NtQuerySystemInformation(国外英语资料).docVIP

NtQuerySystemInformation(国外英语资料) The Native API is a Native system service that provides an interface to the upper Win32 API in Windows user mode. We always invoke the common Win32 API functions that MS provides for us to implement our system functionality. Today were going to talk about how to detect Native system information through Native apis. , of course, Microsoft did not provide us with documentation on the machine system services (Undocumented), which is not provide any guarantee for the use of it, so we do not advocate using Native apis to develop software. Under special circumstances, however, the native system service provides us with a shortcut to the secret. The information mentioned in this article was only tested on Windows 2000 / XP / 2003. Today, were talking about a function, NtQuerySystemInformation. Of course, you dont want to look at such a function, but it provides us with a wealth of information about the system, as well as the control and setting of certain information. Here is the prototype for this function: Typedef NTSTATUS (__stdcall NTQUERYSYSTEMINFORMATION) IN SYSTEM_INFORMATION_CLASS SystemInformationClass, IN OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL); NTQUERYSYSTEMINFORMATION NTQUERYSYSTEMINFORMATION; NtQuerySystemInformation this function with four parameters: the first parameter is the dwRecordType, this parameter specifies the us type information query system, in order to HANDLE list query system, we define a constant # define NT_HANDLE_LIST 16 (this value is to find information I get, if anyone has more information, please also let me share). The second parameter is a pointer, the pointer used to return the system handle list, before the call NtQuerySystemInformation function, must allocate enough memory space for this pointer or function calls will go wrong. The third parameter is the size of the memory space allocated for HandleList, which is byte. The fourth parameter is th