processes.c File Reference

#include "precomp.h"
#include <debug.h>

Include dependency graph for processes.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
NTSTATUS NTAPI	PsaCaptureProcessesAndThreads (OUT PSYSTEM_PROCESS_INFORMATION *ProcessesAndThreads)
NTSTATUS NTAPI	PsaWalkProcessesAndThreads (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
NTSTATUS NTAPI	PsaEnumerateProcessesAndThreads (IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
VOID NTAPI	PsaFreeCapture (IN PVOID Capture)
NTSTATUS NTAPI	PsaWalkProcesses (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaWalkThreads (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads, IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaEnumerateProcesses (IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaEnumerateThreads (IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
PSYSTEM_PROCESS_INFORMATION FASTCALL	PsaWalkFirstProcess (IN PSYSTEM_PROCESS_INFORMATION ProcessesAndThreads)
PSYSTEM_PROCESS_INFORMATION FASTCALL	PsaWalkNextProcess (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess)
PSYSTEM_THREAD_INFORMATION FASTCALL	PsaWalkFirstThread (IN PSYSTEM_PROCESS_INFORMATION CurrentProcess)
PSYSTEM_THREAD_INFORMATION FASTCALL	PsaWalkNextThread (IN PSYSTEM_THREAD_INFORMATION CurrentThread)

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 34 of file processes.c.

Function Documentation

PsaCaptureProcessesAndThreads()

NTSTATUS NTAPI PsaCaptureProcessesAndThreads

(

OUT PSYSTEM_PROCESS_INFORMATION *

ProcessesAndThreads

)

Definition at line 38 of file processes.c.

{
  PSYSTEM_PROCESS_INFORMATION pInfoBuffer = NULL;
  SIZE_T nSize = 0x8000;
  NTSTATUS Status;
 
  if(ProcessesAndThreads == NULL)
  {
    return STATUS_INVALID_PARAMETER_1;
  }
 
  /* FIXME: if the system has loaded several processes and threads, the buffer
            could get really big. But if there's several processes and threads, the
            system is already under stress, and a huge buffer could only make things
            worse. The function should be profiled to see what's the average minimum
            buffer size, to succeed on the first shot */
  do
  {
    PVOID pTmp;
 
    /* free the buffer, and reallocate it to the new size. RATIONALE: since we
       ignore the buffer's contents at this point, there's no point in a realloc()
       that could end up copying a large chunk of data we'd discard anyway */
    PsaiFree(pInfoBuffer);
    pTmp = PsaiMalloc(nSize);
 
    if(pTmp == NULL)
    {
      DPRINT(FAILED_WITH_STATUS, "PsaiMalloc", STATUS_NO_MEMORY);
      Status = STATUS_NO_MEMORY;
      break;
    }
 
    pInfoBuffer = pTmp;
 
    /* query the information */
    Status = NtQuerySystemInformation(SystemProcessInformation,
                                      pInfoBuffer,
                                      nSize,
                                      NULL);
 
    /* double the buffer size */
    nSize *= 2;
  } while(Status == STATUS_INFO_LENGTH_MISMATCH);
 
  if(!NT_SUCCESS(Status))
  {
    DPRINT(FAILED_WITH_STATUS, "NtQuerySystemInformation", Status);
    return Status;
  }
 
  *ProcessesAndThreads = pInfoBuffer;
  return STATUS_SUCCESS;
}

Referenced by PsaEnumerateProcessesAndThreads().

PsaEnumerateProcesses()

NTSTATUS NTAPI PsaEnumerateProcesses	(	IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 218 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(Callback,
                                         CallbackContext,
                                         NULL,
                                         NULL);
}

PsaEnumerateProcessesAndThreads()

NTSTATUS NTAPI PsaEnumerateProcessesAndThreads	(	IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

Definition at line 153 of file processes.c.

{
  PSYSTEM_PROCESS_INFORMATION pInfoBuffer = NULL;
  NTSTATUS Status;
 
  if(ProcessCallback == NULL && ThreadCallback == NULL)
  {
    return STATUS_INVALID_PARAMETER;
  }
 
  /* get the processes and threads list */
  Status = PsaCaptureProcessesAndThreads(&pInfoBuffer);
 
  if(!NT_SUCCESS(Status))
  {
    goto Bail;
  }
 
  /* walk the processes and threads list */
  Status = PsaWalkProcessesAndThreads(pInfoBuffer,
                                      ProcessCallback,
                                      ProcessCallbackContext,
                                      ThreadCallback,
                                      ThreadCallbackContext);
 
Bail:
  PsaFreeCapture(pInfoBuffer);
 
  return Status;
}

Referenced by PsaEnumerateProcesses(), and PsaEnumerateThreads().

PsaEnumerateThreads()

NTSTATUS NTAPI PsaEnumerateThreads	(	IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 228 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(NULL,
                                         NULL,
                                         Callback,
                                         CallbackContext);
}

PsaFreeCapture()

VOID NTAPI PsaFreeCapture

(

IN PVOID

Capture

)

Definition at line 188 of file processes.c.

{
  PsaiFree(Capture);
}

Referenced by PerfDataRefresh(), PrintProcess(), PrintProcessList(), PsaEnumerateProcessesAndThreads(), and PsaEnumerateSystemModules().

PsaWalkFirstProcess()

PSYSTEM_PROCESS_INFORMATION FASTCALL PsaWalkFirstProcess

(

IN PSYSTEM_PROCESS_INFORMATION

ProcessesAndThreads

)

Definition at line 238 of file processes.c.

{
  return ProcessesAndThreads;
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkFirstThread()

PSYSTEM_THREAD_INFORMATION FASTCALL PsaWalkFirstThread

(

IN PSYSTEM_PROCESS_INFORMATION

CurrentProcess

)

Definition at line 257 of file processes.c.

{
  static SIZE_T nOffsetOfThreads = 0;
 
  /* get the offset of the Threads field */
  nOffsetOfThreads = sizeof(SYSTEM_PROCESS_INFORMATION);
 
  return (PSYSTEM_THREAD_INFORMATION)((ULONG_PTR)CurrentProcess + nOffsetOfThreads);
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkNextProcess()

PSYSTEM_PROCESS_INFORMATION FASTCALL PsaWalkNextProcess

(

IN PSYSTEM_PROCESS_INFORMATION

CurrentProcess

)

Definition at line 244 of file processes.c.

{
  if(CurrentProcess->NextEntryOffset == 0)
  {
    return NULL;
  }
  else
  {
    return (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)CurrentProcess + CurrentProcess->NextEntryOffset);
  }
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkNextThread()

PSYSTEM_THREAD_INFORMATION FASTCALL PsaWalkNextThread

(

IN PSYSTEM_THREAD_INFORMATION

CurrentThread

)

Definition at line 268 of file processes.c.

{
  return (PSYSTEM_THREAD_INFORMATION)((ULONG_PTR)CurrentThread +
                           ((sizeof(SYSTEM_PROCESS_INFORMATION) + sizeof(SYSTEM_THREAD_INFORMATION)) -
                            sizeof(SYSTEM_PROCESS_INFORMATION)));
}

Referenced by PsaWalkProcessesAndThreads().

PsaWalkProcesses()

NTSTATUS NTAPI PsaWalkProcesses	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 194 of file processes.c.

{
  return PsaWalkProcessesAndThreads(ProcessesAndThreads,
                                    Callback,
                                    CallbackContext,
                                    NULL,
                                    NULL);
}

PsaWalkProcessesAndThreads()

NTSTATUS NTAPI PsaWalkProcessesAndThreads	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

Definition at line 94 of file processes.c.

{
  NTSTATUS Status;
 
  if(ProcessCallback == NULL && ThreadCallback == NULL)
  {
    return STATUS_INVALID_PARAMETER;
  }
 
  Status = STATUS_SUCCESS;
 
  ProcessesAndThreads = PsaWalkFirstProcess(ProcessesAndThreads);
 
  /* scan the process list */
  do
  {
    if(ProcessCallback)
    {
      Status = ProcessCallback(ProcessesAndThreads, ProcessCallbackContext);
 
      if(!NT_SUCCESS(Status))
      {
        break;
      }
    }
 
    /* if the caller provided a thread callback */
    if(ThreadCallback)
    {
      ULONG i;
      PSYSTEM_THREAD_INFORMATION pCurThread;
 
      /* scan the current process's thread list */
      for(i = 0, pCurThread = PsaWalkFirstThread(ProcessesAndThreads);
          i < ProcessesAndThreads->NumberOfThreads;
          i++, pCurThread = PsaWalkNextThread(pCurThread))
      {
        Status = ThreadCallback(pCurThread, ThreadCallbackContext);
 
        if(!NT_SUCCESS(Status))
        {
          goto Bail;
        }
      }
    }
 
    /* move to the next process */
    ProcessesAndThreads = PsaWalkNextProcess(ProcessesAndThreads);
  } while(ProcessesAndThreads);
 
Bail:
  return Status;
}

Referenced by PsaEnumerateProcessesAndThreads(), PsaWalkProcesses(), and PsaWalkThreads().

PsaWalkThreads()

NTSTATUS NTAPI PsaWalkThreads	(	IN PSYSTEM_PROCESS_INFORMATION	ProcessesAndThreads,
		IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 206 of file processes.c.

{
  return PsaWalkProcessesAndThreads(ProcessesAndThreads,
                                    NULL,
                                    NULL,
                                   Callback,
                                   CallbackContext);
}