psapi.h File Reference

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_MODULEINFO
struct	_PSAPI_WS_WATCH_INFORMATION
struct	_PROCESS_MEMORY_COUNTERS
struct	_PROCESS_MEMORY_COUNTERS_EX
struct	_PERFORMANCE_INFORMATION
struct	_ENUM_PAGE_FILE_INFORMATION

Macros
#define	PENUM_PAGE_FILE_CALLBACK   PENUM_PAGE_FILE_CALLBACKA
#define	EnumPageFiles   EnumPageFilesA
#define	GetModuleBaseName   GetModuleBaseNameA
#define	GetModuleFileNameEx   GetModuleFileNameExA
#define	GetMappedFilenameEx   GetMappedFilenameExA
#define	GetDeviceDriverBaseName   GetDeviceDriverBaseNameA
#define	GetDeviceDriverFileName   GetDeviceDriverFileNameA
#define	GetProcessImageFileName   GetProcessImageFileNameA

Typedefs
typedef struct _MODULEINFO	MODULEINFO
typedef struct _MODULEINFO *	LPMODULEINFO
typedef struct _PSAPI_WS_WATCH_INFORMATION	PSAPI_WS_WATCH_INFORMATION
typedef struct _PSAPI_WS_WATCH_INFORMATION *	PPSAPI_WS_WATCH_INFORMATION
typedef struct _PROCESS_MEMORY_COUNTERS	PROCESS_MEMORY_COUNTERS
typedef struct _PROCESS_MEMORY_COUNTERS *	PPROCESS_MEMORY_COUNTERS
typedef struct _PROCESS_MEMORY_COUNTERS_EX	PROCESS_MEMORY_COUNTERS_EX
typedef struct _PROCESS_MEMORY_COUNTERS_EX *	PPROCESS_MEMORY_COUNTERS_EX
typedef struct _PERFORMANCE_INFORMATION	PERFORMANCE_INFORMATION
typedef struct _PERFORMANCE_INFORMATION *	PPERFORMANCE_INFORMATION
typedef struct _ENUM_PAGE_FILE_INFORMATION	ENUM_PAGE_FILE_INFORMATION
typedef struct _ENUM_PAGE_FILE_INFORMATION *	PENUM_PAGE_FILE_INFORMATION
typedef BOOL(CALLBACK *	PENUM_PAGE_FILE_CALLBACKA) (LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCSTR)
typedef BOOL(CALLBACK *	PENUM_PAGE_FILE_CALLBACKW) (LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCWSTR)

Functions
BOOL WINAPI	EnumProcesses (DWORD *, DWORD, DWORD *)
BOOL WINAPI	EnumProcessModules (HANDLE, HMODULE *, DWORD, LPDWORD)
BOOL WINAPI	EnumPageFilesA (PENUM_PAGE_FILE_CALLBACKA, LPVOID)
BOOL WINAPI	EnumPageFilesW (PENUM_PAGE_FILE_CALLBACKW, LPVOID)
DWORD WINAPI	GetModuleBaseNameA (HANDLE, HMODULE, LPSTR, DWORD)
DWORD WINAPI	GetModuleBaseNameW (HANDLE, HMODULE, LPWSTR, DWORD)
DWORD WINAPI	GetModuleFileNameExA (HANDLE, HMODULE, LPSTR, DWORD)
DWORD WINAPI	GetModuleFileNameExW (HANDLE, HMODULE, LPWSTR, DWORD)
BOOL WINAPI	GetModuleInformation (HANDLE, HMODULE, LPMODULEINFO, DWORD)
BOOL WINAPI	EmptyWorkingSet (HANDLE)
BOOL WINAPI	QueryWorkingSet (HANDLE, PVOID, DWORD)
BOOL WINAPI	InitializeProcessForWsWatch (HANDLE)
BOOL WINAPI	GetWsChanges (HANDLE, PPSAPI_WS_WATCH_INFORMATION, DWORD)
DWORD WINAPI	GetMappedFileNameW (HANDLE, LPVOID, LPWSTR, DWORD)
DWORD WINAPI	GetMappedFileNameA (HANDLE, LPVOID, LPSTR, DWORD)
BOOL WINAPI	EnumDeviceDrivers (LPVOID *, DWORD, LPDWORD)
DWORD WINAPI	GetDeviceDriverBaseNameA (LPVOID, LPSTR, DWORD)
DWORD WINAPI	GetDeviceDriverBaseNameW (LPVOID, LPWSTR, DWORD)
DWORD WINAPI	GetDeviceDriverFileNameA (LPVOID, LPSTR, DWORD)
DWORD WINAPI	GetDeviceDriverFileNameW (LPVOID, LPWSTR, DWORD)
BOOL WINAPI	GetProcessMemoryInfo (HANDLE, PPROCESS_MEMORY_COUNTERS, DWORD)
BOOL WINAPI	GetPerformanceInfo (PPERFORMANCE_INFORMATION, DWORD)
DWORD WINAPI	GetProcessImageFileNameW (HANDLE, LPWSTR, DWORD)
DWORD WINAPI	GetProcessImageFileNameA (HANDLE, LPSTR, DWORD)

Macro Definition Documentation

EnumPageFiles

#define EnumPageFiles   EnumPageFilesA

Definition at line 131 of file psapi.h.

GetDeviceDriverBaseName

#define GetDeviceDriverBaseName   GetDeviceDriverBaseNameA

Definition at line 135 of file psapi.h.

GetDeviceDriverFileName

#define GetDeviceDriverFileName   GetDeviceDriverFileNameA

Definition at line 136 of file psapi.h.

GetMappedFilenameEx

#define GetMappedFilenameEx   GetMappedFilenameExA

Definition at line 134 of file psapi.h.

GetModuleBaseName

#define GetModuleBaseName   GetModuleBaseNameA

Definition at line 132 of file psapi.h.

GetModuleFileNameEx

#define GetModuleFileNameEx   GetModuleFileNameExA

Definition at line 133 of file psapi.h.

GetProcessImageFileName

#define GetProcessImageFileName   GetProcessImageFileNameA

Definition at line 137 of file psapi.h.

PENUM_PAGE_FILE_CALLBACK

#define PENUM_PAGE_FILE_CALLBACK   PENUM_PAGE_FILE_CALLBACKA

Definition at line 130 of file psapi.h.

Typedef Documentation

ENUM_PAGE_FILE_INFORMATION

typedef struct _ENUM_PAGE_FILE_INFORMATION ENUM_PAGE_FILE_INFORMATION

LPMODULEINFO

typedef struct _MODULEINFO* LPMODULEINFO

MODULEINFO

typedef struct _MODULEINFO MODULEINFO

PENUM_PAGE_FILE_CALLBACKA

typedef BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKA) (LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCSTR)

Definition at line 89 of file psapi.h.

PENUM_PAGE_FILE_CALLBACKW

typedef BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKW) (LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCWSTR)

Definition at line 90 of file psapi.h.

PENUM_PAGE_FILE_INFORMATION

typedef struct _ENUM_PAGE_FILE_INFORMATION * PENUM_PAGE_FILE_INFORMATION

PERFORMANCE_INFORMATION

typedef struct _PERFORMANCE_INFORMATION PERFORMANCE_INFORMATION

PPERFORMANCE_INFORMATION

typedef struct _PERFORMANCE_INFORMATION * PPERFORMANCE_INFORMATION

PPROCESS_MEMORY_COUNTERS

typedef struct _PROCESS_MEMORY_COUNTERS * PPROCESS_MEMORY_COUNTERS

PPROCESS_MEMORY_COUNTERS_EX

typedef struct _PROCESS_MEMORY_COUNTERS_EX * PPROCESS_MEMORY_COUNTERS_EX

PPSAPI_WS_WATCH_INFORMATION

typedef struct _PSAPI_WS_WATCH_INFORMATION* PPSAPI_WS_WATCH_INFORMATION

PROCESS_MEMORY_COUNTERS

typedef struct _PROCESS_MEMORY_COUNTERS PROCESS_MEMORY_COUNTERS

PROCESS_MEMORY_COUNTERS_EX

typedef struct _PROCESS_MEMORY_COUNTERS_EX PROCESS_MEMORY_COUNTERS_EX

PSAPI_WS_WATCH_INFORMATION

typedef struct _PSAPI_WS_WATCH_INFORMATION PSAPI_WS_WATCH_INFORMATION

Function Documentation

EmptyWorkingSet()

BOOL WINAPI EmptyWorkingSet

(

HANDLE

hProcess

)

Definition at line 313 of file psapi.c.

{
    SYSTEM_INFO SystemInfo;
    QUOTA_LIMITS QuotaLimits;
    NTSTATUS Status;
 
    GetSystemInfo(&SystemInfo);
 
    /* Query the working set */
    Status = NtQueryInformationProcess(hProcess,
                                       ProcessQuotaLimits,
                                       &QuotaLimits,
                                       sizeof(QuotaLimits),
                                       NULL);
 
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    /* Empty the working set */
    QuotaLimits.MinimumWorkingSetSize = -1;
    QuotaLimits.MaximumWorkingSetSize = -1;
 
    /* Set the working set */
    Status = NtSetInformationProcess(hProcess,
                                     ProcessQuotaLimits,
                                     &QuotaLimits,
                                     sizeof(QuotaLimits));
    if (!NT_SUCCESS(Status) && Status != STATUS_PRIVILEGE_NOT_HELD)
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by test_ws_functions().

EnumDeviceDrivers()

BOOL WINAPI EnumDeviceDrivers	(	LPVOID *	lpImageBase,
		DWORD	cb,
		LPDWORD	lpcbNeeded
	)

Definition at line 358 of file psapi.c.

{
    NTSTATUS Status;
    DWORD NewSize, Count;
    PRTL_PROCESS_MODULES Information;
    /* By default, to prevent too many reallocations, we already make room for 4 modules */
    DWORD Size = sizeof(RTL_PROCESS_MODULES) + 3 * sizeof(RTL_PROCESS_MODULE_INFORMATION);
 
    do
    {
        /* Allocate a buffer to hold modules information */
        Information = LocalAlloc(LMEM_FIXED, Size);
        if (!Information)
        {
            SetLastError(ERROR_NO_SYSTEM_RESOURCES);
            return FALSE;
        }
 
        /* Query information */
        Status = NtQuerySystemInformation(SystemModuleInformation, Information, Size, &Count);
        /* In case of an error */
        if (!NT_SUCCESS(Status))
        {
            /* Save the amount of output modules */
            NewSize = Information->NumberOfModules;
            /* And free buffer */
            LocalFree(Information);
 
            /* If it was not a length mismatch (ie, buffer too small), just leave */
            if (Status != STATUS_INFO_LENGTH_MISMATCH)
            {
                SetLastError(RtlNtStatusToDosError(Status));
                return FALSE;
            }
 
            /* Compute new size length */
            ASSERT(Size >= sizeof(RTL_PROCESS_MODULES));
            NewSize *= sizeof(RTL_PROCESS_MODULE_INFORMATION);
            NewSize += sizeof(ULONG);
            ASSERT(NewSize >= sizeof(RTL_PROCESS_MODULES));
            /* Check whether it is really bigger - otherwise, leave */
            if (NewSize < Size)
            {
                ASSERT(NewSize > Size);
                SetLastError(RtlNtStatusToDosError(STATUS_INFO_LENGTH_MISMATCH));
                return FALSE;
            }
 
            /* Loop again with that new buffer */
            Size = NewSize;
            continue;
        }
 
        /* End of allocation loop */
        break;
    } while (TRUE);
 
    _SEH2_TRY
    {
        for (Count = 0; Count < Information->NumberOfModules && Count < cb / sizeof(LPVOID); ++Count)
        {
            lpImageBase[Count] = Information->Modules[Count].ImageBase;
        }
 
        *lpcbNeeded = Information->NumberOfModules * sizeof(LPVOID);
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        SetLastError(RtlNtStatusToDosError(_SEH2_GetExceptionCode()));
        _SEH2_YIELD(return FALSE);
    }
    _SEH2_END;
 
    return TRUE;
}

EnumPageFilesA()

BOOL WINAPI EnumPageFilesA	(	PENUM_PAGE_FILE_CALLBACKA	pCallbackRoutine,
		LPVOID	lpContext
	)

Definition at line 1270 of file psapi.c.

{
    BOOL Ret;
    INTERNAL_ENUM_PAGE_FILES_CONTEXT Context;
 
    Context.dwErrCode = ERROR_SUCCESS;
    Context.lpContext = lpContext;
    Context.pCallbackRoutine = pCallbackRoutine;
 
    /* Call W with our own callback for W -> A conversions */
    Ret = EnumPageFilesW(CallBackConvertToAscii, &Context);
    /* If we succeed but we have error code, fail and set error */
    if (Ret && Context.dwErrCode != ERROR_SUCCESS)
    {
        Ret = FALSE;
        SetLastError(Context.dwErrCode);
    }
 
    return Ret;
}

EnumPageFilesW()

BOOL WINAPI EnumPageFilesW	(	PENUM_PAGE_FILE_CALLBACKW	pCallbackRoutine,
		LPVOID	lpContext
	)

Definition at line 1298 of file psapi.c.

{
    PWSTR Colon;
    NTSTATUS Status;
    DWORD Size = INIT_MEMORY_SIZE, Needed;
    ENUM_PAGE_FILE_INFORMATION Information;
    PSYSTEM_PAGEFILE_INFORMATION PageFileInfoArray, PageFileInfo;
 
    /* First loop till we have all the information about page files */
    do
    {
        PageFileInfoArray = LocalAlloc(LMEM_FIXED, Size);
        if (PageFileInfoArray == NULL)
        {
            SetLastError(RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES));
            return FALSE;
        }
 
        Status = NtQuerySystemInformation(SystemPageFileInformation, PageFileInfoArray, Size, &Needed);
        if (NT_SUCCESS(Status))
        {
            break;
        }
 
        LocalFree(PageFileInfoArray);
 
        /* In case we have unexpected status, quit */
        if (Status != STATUS_INFO_LENGTH_MISMATCH)
        {
            SetLastError(RtlNtStatusToDosError(Status));
            return FALSE;
        }
 
        /* If needed size is smaller than actual size, guess it's something to add to our current size */
        if (Needed <= Size)
        {
            Size += Needed;
        }
        /* Otherwise, take it as size to allocate */
        else
        {
            Size = Needed;
        }
    }
    while (TRUE);
 
    /* Start browsing all our entries */
    PageFileInfo = PageFileInfoArray;
    do
    {
        /* Ensure we really have an entry */
        if (Needed < sizeof(SYSTEM_PAGEFILE_INFORMATION))
        {
            break;
        }
 
        /* Prepare structure to hand to the user */
        Information.Reserved = 0;
        Information.cb = sizeof(Information);
        Information.TotalSize = PageFileInfo->TotalSize;
        Information.TotalInUse = PageFileInfo->TotalInUse;
        Information.PeakUsage = PageFileInfo->PeakUsage;
 
        /* Search for colon */
        Colon = wcschr(PageFileInfo->PageFileName.Buffer, L':');
        /* If it's found and not at the begin of the string */
        if (Colon != 0 && Colon != PageFileInfo->PageFileName.Buffer)
        {
            /* We can call the user callback routine with the colon */
            --Colon;
            pCallbackRoutine(lpContext, &Information, Colon);
        }
 
        /* If no next entry, then, it's over */
        if (PageFileInfo->NextEntryOffset == 0 || PageFileInfo->NextEntryOffset > Needed)
        {
            break;
        }
 
        /* Jump to next entry while keeping accurate bytes left count */
        Needed -= PageFileInfo->NextEntryOffset;
        PageFileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((ULONG_PTR)PageFileInfo + PageFileInfo->NextEntryOffset);
    }
    while (TRUE);
 
    LocalFree(PageFileInfoArray);
    return TRUE;
}

Referenced by EnumPageFilesA().

EnumProcesses()

BOOL WINAPI EnumProcesses	(	DWORD *	,
		DWORD	,
		DWORD *
	)

EnumProcessModules()

BOOL WINAPI EnumProcessModules	(	HANDLE	hProcess,
		HMODULE *	lphModule,
		DWORD	cb,
		LPDWORD	lpcbNeeded
	)

Definition at line 526 of file psapi.c.

{
    NTSTATUS Status;
    DWORD NbOfModules, Count;
    PPEB_LDR_DATA LoaderData;
    PLIST_ENTRY ListHead, ListEntry;
    PROCESS_BASIC_INFORMATION ProcInfo;
    LDR_DATA_TABLE_ENTRY CurrentModule;
 
    /* Query the process information to get its PEB address */
    Status = NtQueryInformationProcess(hProcess, ProcessBasicInformation, &ProcInfo, sizeof(ProcInfo), NULL);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    if (ProcInfo.PebBaseAddress == NULL)
    {
        SetLastError(RtlNtStatusToDosError(STATUS_PARTIAL_COPY));
        return FALSE;
    }
 
    /* Read loader data address from PEB */
    if (!ReadProcessMemory(hProcess, &ProcInfo.PebBaseAddress->Ldr, &LoaderData, sizeof(LoaderData), NULL))
    {
        return FALSE;
    }
 
    /* Store list head address */
    ListHead = &LoaderData->InLoadOrderModuleList;
 
    /* Read first element in the modules list */
    if (!ReadProcessMemory(hProcess, &LoaderData->InLoadOrderModuleList.Flink, &ListEntry, sizeof(ListEntry), NULL))
    {
        return FALSE;
    }
 
    NbOfModules = cb / sizeof(HMODULE);
    Count = 0;
 
    /* Loop on the modules */
    while (ListEntry != ListHead)
    {
        /* Load module data */
        if (!ReadProcessMemory(hProcess,
                               CONTAINING_RECORD(ListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks),
                               &CurrentModule,
                               sizeof(CurrentModule),
                               NULL))
        {
            return FALSE;
        }
 
        /* Check if we can output module, do it if so */
        if (Count < NbOfModules)
        {
            _SEH2_TRY
            {
                lphModule[Count] = CurrentModule.DllBase;
            }
            _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
            {
                SetLastError(RtlNtStatusToDosError(_SEH2_GetExceptionCode()));
                _SEH2_YIELD(return FALSE);
            }
            _SEH2_END;
        }
 
        ++Count;
        if (Count > MAX_MODULES)
        {
            SetLastError(ERROR_INVALID_HANDLE);
            return FALSE;
        }
 
        /* Get to next listed module */
        ListEntry = CurrentModule.InLoadOrderLinks.Flink;
    }
 
    _SEH2_TRY
    {
        *lpcbNeeded = Count * sizeof(HMODULE);
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        SetLastError(RtlNtStatusToDosError(_SEH2_GetExceptionCode()));
        _SEH2_YIELD(return FALSE);
    }
    _SEH2_END;
 
    return TRUE;
}

Referenced by debug_target_init_modules_info(), DllMain(), EnumerateLoadedModulesW64(), get_process_name_from_pid(), and test_EnumProcessModules().

GetDeviceDriverBaseNameA()

DWORD WINAPI GetDeviceDriverBaseNameA	(	LPVOID	ImageBase,
		LPSTR	lpBaseName,
		DWORD	nSize
	)

Definition at line 629 of file psapi.c.

{
    SIZE_T Len, LenWithNull;
    RTL_PROCESS_MODULE_INFORMATION Module;
 
    /* Get the associated device driver to the base address */
    if (!FindDeviceDriver(ImageBase, &Module))
    {
        return 0;
    }
 
    /* And copy as much as possible to output buffer.
     * Try to add 1 to the len, to copy the null char as well.
     */
    Len =
    LenWithNull = strlen(&Module.FullPathName[Module.OffsetToFileName]) + 1;
    if (Len > nSize)
    {
        Len = nSize;
    }
 
    memcpy(lpBaseName, &Module.FullPathName[Module.OffsetToFileName], Len);
    /* In case we copied null char, remove it from final len */
    if (Len == LenWithNull)
    {
        --Len;
    }
 
    return Len;
}

Referenced by GetDeviceDriverBaseNameW(), and START_TEST().

GetDeviceDriverBaseNameW()

DWORD WINAPI GetDeviceDriverBaseNameW	(	LPVOID	ImageBase,
		LPWSTR	lpBaseName,
		DWORD	nSize
	)

Definition at line 707 of file psapi.c.

{
    DWORD Len;
    LPSTR BaseName;
 
    /* Allocate internal buffer for conversion */
    BaseName = LocalAlloc(LMEM_FIXED, nSize);
    if (BaseName == 0)
    {
        return 0;
    }
 
    /* Call A API */
    Len = GetDeviceDriverBaseNameA(ImageBase, BaseName, nSize);
    if (Len == 0)
    {
        LocalFree(BaseName);
        return 0;
    }
 
    /* And convert output */
    if (MultiByteToWideChar(CP_ACP, 0, BaseName, (Len < nSize) ? Len + 1 : Len, lpBaseName, nSize) == 0)
    {
        LocalFree(BaseName);
        return 0;
    }
 
    LocalFree(BaseName);
    return Len;
}

GetDeviceDriverFileNameA()

DWORD WINAPI GetDeviceDriverFileNameA	(	LPVOID	ImageBase,
		LPSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 668 of file psapi.c.

{
    SIZE_T Len, LenWithNull;
    RTL_PROCESS_MODULE_INFORMATION Module;
 
    /* Get the associated device driver to the base address */
    if (!FindDeviceDriver(ImageBase, &Module))
    {
        return 0;
    }
 
    /* And copy as much as possible to output buffer.
     * Try to add 1 to the len, to copy the null char as well.
     */
    Len =
    LenWithNull = strlen(Module.FullPathName) + 1;
    if (Len > nSize)
    {
        Len = nSize;
    }
 
    memcpy(lpFilename, Module.FullPathName, Len);
    /* In case we copied null char, remove it from final len */
    if (Len == LenWithNull)
    {
        --Len;
    }
 
    return Len;
}

Referenced by GetDeviceDriverFileNameW(), and START_TEST().

GetDeviceDriverFileNameW()

DWORD WINAPI GetDeviceDriverFileNameW	(	LPVOID	ImageBase,
		LPWSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 746 of file psapi.c.

{
    DWORD Len;
    LPSTR FileName;
 
    /* Allocate internal buffer for conversion */
    FileName = LocalAlloc(LMEM_FIXED, nSize);
    if (FileName == 0)
    {
        return 0;
    }
 
    /* Call A API */
    Len = GetDeviceDriverFileNameA(ImageBase, FileName, nSize);
    if (Len == 0)
    {
        LocalFree(FileName);
        return 0;
    }
 
    /* And convert output */
    if (MultiByteToWideChar(CP_ACP, 0, FileName, (Len < nSize) ? Len + 1 : Len, lpFilename, nSize) == 0)
    {
        LocalFree(FileName);
        return 0;
    }
 
    LocalFree(FileName);
    return Len;
}

GetMappedFileNameA()

DWORD WINAPI GetMappedFileNameA	(	HANDLE	hProcess,
		LPVOID	lpv,
		LPSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 785 of file psapi.c.

{
    DWORD Len;
    LPWSTR FileName;
 
    DPRINT("GetMappedFileNameA(%p, %p, %p, %lu)\n", hProcess, lpv, lpFilename, nSize);
 
    /* Allocate internal buffer for conversion */
    FileName = LocalAlloc(LMEM_FIXED, nSize * sizeof(WCHAR));
    if (FileName == NULL)
    {
        return 0;
    }
 
    /* Call W API */
    Len = GetMappedFileNameW(hProcess, lpv, FileName, nSize);
 
    /* And convert output */
    if (WideCharToMultiByte(CP_ACP, 0, FileName, (Len < nSize) ? Len + 1 : Len, lpFilename, nSize, NULL, NULL) == 0)
    {
        Len = 0;
    }
 
    LocalFree(FileName);
    return Len;
}

Referenced by test_GetMappedFileName(), and test_GetProcessImageFileName().

GetMappedFileNameW()

DWORD WINAPI GetMappedFileNameW	(	HANDLE	hProcess,
		LPVOID	lpv,
		LPWSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 821 of file psapi.c.

{
    DWORD Len;
    SIZE_T OutSize;
    NTSTATUS Status;
    struct
    {
        MEMORY_SECTION_NAME;
        WCHAR CharBuffer[MAX_PATH];
    } SectionName;
 
    DPRINT("GetMappedFileNameW(%p, %p, %p, %lu)\n", hProcess, lpv, lpFilename, nSize);
 
    /* If no buffer, no need to keep going on */
    if (nSize == 0)
    {
        SetLastError(ERROR_INSUFFICIENT_BUFFER);
        return 0;
    }
 
    /* Query section name */
    Status = NtQueryVirtualMemory(hProcess, lpv, MemorySectionName,
                                  &SectionName, sizeof(SectionName), &OutSize);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return 0;
    }
 
    /* Prepare to copy file name */
    Len =
    OutSize = SectionName.SectionFileName.Length / sizeof(WCHAR);
    if (OutSize + 1 > nSize)
    {
        Len = nSize - 1;
        OutSize = nSize;
        SetLastError(ERROR_INSUFFICIENT_BUFFER);
    }
    else
    {
        SetLastError(ERROR_SUCCESS);
    }
 
    /* Copy, zero and return */
    memcpy(lpFilename, SectionName.SectionFileName.Buffer, Len * sizeof(WCHAR));
    lpFilename[Len] = 0;
 
    return OutSize;
}

Referenced by GetMappedFileNameA(), and test_GetMappedFileName().

GetModuleBaseNameA()

DWORD WINAPI GetModuleBaseNameA	(	HANDLE	hProcess,
		HMODULE	hModule,
		LPSTR	lpBaseName,
		DWORD	nSize
	)

Definition at line 880 of file psapi.c.

{
    DWORD Len;
    PWSTR BaseName;
 
    /* Allocate internal buffer for conversion */
    BaseName = LocalAlloc(LMEM_FIXED, nSize * sizeof(WCHAR));
    if (BaseName == NULL)
    {
        return 0;
    }
 
    /* Call W API */
    Len = GetModuleBaseNameW(hProcess, hModule, BaseName, nSize);
    /* And convert output */
    if (WideCharToMultiByte(CP_ACP, 0, BaseName, (Len < nSize) ? Len + 1 : Len, lpBaseName, nSize, NULL, NULL) == 0)
    {
        Len = 0;
    }
 
    LocalFree(BaseName);
 
    return Len;
}

Referenced by test_EnumProcessModules(), and test_GetModuleBaseName().

GetModuleBaseNameW()

DWORD WINAPI GetModuleBaseNameW	(	HANDLE	hProcess,
		HMODULE	hModule,
		LPWSTR	lpBaseName,
		DWORD	nSize
	)

Definition at line 914 of file psapi.c.

{
    DWORD Len;
    LDR_DATA_TABLE_ENTRY Module;
 
    /* Get the matching module */
    if (!FindModule(hProcess, hModule, &Module))
    {
        return 0;
    }
 
    /* Get the maximum len we have/can write in given size */
    Len = Module.BaseDllName.Length + sizeof(UNICODE_NULL);
    if (nSize * sizeof(WCHAR) < Len)
    {
        Len = nSize * sizeof(WCHAR);
    }
 
    /* Read string */
    if (!ReadProcessMemory(hProcess, (&Module.BaseDllName)->Buffer, lpBaseName, Len, NULL))
    {
        return 0;
    }
 
    /* If we are at the end of the string, prepare to override to nullify string */
    if (Len == Module.BaseDllName.Length + sizeof(UNICODE_NULL))
    {
        Len -= sizeof(UNICODE_NULL);
    }
 
    /* Nullify at the end if needed */
    if (Len >= nSize * sizeof(WCHAR))
    {
        if (nSize)
        {
            ASSERT(nSize >= sizeof(UNICODE_NULL));
            lpBaseName[nSize - 1] = UNICODE_NULL;
        }
    }
    /* Otherwise, nullify at last written char */
    else
    {
        ASSERT(Len + sizeof(UNICODE_NULL) <= nSize * sizeof(WCHAR));
        lpBaseName[Len / sizeof(WCHAR)] = UNICODE_NULL;
    }
 
    return Len / sizeof(WCHAR);
}

Referenced by EnumerateLoadedModulesW64(), get_process_name_from_pid(), GetModuleBaseNameA(), and GetOwnerModuleFromPidEntry().

GetModuleFileNameExA()

DWORD WINAPI GetModuleFileNameExA	(	HANDLE	hProcess,
		HMODULE	hModule,
		LPSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 972 of file psapi.c.

{
    DWORD Len;
    PWSTR Filename;
 
    /* Allocate internal buffer for conversion */
    Filename = LocalAlloc(LMEM_FIXED, nSize * sizeof(WCHAR));
    if (Filename == NULL)
    {
        return 0;
    }
 
    /* Call W API */
    Len = GetModuleFileNameExW(hProcess, hModule, Filename, nSize);
    /* And convert output */
    if (WideCharToMultiByte(CP_ACP, 0, Filename, (Len < nSize) ? Len + 1 : Len, lpFilename, nSize, NULL, NULL) == 0)
    {
        Len = 0;
    }
 
    LocalFree(Filename);
 
    return Len;
}

Referenced by debug_target_init_modules_info(), test_EnumProcessModules(), test_GetModuleFileNameEx(), and ModuleData::Update().

GetModuleFileNameExW()

DWORD WINAPI GetModuleFileNameExW	(	HANDLE	hProcess,
		HMODULE	hModule,
		LPWSTR	lpFilename,
		DWORD	nSize
	)

Definition at line 1006 of file psapi.c.

{
    DWORD Len;
    LDR_DATA_TABLE_ENTRY Module;
 
    /* Get the matching module */
    if (!FindModule(hProcess, hModule, &Module))
    {
        return 0;
    }
 
    /* Get the maximum len we have/can write in given size */
    Len = Module.FullDllName.Length + sizeof(UNICODE_NULL);
    if (nSize * sizeof(WCHAR) < Len)
    {
        Len = nSize * sizeof(WCHAR);
    }
 
    /* Read string */
    if (!ReadProcessMemory(hProcess, (&Module.FullDllName)->Buffer, lpFilename, Len, NULL))
    {
        return 0;
    }
 
    /* If we are at the end of the string, prepare to override to nullify string */
    if (Len == Module.FullDllName.Length + sizeof(UNICODE_NULL))
    {
        Len -= sizeof(UNICODE_NULL);
    }
 
    /* Nullify at the end if needed */
    if (Len >= nSize * sizeof(WCHAR))
    {
        if (nSize)
        {
            ASSERT(nSize >= sizeof(UNICODE_NULL));
            lpFilename[nSize - 1] = UNICODE_NULL;
        }
    }
    /* Otherwise, nullify at last written char */
    else
    {
        ASSERT(Len + sizeof(UNICODE_NULL) <= nSize * sizeof(WCHAR));
        lpFilename[Len / sizeof(WCHAR)] = UNICODE_NULL;
    }
 
    return Len / sizeof(WCHAR);
}

GetModuleInformation()

BOOL WINAPI GetModuleInformation	(	HANDLE	hProcess,
		HMODULE	hModule,
		LPMODULEINFO	lpmodinfo,
		DWORD	cb
	)

Definition at line 1064 of file psapi.c.

{
    MODULEINFO LocalInfo;
    LDR_DATA_TABLE_ENTRY Module;
 
    /* Check output size */
    if (cb < sizeof(MODULEINFO))
    {
        SetLastError(ERROR_INSUFFICIENT_BUFFER);
        return FALSE;
    }
 
    /* Get the matching module */
    if (!FindModule(hProcess, hModule, &Module))
    {
        return FALSE;
    }
 
    /* Get a local copy first, to check for valid pointer once */
    LocalInfo.lpBaseOfDll = hModule;
    LocalInfo.SizeOfImage = Module.SizeOfImage;
    LocalInfo.EntryPoint = Module.EntryPoint;
 
    /* Attempt to copy to output */
    _SEH2_TRY
    {
        memcpy(lpmodinfo, &LocalInfo, sizeof(LocalInfo));
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        SetLastError(RtlNtStatusToDosError(_SEH2_GetExceptionCode()));
        _SEH2_YIELD(return FALSE);
    }
    _SEH2_END;
 
    return TRUE;
}

Referenced by debug_target_init_modules_info(), EnumerateLoadedModulesW64(), test_EnumProcessModules(), test_GetModuleInformation(), and ModuleData::Update().

GetPerformanceInfo()

BOOL WINAPI GetPerformanceInfo	(	PPERFORMANCE_INFORMATION	pPerformanceInformation,
		DWORD	cb
	)

Definition at line 1394 of file psapi.c.

{
    NTSTATUS Status;
    SYSTEM_BASIC_INFORMATION SystemBasicInfo;
    SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
    SYSTEM_FILECACHE_INFORMATION SystemFileCacheInfo;
    PSYSTEM_PROCESS_INFORMATION ProcInfoArray, SystemProcInfo;
    DWORD Size = INIT_MEMORY_SIZE, Needed, ProcCount, ThreadsCount, HandleCount;
 
    /* Validate output buffer */
    if (cb < sizeof(PERFORMANCE_INFORMATION))
    {
        SetLastError(RtlNtStatusToDosError(STATUS_INFO_LENGTH_MISMATCH));
        return FALSE;
    }
 
    /* First, gather as many information about the system as possible */
    Status = NtQuerySystemInformation(SystemBasicInformation,
                                      &SystemBasicInfo,
                                      sizeof(SystemBasicInfo),
                                      NULL);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    Status = NtQuerySystemInformation(SystemPerformanceInformation,
                                      &SystemPerfInfo,
                                      sizeof(SystemPerfInfo),
                                      NULL);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    Status = NtQuerySystemInformation(SystemFileCacheInformation,
                                      &SystemFileCacheInfo,
                                      sizeof(SystemFileCacheInfo),
                                      NULL);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    /* Then loop till we have all the information about processes */
    do
    {
        ProcInfoArray = LocalAlloc(LMEM_FIXED, Size);
        if (ProcInfoArray == NULL)
        {
            SetLastError(RtlNtStatusToDosError(STATUS_INSUFFICIENT_RESOURCES));
            return FALSE;
        }
 
        Status = NtQuerySystemInformation(SystemProcessInformation,
                                          ProcInfoArray,
                                          Size,
                                          &Needed);
        if (NT_SUCCESS(Status))
        {
            break;
        }
 
        LocalFree(ProcInfoArray);
 
        /* In case we have unexpected status, quit */
        if (Status != STATUS_INFO_LENGTH_MISMATCH)
        {
            SetLastError(RtlNtStatusToDosError(Status));
            return FALSE;
        }
 
        /* If needed size is smaller than actual size, guess it's something to add to our current size */
        if (Needed <= Size)
        {
            Size += Needed;
        }
        /* Otherwise, take it as size to allocate */
        else
        {
            Size = Needed;
        }
    } while (TRUE);
 
    /* Start browsing all our entries */
    ProcCount = 0;
    HandleCount = 0;
    ThreadsCount = 0;
    SystemProcInfo = ProcInfoArray;
    do
    {
        /* Ensure we really have an entry */
        if (Needed < sizeof(SYSTEM_PROCESS_INFORMATION))
        {
            break;
        }
 
        /* Sum procs, threads and handles */
        ++ProcCount;
        ThreadsCount += SystemProcInfo->NumberOfThreads;
        HandleCount += SystemProcInfo->HandleCount;
 
        /* If no next entry, then, it's over */
        if (SystemProcInfo->NextEntryOffset == 0 || SystemProcInfo->NextEntryOffset > Needed)
        {
            break;
        }
 
        /* Jump to next entry while keeping accurate bytes left count */
        Needed -= SystemProcInfo->NextEntryOffset;
        SystemProcInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)SystemProcInfo + SystemProcInfo->NextEntryOffset);
    }
    while (TRUE);
 
    LocalFree(ProcInfoArray);
 
    /* Output data */
    pPerformanceInformation->CommitTotal = SystemPerfInfo.CommittedPages;
    pPerformanceInformation->CommitLimit = SystemPerfInfo.CommitLimit;
    pPerformanceInformation->CommitPeak = SystemPerfInfo.PeakCommitment;
    pPerformanceInformation->PhysicalTotal = SystemBasicInfo.NumberOfPhysicalPages;
    pPerformanceInformation->PhysicalAvailable = SystemPerfInfo.AvailablePages;
    pPerformanceInformation->SystemCache = SystemFileCacheInfo.CurrentSizeIncludingTransitionInPages;
    pPerformanceInformation->KernelNonpaged = SystemPerfInfo.NonPagedPoolPages;
    pPerformanceInformation->PageSize = SystemBasicInfo.PageSize;
    pPerformanceInformation->cb = sizeof(PERFORMANCE_INFORMATION);
    pPerformanceInformation->KernelTotal = SystemPerfInfo.PagedPoolPages + SystemPerfInfo.NonPagedPoolPages;
    pPerformanceInformation->KernelPaged = SystemPerfInfo.PagedPoolPages;
    pPerformanceInformation->HandleCount = HandleCount;
    pPerformanceInformation->ProcessCount = ProcCount;
    pPerformanceInformation->ThreadCount = ThreadsCount;
 
    return TRUE;
}

Referenced by test_GetPerformanceInfo().

GetProcessImageFileNameA()

DWORD WINAPI GetProcessImageFileNameA	(	HANDLE	hProcess,
		LPSTR	lpImageFileName,
		DWORD	nSize
	)

Definition at line 1216 of file psapi.c.

{
    PUNICODE_STRING ImageFileName;
    SIZE_T BufferSize;
    NTSTATUS Status;
    DWORD Len;
 
    /* Allocate string big enough to hold name */
    BufferSize = sizeof(UNICODE_STRING) + (nSize * sizeof(WCHAR));
    ImageFileName = LocalAlloc(LMEM_FIXED, BufferSize);
    if (ImageFileName == NULL)
    {
        return 0;
    }
 
    /* Query name */
    Status = NtQueryInformationProcess(hProcess,
                                       ProcessImageFileName,
                                       ImageFileName,
                                       BufferSize,
                                       NULL);
    /* Len mismatch => buffer too small */
    if (Status == STATUS_INFO_LENGTH_MISMATCH)
    {
        Status = STATUS_BUFFER_TOO_SMALL;
    }
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        LocalFree(ImageFileName);
        return 0;
    }
 
    /* Copy name */
    Len = WideCharToMultiByte(CP_ACP, 0, ImageFileName->Buffer,
                              ImageFileName->Length, lpImageFileName, nSize, NULL, NULL);
    /* If conversion was successful, don't return len with added \0 */
    if (Len != 0)
    {
        Len -= sizeof(ANSI_NULL);
    }
 
    LocalFree(ImageFileName);
    return Len;
}

Referenced by test_GetProcessImageFileName().

GetProcessImageFileNameW()

DWORD WINAPI GetProcessImageFileNameW	(	HANDLE	hProcess,
		LPWSTR	lpImageFileName,
		DWORD	nSize
	)

Definition at line 1163 of file psapi.c.

{
    PUNICODE_STRING ImageFileName;
    SIZE_T BufferSize;
    NTSTATUS Status;
    DWORD Len;
 
    /* Allocate string big enough to hold name */
    BufferSize = sizeof(UNICODE_STRING) + (nSize * sizeof(WCHAR));
    ImageFileName = LocalAlloc(LMEM_FIXED, BufferSize);
    if (ImageFileName == NULL)
    {
        return 0;
    }
 
    /* Query name */
    Status = NtQueryInformationProcess(hProcess,
                                       ProcessImageFileName,
                                       ImageFileName,
                                       BufferSize,
                                       NULL);
    /* Len mismatch => buffer too small */
    if (Status == STATUS_INFO_LENGTH_MISMATCH)
    {
        Status = STATUS_BUFFER_TOO_SMALL;
    }
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        LocalFree(ImageFileName);
        return 0;
    }
 
    /* Copy name and null-terminate if possible */
    memcpy(lpImageFileName, ImageFileName->Buffer, ImageFileName->Length);
    Len = ImageFileName->Length / sizeof(WCHAR);
    if (Len < nSize)
    {
        lpImageFileName[Len] = UNICODE_NULL;
    }
 
    LocalFree(ImageFileName);
    return Len;
}

Referenced by NonConsoleProcessShutdown(), test_GetProcessImageFileName(), and UserClientShutdown().

GetProcessMemoryInfo()

BOOL WINAPI GetProcessMemoryInfo	(	HANDLE	Process,
		PPROCESS_MEMORY_COUNTERS	ppsmemCounters,
		DWORD	cb
	)

Definition at line 1539 of file psapi.c.

{
    NTSTATUS Status;
    VM_COUNTERS_EX Counters;
 
    /* Validate output size
     * It can be either PROCESS_MEMORY_COUNTERS or PROCESS_MEMORY_COUNTERS_EX
     */
    if (cb < sizeof(PROCESS_MEMORY_COUNTERS))
    {
        SetLastError(ERROR_INSUFFICIENT_BUFFER);
        return FALSE;
    }
 
    _SEH2_TRY
    {
        ppsmemCounters->PeakPagefileUsage = 0;
 
        /* Query counters */
        Status = NtQueryInformationProcess(Process,
                                           ProcessVmCounters,
                                           &Counters,
                                           sizeof(Counters),
                                           NULL);
        if (!NT_SUCCESS(Status))
        {
            SetLastError(RtlNtStatusToDosError(Status));
            _SEH2_YIELD(return FALSE);
        }
 
        /* Properly set cb, according to what we received */
        if (cb >= sizeof(PROCESS_MEMORY_COUNTERS_EX))
        {
            ppsmemCounters->cb = sizeof(PROCESS_MEMORY_COUNTERS_EX);
        }
        else
        {
            ppsmemCounters->cb = sizeof(PROCESS_MEMORY_COUNTERS);
        }
 
        /* Output data */
        ppsmemCounters->PageFaultCount = Counters.PageFaultCount;
        ppsmemCounters->PeakWorkingSetSize = Counters.PeakWorkingSetSize;
        ppsmemCounters->WorkingSetSize = Counters.WorkingSetSize;
        ppsmemCounters->QuotaPeakPagedPoolUsage = Counters.QuotaPeakPagedPoolUsage;
        ppsmemCounters->QuotaPagedPoolUsage = Counters.QuotaPagedPoolUsage;
        ppsmemCounters->QuotaPeakNonPagedPoolUsage = Counters.QuotaPeakNonPagedPoolUsage;
        ppsmemCounters->QuotaNonPagedPoolUsage = Counters.QuotaNonPagedPoolUsage;
        ppsmemCounters->PagefileUsage = Counters.PagefileUsage;
        ppsmemCounters->PeakPagefileUsage = Counters.PeakPagefileUsage;
        /* And if needed, additional field for _EX version */
        if (cb >= sizeof(PROCESS_MEMORY_COUNTERS_EX))
        {
            ((PPROCESS_MEMORY_COUNTERS_EX)ppsmemCounters)->PrivateUsage = Counters.PrivateUsage;
        }
    }
    _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
    {
        SetLastError(RtlNtStatusToDosError(_SEH2_GetExceptionCode()));
        _SEH2_YIELD(return FALSE);
    }
    _SEH2_END;
 
    return TRUE;
}

Referenced by test_GetProcessMemoryInfo().

GetWsChanges()

BOOL WINAPI GetWsChanges	(	HANDLE	hProcess,
		PPSAPI_WS_WATCH_INFORMATION	lpWatchInfo,
		DWORD	cb
	)

Definition at line 1136 of file psapi.c.

{
    NTSTATUS Status;
 
    /* Simply forward the call */
    Status = NtQueryInformationProcess(hProcess,
                                       ProcessWorkingSetWatch,
                                       lpWatchInfo,
                                       cb,
                                       NULL);
    if(!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by test_ws_functions().

InitializeProcessForWsWatch()

BOOL WINAPI InitializeProcessForWsWatch

(

HANDLE

hProcess

)

Definition at line 1111 of file psapi.c.

{
    NTSTATUS Status;
 
    /* Simply forward the call */
    Status = NtSetInformationProcess(hProcess,
                                     ProcessWorkingSetWatch,
                                     NULL,
                                     0);
    /* In case the function returns this, MS considers the call as a success */
    if (NT_SUCCESS(Status) || Status == STATUS_PORT_ALREADY_SET || Status == STATUS_ACCESS_DENIED)
    {
        return TRUE;
    }
 
    SetLastError(RtlNtStatusToDosError(Status));
    return FALSE;
}

Referenced by test_ws_functions().

QueryWorkingSet()

BOOL WINAPI QueryWorkingSet	(	HANDLE	hProcess,
		PVOID	pv,
		DWORD	cb
	)

Definition at line 1613 of file psapi.c.

{
    NTSTATUS Status;
 
    /* Simply forward the call */
    Status = NtQueryVirtualMemory(hProcess,
                                  NULL,
                                  MemoryWorkingSetList,
                                  pv,
                                  cb,
                                  NULL);
    if (!NT_SUCCESS(Status))
    {
        SetLastError(RtlNtStatusToDosError(Status));
        return FALSE;
    }
 
    return TRUE;
}

Referenced by test_ws_functions().