故障数目； ULONG WriteCopyFaults; //Copy-On-Write故障数目； ULONG TransitionFaults; //软页故障数目； ULONG Reserved1; ULONG DemandZeroFaults; //需求0故障数； ULONG PagesRead; //读页数目； ULONG PageReadIos; //读页I/O操作数； ULONG Reserved2[2]; ULONG PagefilePagesWritten; //已写页文件页数； ULONG PagefilePageWriteIos; //已写页文件操作数； ULONG MappedFilePagesWritten; //已写映射文件页数； ULONG MappedFileWriteIos; //已写映射文件操作数； ULONG PagedPoolUsage; //分页池使用； ULONG NonPagedPoolUsage; //非分页池使用； ULONG PagedPoolAllocs; //分页池分配情况； ULONG PagedPoolFrees; //分页池释放情况； ULONG NonPagedPoolAllocs; //非分页池分配情况； ULONG NonPagedPoolFress; //非分页池释放情况； ULONG TotalFreeSystemPtes; //系统页表项释放总数； ULONG SystemCodePage; //操作系统代码页数； ULONG TotalSystemDriverPages; //可分页驱动程序页数； ULONG TotalSystemCodePages; //操作系统代码页总数； ULONG SmallNonPagedLookasideListAllocateHits; // ULONG SmallPagedLookasideListAllocateHits; ULONG Reserved3; ULONG MmSystemCachePage; //系统缓存页数； ULONG PagedPoolPage; //分页池页数； ULONG SystemDriverPage; //可分页驱动页数； ULONG FastReadNoWait; //异步快速读数目； ULONG FastReadWait; //同步快速读数目； ULONG FastReadResourceMiss; //快速读资源冲突数； ULONG FastReadNotPossible; //快速读失败数； ULONG FastMdlReadNoWait; //异步MDL快速读数目； ULONG FastMdlReadWait; //同步MDL快速读数目； ULONG FastMdlReadResourceMiss; //MDL读资源冲突数； ULONG FastMdlReadNotPossible; //MDL读失败数； ULONG MapDataNoWait; //异步映射数据次数； ULONG MapDataWait; //同步映射数据次数； ULONG MapDataNoWaitMiss; //异步映射数据冲突次数； ULONG MapDataWaitMiss; //同步映射数据冲突次数； ULONG PinMappedDataCount; //牵制映射数据数目； ULONG PinReadNoWait; //牵制异步读数目； ULONG PinReadWait; //牵制同步读数目； ULONG PinReadNoWaitMiss; //牵制异步读冲突数目； ULONG PinReadWaitMiss; //牵制同步读冲突数目； ULONG CopyReadNoWait; //异步拷贝读次数； ULONG CopyReadWait; //同步拷贝读次数； ULONG CopyReadNoWaitMiss; //异步拷贝读故障次数； ULONG CopyReadWaitMiss; //同步拷贝读故障次数； ULONG MdlReadNoWait; //异步MDL读次数； ULONG MdlReadWait; //同步MDL读次数； ULONG MdlReadNoWaitMiss; //异步MDL读故障次数； ULONG MdlReadWaitMiss; //同步MDL读故障次数； ULONG ReadAheadIos; //向前读操作数目； ULONG LazyWriteIos; //LAZY写操作数目； ULONG LazyWritePages; //LAZY写页文件数目； ULONG DataFlushes; //缓存刷新次数； ULONG DataPages; //缓存刷新页数； ULONG ContextSwitches; //环境切换数目； ULONG FirstLevelTbFills; //第一层缓冲区填充次数； ULONG SecondLevelTbFills; //第二层缓冲区填充次数； ULONG SystemCall; //系统调用次数； }SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;现在看到的是结构SYSTEM_PROCESSOR_TIMES提供的系统处理器的使用情况，包括各种情况下的使用时间及中断数目：
typedef struct __SYSTEM_PROCESSOR_TIMES
{ LARGE_INTEGER IdleTime; //空闲时间； LARGE_INTEGER KernelTime; //内核模式时间； LARGE_INTEGER UserTime; //用户模式时间； LARGE_INTEGER DpcTime; //延迟过程调用时间； LARGE_INTEGER InterruptTime; //中断时间； ULONG InterruptCount; //中断次数； }SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;页文件的使用情况，SYSTEM_PAGEFILE_INFORMATION提供了所需的相关信息：
typedef struct _SYSTEM_PAGEFILE_INFORMATION
{ ULONG NetxEntryOffset; //下一个结构的偏移量； ULONG CurrentSize; //当前页文件大小； ULONG TotalUsed; //当前使用的页文件数； ULONG PeakUsed; //当前使用的页文件峰值数； UNICODE_STRING FileName; //页文件的文件名称； }SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;系统高速缓存的使用情况参见结构SYSTEM_CACHE_INFORMATION提供的信息：
typedef struct _SYSTEM_CACHE_INFORMATION
{ ULONG SystemCacheWsSize; //高速缓存大小； ULONG SystemCacheWsPeakSize; //高速缓存峰值大小； ULONG SystemCacheWsFaults; //高速缓存页故障数目； ULONG SystemCacheWsMinimum; //高速缓存最小页大小； ULONG SystemCacheWsMaximum; //高速缓存最大页大小； ULONG TransitionSharedPages; //共享页数目； ULONG TransitionSharedPagesPeak; //共享页峰值数目； ULONG Reserved[2]; }SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;附录：(所有完整源代码，您可以到我们FZ5FZ的主页下载)。
1.T-PMList的头文件源代码：
#ifndef T_PMLIST_H
#define T_PMLIST_H#include <windows.h>
#include <stdio.h>#define NT_PROCESSTHREAD_INFO 0x05
#define MAX_INFO_BUF_LEN 0x500000#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)typedef LONG NTSTATUS;
typedef struct _LSA_UNICODE_STRING
{ USHORT Length;USHORT MaximumLength;PWSTR Buffer;}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;typedef struct _CLIENT_ID
{ HANDLE UniqueProcess;HANDLE UniqueThread;}CLIENT_ID;typedef CLIENT_ID *PCLIENT_ID;typedef LONG KPRIORITY;
typedef struct _VM_COUNTERS
{ ULONG PeakVirtualSize;ULONG VirtualSize;ULONG PageFaultCount;ULONG PeakWorkingSetSize;ULONG WorkingSetSize;ULONG QuotaPeakPagedPoolUsage;ULONG QuotaPagedPoolUsage;ULONG QuotaPeakNonPagedPoolUsage;ULONG QuotaNonPagedPoolUsage;ULONG PagefileUsage;ULONG PeakPagefileUsage;}VM_COUNTERS,*PVM_COUNTERS;typedef struct _IO_COUNTERS
{ LARGE_INTEGER ReadOperationCount;LARGE_INTEGER WriteOperationCount;LARGE_INTEGER OtherOperationCount;LARGE_INTEGER ReadTransferCount;LARGE_INTEGER WriteTransferCount;LARGE_INTEGER OtherTransferCount;}IO_COUNTERS,*PIO_COUNTERS;typedef enum _THREAD_STATE
{ StateInitialized,StateReady,StateRunning,StateStandby,StateTerminated,StateWait,StateTransition,StateUnknown}THREAD_STATE;typedef enum _KWAIT_REASON
{ Executive,FreePage,PageIn,PoolAllocation,DelayExecution,Suspended,UserRequest,WrExecutive,WrFreePage,WrPageIn,WrPoolAllocation,WrDelayExecution,WrSuspended,WrUserRequest,WrEventPair,WrQueue,WrLpcReceive,WrLpcReply,WrVertualMemory,WrPageOut,WrRendezvous,Spare2,Spare3,Spare4,Spare5,Spare6,WrKernel}KWAIT_REASON;typedef struct _SYSTEM_THREADS
{ LARGE_INTEGER KernelTime;LARGE_INTEGER UserTime;LARGE_INTEGER CreateTime;ULONG WaitTime;PVOID StartAddress;CLIENT_ID ClientId;KPRIORITY Priority;KPRIORITY BasePriority;ULONG ContextSwitchCount;THREAD_STATE State;KWAIT_REASON WaitReason;}SYSTEM_THREADS,*PSYSTEM_THREADS;typedef struct _SYSTEM_PROCESSES
{ ULONG NextEntryDelta;ULONG ThreadCount;ULONG Reserved1[6];LARGE_INTEGER CreateTime;LARGE_INTEGER UserTime;LARGE_INTEGER KernelTime;UNICODE_STRING ProcessName;KPRIORITY BasePriority;ULONG ProcessId;ULONG InheritedFromProcessId;ULONG HandleCount;ULONG Reserved2[2];VM_COUNTERS VmCounters;IO_COUNTERS IoCounters;SYSTEM_THREADS Threads[1];}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;typedef DWORD SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION) (IN SYSTEM_INFORMATION_CLASS, IN OUT PVOID, IN ULONG, OUT PULONG OPTIONAL);NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;DWORD EnumProcess()
{ PSYSTEM_PROCESSES pSystemProc;HMODULE hNtDll = NULL;LPVOID lpSystemInfo = NULL;DWORD dwNumberBytes = MAX_INFO_BUF_LEN;DWORD dwTotalProcess = 0;DWORD dwReturnLength;NTSTATUS Status; LONGLONG llTempTime;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL){ printf("LoadLibrary Error: %d\n",GetLastError()); __leave;}NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation"); if(NtQuerySystemInformation == NULL){ printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError()); __leave;}lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO, lpSystemInfo,dwNumberBytes,&dwReturnLength);if(Status == STATUS_INFO_LENGTH_MISMATCH){ printf("STATUS_INFO_LENGTH_MISMATCH\n");__leave;}else if(Status != STATUS_SUCCESS){ printf("NtQuerySystemInformation Error: %d\n",GetLastError());__leave;}printf("%-20s%6s%7s%8s%6s%7s%7s%13s\n","ProcessName","PID","PPID","WsSize","
Prio.","Thread","Handle","CPU Time");printf("--------------------------------------------------------------------------\n");pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;while(pSystemProc->NextEntryDelta != 0){ if(pSystemProc->ProcessId != 0){ wprintf(L"%-20s",pSystemProc->ProcessName.Buffer);}else{ wprintf(L"%-20s",L"System Idle Process");}printf("%6d",pSystemProc->ProcessId);printf("%7d",pSystemProc->InheritedFromProcessId);printf("%7dK",pSystemProc->VmCounters.WorkingSetSize/1024);printf("%6d",pSystemProc->BasePriority);printf("%7d",pSystemProc->ThreadCount);printf("%7d",pSystemProc->HandleCount);llTempTime = pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart;llTempTime /= 10000;printf("%3d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d",llTempTime);printf("\n");
dwTotalProcess ++;pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);}printf("--------------------------------------------------------------------------\n");printf("\nTotal %d Process(es) !\n\n",dwTotalProcess);printf("PID\t ==> Process Identification\n");printf("PPID\t ==> Parent Process Identification\n");printf("WsSize\t ==> Working Set Size\n");printf("Prio.\t ==> Base Priority\n");printf("Thread\t ==> Thread Count\n");printf("Handle\t ==> Handle Count\n");printf("CPU Time ==> Processor Time\n");}__finally{ if(lpSystemInfo != NULL){ free(lpSystemInfo);}if(hNtDll != NULL){ FreeLibrary(hNtDll);}}return 0;
}DWORD SpeciProcess(DWORD dwPID)
{ PSYSTEM_PROCESSES pSystemProc = NULL;PSYSTEM_THREADS pSystemThre = NULL; HMODULE hNtDll = NULL;LPVOID lpSystemInfo = NULL;DWORD dwNumberBytes = MAX_INFO_BUF_LEN;DWORD dwTotalProcess = 0;DWORD dwReturnLength;NTSTATUS Status; LONGLONG llTempTime;ULONG ulIndex;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL){ printf("LoadLibrary Error: %d\n",GetLastError()); __leave;}NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation"); if(NtQuerySystemInformation == NULL){ printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError()); __leave;}lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO, lpSystemInfo,dwNumberBytes,&dwReturnLength);if(Status == STATUS_INFO_LENGTH_MISMATCH){ printf("STATUS_INFO_LENGTH_MISMATCH\n");__leave;}else if(Status != STATUS_SUCCESS){ printf("NtQuerySystemInformation Error: %d\n",GetLastError());__leave;}pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0){ if(pSystemProc->ProcessId == dwPID){ printf("ProcessName:\t\t ");if(pSystemProc->ProcessId != 0){ wprintf(L"%-20s\n",pSystemProc->ProcessName.Buffer);}else{ wprintf(L"%-20s\n",L"System Idle Process");}printf("ProcessID:\t\t %d\t\t",pSystemProc->ProcessId);printf("ParentProcessID:\t%d\n",pSystemProc->InheritedFromProcessId);printf("KernelTime:\t\t ");
llTempTime = pSystemProc->KernelTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\t",llTempTime);printf("UserTime:\t\t");
llTempTime = pSystemProc->UserTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("Privilege:\t\t %d%%\t\t",(pSystemProc->KernelTime.QuadPart * 100)/
(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));printf("User:\t\t\t%d%%\n",(pSystemProc->UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));printf("ThreadCount:\t\t %d\t\t",pSystemProc->ThreadCount);
printf("HandleCount:\t\t%d\n",pSystemProc->HandleCount);printf("BasePriority:\t\t %-2d\t\t",pSystemProc->BasePriority);
printf("PageFaultCount:\t\t%d\n\n",pSystemProc->VmCounters.PageFaultCount);printf("PeakWorkingSetSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakWorki
ngSetSize/1024);printf("WorkingSetSize(K):\t%-8d\n",pSystemProc->VmCounters.WorkingSetSize/1024);printf("PeakPagedPool(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakPaged
PoolUsage/1024);printf("PagedPool(K):\t\t%-8d\n",pSystemProc->VmCounters.QuotaPagedPoolUsage/1024);printf("PeakNonPagedPook(K):\t %-8d\t",pSystemProc->VmCounters.QuotaPeakNo
nPagedPoolUsage/1024);printf("NonePagedPook(K):\t%-8d\n",pSystemProc->VmCounters.QuotaNonPagedPoolUsage/1024);printf("PeakPagefile(K):\t %-8d\t",pSystemProc->VmCounters.PeakPagefileUsa
ge/1024);printf("Pagefile(K):\t\t%-8d\n",pSystemProc->VmCounters.PagefileUsage/1024);printf("PeakVirtualSize(K):\t %-8d\t",pSystemProc->VmCounters.PeakVirtualS
ize/1024);printf("VirtualSize(K):\t\t%-8d\n\n",pSystemProc->VmCounters.VirtualSize/1024);printf("ReadTransfer:\t\t %-8d\t",pSystemProc->IoCounters.ReadTransferCoun
t);printf("ReadOperationCount:\t%-8d\n",pSystemProc->IoCounters.ReadOperationCount);printf("WriteTransfer:\t\t %-8d\t",pSystemProc->IoCounters.WriteTransferCo
unt);printf("WriteOperationCount:\t%-8d\n",pSystemProc->IoCounters.WriteOperationCount);printf("OtherTransfer:\t\t %-8d\t",pSystemProc->IoCounters.OtherTransferCo
unt);printf("OtherOperationCount:\t%-8d\n\n",pSystemProc->IoCounters.OtherOperationCount);printf("%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n","TID","Pri","BPr","Priv",
"User","KernelTime","UserTime","StartAddr","CSwitC","State","WtReason"); printf("-------------------------------------------------------------------------------\n");for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
{ pSystemThre = &pSystemProc->Threads[ulIndex];printf("%-5d",pSystemProc->Threads[ulIndex].ClientId.UniqueThread);printf("%3d",pSystemProc->Threads[ulIndex].Priority);
printf("%4d",pSystemProc->Threads[ulIndex].BasePriority);printf("%4d%%",(pSystemProc->Threads[ulIndex].KernelTime.QuadPart * 10
0)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart)); printf("%4d%%",(pSystemProc->Threads[ulIndex].UserTime.QuadPart * 100)/(pSystemProc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));llTempTime = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
llTempTime /= 10000;printf("%2d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d.",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 100;printf("%.2d ",llTempTime);llTempTime = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
llTempTime /= 10000;printf("%2d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d.",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 100;printf("%.2d ",llTempTime);printf(" 0x%.8X",pSystemProc->Threads[ulIndex].StartAddress);
printf("%7d",pSystemProc->Threads[ulIndex].ContextSwitchCount);switch(pSystemProc->Threads[ulIndex].State)
{ case StateInitialized:printf("%6s","Init.");break;case StateReady:printf("%6s","Ready");break;case StateRunning:printf("%6s","Run");break;case StateStandby:printf("%6s","StBy.");break;case StateTerminated:printf("%6s","Term.");break;case StateWait:printf("%6s","Wait");break;case StateTransition:printf("%6s","Tran.");break;case StateUnknown:printf("%6s","Unkn.");break;default:printf("%6s","Unkn.");break;}switch(pSystemProc->Threads[ulIndex].WaitReason)
{ case Executive:printf(" %-8s","Executi.");break;case FreePage:printf(" %-8s","FreePag.");break;case PageIn:printf(" %-8s","PageIn");break;case PoolAllocation:printf(" %-8s","PoolAll.");break;case DelayExecution:printf(" %-8s","DelayEx.");break;case Suspended:printf(" %-8s","Suspend.");break;case UserRequest:printf(" %-8s","UserReq.");break;case WrExecutive:printf(" %-8s","WrExect.");break;case WrFreePage:printf(" %-8s","WrFrePg.");break;case WrPageIn:printf(" %-8s","WrPageIn");break;case WrPoolAllocation:printf(" %-8s","WrPoolA.");break;case WrSuspended:printf(" %-8s","WrSuspe.");break;case WrUserRequest:printf(" %-8s","WrUsReq.");break;case WrEventPair:printf(" %-8s","WrEvent.");break;case WrQueue:printf(" %-8s","WrQueue");break;case WrLpcReceive:printf(" %-8s","WrLpcRv.");break;case WrLpcReply:printf(" %-8s","WrLpcRp.");break;case WrVertualMemory:printf(" %-8s","WrVerMm.");break;case WrPageOut:printf(" %-8s","WrPgOut.");break;case WrRendezvous:printf(" %-8s","WrRende.");break;case WrKernel:printf(" %-8s","WrKernel");break;default:printf(" %-8s","Unknown");break;} printf("\n");} printf("-------------------------------------------------------------------------------\n\n"); printf("Total %d Thread(s) !\n\n",ulIndex);dwTotalProcess ++;
break;}pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc + pSystemProc->NextEntryDelta);}}__finally{ if(dwTotalProcess == 0){ printf("Could not found the %d Process !\n",dwPID);}else{ printf("TID:\t\t====>\tThread Identification\n");printf("Pri:\t\t====>\tPriority\n");printf("BPr:\t\t====>\tBase Priority\n");printf("Priv:\t\t====>\tPrivilege\n");printf("StartAddr:\t====>\tThread Start Address\n");printf("CSwitC:\t\t====>\tContext Switch Count\n");printf("WtReason:\t====>\tWait Reason\n");}if(lpSystemInfo != NULL){ free(lpSystemInfo);}if(hNtDll != NULL){ FreeLibrary(hNtDll);}}return 0;
}VOID Start()
{ printf("T-PMList, by TOo2y\n");printf("E-mail: ");printf("HomePage: ");printf("Date: 05-10-2003\n\n");return ;}VOID Usage()
{ printf("Usage:\tT-PMList [-e] | [-s PID]\n"); printf(" -e\t Enumerate All Processes\n");printf(" -s PID Show Special Process Information with PID\n\n");return ;}#endif
2.T-PMPerf的头文件源代码：
#ifndef T_PMPERF_H
#define T_PMPERF_H#include "windows.h"
#include "stdio.h"#define SYSTEM_PERF_INFO 0x02
#define SYSTEM_PROC_TIME 0x08#define SYSTEM_PAGE_INFO 0x12#define SYSTEM_CACHE_INFO 0x15#define MAX_INFO_BUF_LEN 0x500000#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)typedef LONG NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;typedef struct _LSA_UNICODE_STRING
{ USHORT Length;USHORT MaximumLength;PWSTR Buffer;}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{ LARGE_INTEGER IdleTime;LARGE_INTEGER ReadTransferCount;LARGE_INTEGER WriteTransferCount;LARGE_INTEGER OtherTransferCount;ULONG ReadOperationCount;ULONG WriteOperationCount;ULONG OtherOperationCount;ULONG AvailablePages;ULONG TotalCommittedPages;ULONG TotalCommitLimit;ULONG PeakCommitment;ULONG PageFaults;ULONG WriteCopyFaults;ULONG TransitionFaults;ULONG Reserved1;ULONG DemandZeroFaults;ULONG PagesRead;ULONG PageReadIos;ULONG Reserved2[2];ULONG PagefilePagesWritten;ULONG PagefilePageWriteIos;ULONG MappedFilePagesWritten;ULONG MappedFileWriteIos;ULONG PagedPoolUsage;ULONG NonPagedPoolUsage;ULONG PagedPoolAllocs;ULONG PagedPoolFrees;ULONG NonPagedPoolAllocs;ULONG NonPagedPoolFress;ULONG TotalFreeSystemPtes;ULONG SystemCodePage;ULONG TotalSystemDriverPages;ULONG TotalSystemCodePages;ULONG SmallNonPagedLookasideListAllocateHits;ULONG SmallPagedLookasideListAllocateHits;ULONG Reserved3;ULONG MmSystemCachePage;ULONG PagedPoolPage;ULONG SystemDriverPage;ULONG FastReadNoWait;ULONG FastReadWait;ULONG FastReadResourceMiss;ULONG FastReadNotPossible;ULONG FastMdlReadNoWait;ULONG FastMdlReadWait;ULONG FastMdlReadResourceMiss;ULONG FastMdlReadNotPossible;ULONG MapDataNoWait;ULONG MapDataWait;ULONG MapDataNoWaitMiss;ULONG MapDataWaitMiss;ULONG PinMappedDataCount;ULONG PinReadNoWait;ULONG PinReadWait;ULONG PinReadNoWaitMiss;ULONG PinReadWaitMiss;ULONG CopyReadNoWait;ULONG CopyReadWait;ULONG CopyReadNoWaitMiss;ULONG CopyReadWaitMiss;ULONG MdlReadNoWait;ULONG MdlReadWait;ULONG MdlReadNoWaitMiss;ULONG MdlReadWaitMiss;ULONG ReadAheadIos;ULONG LazyWriteIos;ULONG LazyWritePages;ULONG DataFlushes;ULONG DataPages;ULONG ContextSwitches;ULONG FirstLevelTbFills;ULONG SecondLevelTbFills;ULONG SystemCall;}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;typedef struct __SYSTEM_PROCESSOR_TIMES
{ LARGE_INTEGER IdleTime;LARGE_INTEGER KernelTime;LARGE_INTEGER UserTime;LARGE_INTEGER DpcTime;LARGE_INTEGER InterruptTime;ULONG InterruptCount;}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;typedef struct _SYSTEM_PAGEFILE_INFORMATION
{ ULONG NetxEntryOffset;ULONG CurrentSize;ULONG TotalUsed;ULONG PeakUsed;UNICODE_STRING FileName;}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;typedef struct _SYSTEM_CACHE_INFORMATION
{ ULONG SystemCacheWsSize;ULONG SystemCacheWsPeakSize;ULONG SystemCacheWsFaults;ULONG SystemCacheWsMinimum;ULONG SystemCacheWsMaximum;ULONG TransitionSharedPages;ULONG TransitionSharedPagesPeak;ULONG Reserved[2];}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)
(IN SYSTEM_INFORMATION_CLASS, IN OUT PVOID, INT ULONG, OUT PULONG OPTION);NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;DWORD PerfInfo()
{ SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;HMODULE hNtDll = NULL;DWORD dwNumberBytes;DWORD dwReturnLength;NTSTATUS Status;LONGLONG llTempTime;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL){ printf("LoadLibrary Error: %d\n",GetLastError()); __leave;}NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");if(NtQuerySystemInformation == NULL){ printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());__leave;}dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_PERF_INFO, &SystemPerfInfo,dwNumberBytes,&dwReturnLength);if(Status != STATUS_SUCCESS){ printf("NtQuerySystemInformation for Performance Error: %d\n",GetLastError());__leave;}printf("IdleTime:\t\t");
llTempTime = SystemPerfInfo.IdleTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("ReadOperationCount:\t%-10d\t",SystemPerfInfo.ReadOperationCount);
printf("ReadTransferCount:\t%d\n",SystemPerfInfo.ReadTransferCount);printf("WriteOperationCount:\t%-10d\t",SystemPerfInfo.WriteOperationCount);printf("WriteTransferCount:\t%d\n",SystemPerfInfo.WriteTransferCount);
printf("OtherOperationCount:\t%-10d\t",SystemPerfInfo.OtherOperationCount);printf("OtherTransferCount:\t%d\n",SystemPerfInfo.OtherTransferCount);
printf("AvailablePages:\t\t%-10d\t",SystemPerfInfo.AvailablePages);
printf("TotalCommittedPage:\t%d\n",SystemPerfInfo.TotalCommittedPages);printf("CommitLimit:\t\t%-10d\t",SystemPerfInfo.TotalCommitLimit);printf("PeakCommitment:\t\t%d\n",SystemPerfInfo.PeakCommitment);printf("PageFault:\t\t%-10d\t",SystemPerfInfo.PageFaults);
printf("WriteCopyFault:\t\t%d\n",SystemPerfInfo.WriteCopyFaults);printf("TransitionFault:\t%-10d\t",SystemPerfInfo.TransitionFaults);printf("DemandZeroFault:\t%d\n",SystemPerfInfo.DemandZeroFaults);printf("PagesRead:\t\t%-10d\t",SystemPerfInfo.PagesRead);
printf("PageReadIos:\t\t%d\n",SystemPerfInfo.PageReadIos);printf("PagesWritten:\t\t%-10d\t",SystemPerfInfo.PagefilePagesWritten);printf("PageWriteIos:\t\t%d\n",SystemPerfInfo.PagefilePageWriteIos);printf("MappedFilePagesWritten:\t%-10d\t",SystemPerfInfo.MappedFilePagesWritten);printf("MappedFileWriteIos:\t%d\n",SystemPerfInfo.MappedFileWriteIos);printf("PagedPoolUsage:\t\t%-10d\t",SystemPerfInfo.PagedPoolUsage);
printf("NonPagedPoolUsage:\t%d\n",SystemPerfInfo.NonPagedPoolUsage);printf("PagedPoolAllocs:\t%-10d\t",SystemPerfInfo.PagedPoolAllocs);printf("NonPagedPoolAllocs:\t%d\n",SystemPerfInfo.NonPagedPoolAllocs);printf("PagedPoolFrees:\t\t%-10d\t",SystemPerfInfo.PagedPoolFrees);printf("NonPagedPoolFrees:\t%d\n",SystemPerfInfo.NonPagedPoolFress);printf("SystemCodePage:\t\t%-10d\t",SystemPerfInfo.SystemCodePage);
printf("TotalSystemCodePage:\t%d\n",SystemPerfInfo.TotalSystemCodePages);printf("TotalFreeSysPTE:\t%-10d\t",SystemPerfInfo.TotalFreeSystemPtes);printf("TotalSystemDriverPages:\t%d\n",SystemPerfInfo.TotalSystemDriverPages);printf("PagedPoolPage:\t\t%-10d\t",SystemPerfInfo.PagedPoolPage);printf("SystemDriverPage:\t%d\n",SystemPerfInfo.SystemDriverPage);printf("FastReadWait:\t\t%-10d\t",SystemPerfInfo.FastReadWait);
printf("FastReadNoWait:\t\t%d\n",SystemPerfInfo.FastReadNoWait);printf("FastReadNoPossible:\t%-10d\t",SystemPerfInfo.FastReadNotPossible);printf("FastReadResourceMiss:\t%d\n",SystemPerfInfo.FastReadResourceMiss);
printf("FastMdlReadWait:\t%-10d\t",SystemPerfInfo.FastMdlReadWait);
printf("FastMdlReadNoWait:\t%d\n",SystemPerfInfo.FastMdlReadNoWait);printf("FastMdlReadNotPossible:\t%-10d\t",SystemPerfInfo.FastMdlReadNotPossible);printf("FastMdlReadResourceMiss:%d\n",SystemPerfInfo.FastMdlReadResourceMiss); printf("MapDataWait:\t\t%-10d\t",SystemPerfInfo.MapDataWait);printf("MapDataNoWait:\t\t%d\n",SystemPerfInfo.MapDataNoWait);printf("MapDataWaitMiss:\t%-10d\t",SystemPerfInfo.MapDataWaitMiss);printf("MapDataNoWaitMiss:\t%d\n",SystemPerfInfo.MapDataNoWaitMiss);printf("ReadAheadIos:\t\t%-10d\t",SystemPerfInfo.ReadAheadIos);
printf("PinMappedDataCount:\t%d\n",SystemPerfInfo.PinMappedDataCount);printf("PinReadWait:\t\t%-10d\t",SystemPerfInfo.PinReadWait);printf("PinReadNoWait:\t\t%d\n",SystemPerfInfo.PinReadNoWait);printf("PinReadWaitMiss:\t%-10d\t",SystemPerfInfo.PinReadWaitMiss);printf("PinReadNoWaitMiss:\t%d\n",SystemPerfInfo.PinReadNoWaitMiss);printf("CopyReadWait:\t\t%-10d\t",SystemPerfInfo.CopyReadWait);
printf("CopyReadNoWait:\t\t%d\n",SystemPerfInfo.CopyReadNoWait);printf("CopyReadWaitMiss:\t%-10d\t",SystemPerfInfo.CopyReadWaitMiss);printf("CopyReadNoWaitMiss:\t%-10d\n",SystemPerfInfo.CopyReadNoWaitMiss);printf("MdlReadWait:\t\t%-10d\t",SystemPerfInfo.MdlReadWait);printf("MdlReadNoWait:\t\t%d\n",SystemPerfInfo.MdlReadNoWait);printf("MdlReadWaitMiss:\t%-10d\t",SystemPerfInfo.MdlReadWaitMiss);printf("MdlReadNoWaitMiss:\t%d\n",SystemPerfInfo.MdlReadNoWaitMiss);printf("LazyWriteIos:\t\t%-10d\t",SystemPerfInfo.LazyWriteIos);
printf("LazyWritePages:\t\t%d\n",SystemPerfInfo.LazyWritePages);printf("DataPages:\t\t%-10d\t",SystemPerfInfo.DataPages);printf("DataFlushes:\t\t%d\n",SystemPerfInfo.DataFlushes);printf("FirstLevelTbFills:\t%-10d\t",SystemPerfInfo.FirstLevelTbFills);printf("SecondLevelTbFills:\t%d\n",SystemPerfInfo.SecondLevelTbFills);printf("ContextSwitches:\t%-10d\t",SystemPerfInfo.ContextSwitches);printf("SytemCall:\t\t%d\n",SystemPerfInfo.SystemCall);printf("MemorySystemCachePage:\t\t\t%d\n",SystemPerfInfo.MmSystemCachePage);
printf("SmallPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallPage
dLookasideListAllocateHits);printf("SmallNonPagedLookasideListAllocateHits:\t%d\n",SystemPerfInfo.SmallNonPagedLookasideListAllocateHits);}
__finally{ if(hNtDll != NULL){ FreeLibrary(hNtDll);}}return 0;
}DWORD ProcTime()
{ SYSTEM_PROCESSOR_TIMES SystemProcTime;HMODULE hNtDll = NULL;DWORD dwNumberBytes;DWORD dwReturnLength;NTSTATUS Status;LONGLONG llTempTime;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL){ printf("LoadLibrary Error: %d\n",GetLastError()); __leave;}NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");if(NtQuerySystemInformation == NULL){ printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());__leave;}dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");if(NtQuerySystemInformation == NULL){ printf("GetProcAddress Error: %d\n",GetLastError());__leave;}Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,
&SystemProcTime,dwNumberBytes,&dwReturnLength);if(Status != STATUS_SUCCESS){ printf("NtQuerySystemInformation for Processor Time Error: %d\n",GetLastError());__leave;}printf("IdleTime:\t\t");
llTempTime = SystemProcTime.IdleTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("KernelTime:\t\t");
llTempTime = SystemProcTime.KernelTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("UserTime:\t\t");
llTempTime = SystemProcTime.UserTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("DpcTime:\t\t");
llTempTime = SystemProcTime.DpcTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("InterruptTime:\t\t");
llTempTime = SystemProcTime.InterruptTime.QuadPart;llTempTime /= 10000;printf("%d:",llTempTime/(60*60*1000));llTempTime %= 60*60*1000;printf("%.2d:",llTempTime/(60*1000));llTempTime %= 60*1000;printf("%.2d.",llTempTime/1000);llTempTime %= 1000;printf("%.3d\n",llTempTime);printf("InterruptCount:\t\t%d\n",SystemProcTime.InterruptCount);
}
__finally{ if(hNtDll != NULL){ FreeLibrary(hNtDll);}}return 0;
}DWORD PagefileInfo()
{ PSYSTEM_PAGEFILE_INFORMATION pSystemPagefileInfo;PVOID pBuffer;HMODULE hNtDll = NULL;DWORD dwNumberBytes;DWORD dwReturnLength; NTSTATUS Status;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL){ printf("LoadLibrary Error: %d\n",GetLastError()); __leave;}NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"
NtQuerySystemInformation");if(NtQuerySystemInformation == NULL){ printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError());__leave;}dwNumberBytes = MAX_INFO_BUF_LEN;
pBuffer = (LPVOID)malloc(dwNumberBytes);Status = NtQuerySystemInformation(SYSTEM_PAGE_INFO, pBuffer, dwNumberBytes, &dwReturnLength);if(Status != STATUS_SUCCESS){ printf("NtQuerySystemInformation for Pagefile Error: %d\n",GetLastError());__leave;
}pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
do{ printf("CurrentPagefileSize:\t%d\n",pSystemPagefileInfo->CurrentSize);printf("TotalPagefileUsed:\t%d\n",pSystemPagefileInfo->TotalUsed);printf("PeakPagefileUsed:\t%d\n",pSystemPagefileInfo->PeakUsed);wprintf(L"PagefileFileName:\t%s\n",pSystemPagefileInfo->FileName.Buffer); pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer + pSystemPagefileInfo->NetxEntryOffset);}while(pSystemPagefileInfo->NetxEntryOffset != 0);}__finally{ if(pBuffer != NULL){ free(pBuffer);} if(hNtDll != NULL){ FreeLibrary(hNtDll);}}return 0;
}DWORD CacheInfo()
{ SYSTEM_CACHE_INFORMATION SystemCacheInfo; HMODULE hNtDll = NULL; DWORD dwNumberBytes; DWORD dwReturnLength; NTSTATUS Status;__try
{ hNtDll = LoadLibrary("NtDll.dll"); if(hNtDll == NULL) { printf("LoadLibrary Error: %d\n",GetLastError()); __leave; }NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL) { printf("GetProcAddress for NtQuerySystemInformation Error: %d\n",GetLastError()); __leave; }dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_CACHE_INFO, &SystemCacheInfo,dwNumberBytes,&dwReturnLength); if(Status != STATUS_SUCCESS) { printf("NtQuerySystemInformation for Cache Error: %d\n",GetLastError()); __leave; }printf("CacheWorkingSetSize:\t\t%d(KB)\n",SystemCacheInfo.SystemCacheWsSize1024);
printf("CacheWorkingSetPeakSize:\t%d(KB)\n",SystemCacheInfo.SystemCacheWsPeakSize/1024); printf("CacheWorkingSetFaults:\t\t%d\n",SystemCacheInfo.SystemCacheWsFaults); printf("CacheWorkingSetMinimum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMinimum); printf("CacheWorkingSetMaximum:\t\t%d\n",SystemCacheInfo.SystemCacheWsMaximum); printf("TransitionSharedPages:\t\t%d\n",SystemCacheInfo.TransitionSharedPages); printf("TransitionSharedPagesPeak:\t%d\n",SystemCacheInfo.TransitionSharedPagesPeak);}__finally
{ if(hNtDll != NULL) { FreeLibrary(hNtDll); } }return 0;
}VOID Start()
{ printf("T-PMPerf, by TOo2y\n"); printf("E-mail: "); printf("HomePage: "); printf("Date: 05-09-2003\n\n"); return ;}VOID Usage()
{ printf("Usage:\tT-PMPerf <Option>\n"); printf("Option:\n"); printf(" -Perf System Performance Information\n"); printf(" -Proc System Processor Information\n"); printf(" -Page System Pagefile Information\n"); printf(" -Cache System Cache Information\n"); return ;}#endif