16#define WIN32_NO_STATUS
33#define MAX_MODULES 0x2710
34#define INIT_MEMORY_SIZE 0x1000
94 memcpy(MatchingModule, &Module,
sizeof(Module));
148 if (LoaderData ==
NULL)
170 while (ListEntry != ListHead)
183 if (Module->DllBase ==
hModule)
195 ListEntry = Module->InMemoryOrderLinks.
Flink;
226 if (AnsiFileName ==
NULL)
241 Ret =
Context->pCallbackRoutine(
Context->lpContext, pPageFileInfo, AnsiFileName);
342 sizeof(QuotaLimits));
455 if (ProcInfoArray ==
NULL)
481 ProcInfo = ProcInfoArray;
571 while (ListEntry != ListHead)
577 sizeof(CurrentModule),
584 if (
Count < NbOfModules)
654 if (
Len == LenWithNull)
693 if (
Len == LenWithNull)
846 &SectionName,
sizeof(SectionName), &OutSize);
855 OutSize = SectionName.SectionFileName.Length /
sizeof(
WCHAR);
856 if (OutSize + 1 >
nSize)
868 memcpy(lpFilename, SectionName.SectionFileName.Buffer,
Len *
sizeof(
WCHAR));
890 if (BaseName ==
NULL)
1093 memcpy(lpmodinfo, &LocalInfo,
sizeof(LocalInfo));
1175 if (ImageFileName ==
NULL)
1217 LPSTR lpImageFileName,
1228 if (ImageFileName ==
NULL)
1277 Context.lpContext = lpContext;
1278 Context.pCallbackRoutine = pCallbackRoutine;
1311 if (PageFileInfoArray ==
NULL)
1346 PageFileInfo = PageFileInfoArray;
1433 &SystemFileCacheInfo,
1434 sizeof(SystemFileCacheInfo),
1446 if (ProcInfoArray ==
NULL)
1486 SystemProcInfo = ProcInfoArray;
1526 pPerformanceInformation->
HandleCount = HandleCount;
1528 pPerformanceInformation->
ThreadCount = ThreadsCount;
#define STATUS_PRIVILEGE_NOT_HELD
ACPI_SIZE strlen(const char *String)
#define ERROR_INSUFFICIENT_BUFFER
#define NT_SUCCESS(StatCode)
#define ReadProcessMemory(a, b, c, d, e)
#define GetModuleFileNameExW(w, x, y, z)
#define DLL_PROCESS_ATTACH
#define DLL_PROCESS_DETACH
#define ERROR_INVALID_HANDLE
#define WideCharToMultiByte
#define MultiByteToWideChar
BOOL WINAPI DisableThreadLibraryCalls(IN HMODULE hLibModule)
VOID WINAPI GetSystemInfo(IN LPSYSTEM_INFO lpSystemInfo)
DWORD WINAPI GetModuleFileNameExA(HANDLE hProcess, HMODULE hModule, LPSTR lpFilename, DWORD nSize)
DWORD WINAPI GetMappedFileNameW(HANDLE hProcess, LPVOID lpv, LPWSTR lpFilename, DWORD nSize)
static BOOL NTAPI FindModule(IN HANDLE hProcess, IN HMODULE hModule OPTIONAL, OUT PLDR_DATA_TABLE_ENTRY Module)
BOOL WINAPI EnumPageFilesW(PENUM_PAGE_FILE_CALLBACKW pCallbackRoutine, LPVOID lpContext)
BOOL WINAPI QueryWorkingSet(HANDLE hProcess, PVOID pv, DWORD cb)
BOOL WINAPI GetProcessMemoryInfo(HANDLE Process, PPROCESS_MEMORY_COUNTERS ppsmemCounters, DWORD cb)
BOOL WINAPI EmptyWorkingSet(HANDLE hProcess)
static BOOL NTAPI FindDeviceDriver(IN PVOID ImageBase, OUT PRTL_PROCESS_MODULE_INFORMATION MatchingModule)
static VOID NTAPI PsStopAndAnalyzeProfile(VOID)
BOOL WINAPI GetWsChanges(HANDLE hProcess, PPSAPI_WS_WATCH_INFORMATION lpWatchInfo, DWORD cb)
DWORD WINAPI GetDeviceDriverFileNameW(LPVOID ImageBase, LPWSTR lpFilename, DWORD nSize)
DWORD WINAPI GetModuleBaseNameA(HANDLE hProcess, HMODULE hModule, LPSTR lpBaseName, DWORD nSize)
BOOL WINAPI EnumDeviceDrivers(LPVOID *lpImageBase, DWORD cb, LPDWORD lpcbNeeded)
BOOL WINAPI EnumProcessModules(HANDLE hProcess, HMODULE *lphModule, DWORD cb, LPDWORD lpcbNeeded)
BOOL WINAPI InitializeProcessForWsWatch(HANDLE hProcess)
BOOLEAN WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
static BOOL CALLBACK CallBackConvertToAscii(LPVOID pContext, PENUM_PAGE_FILE_INFORMATION pPageFileInfo, LPCWSTR lpFilename)
BOOL WINAPI GetPerformanceInfo(PPERFORMANCE_INFORMATION pPerformanceInformation, DWORD cb)
static VOID NTAPI PsParseCommandLine(VOID)
DWORD WINAPI GetDeviceDriverBaseNameA(LPVOID ImageBase, LPSTR lpBaseName, DWORD nSize)
DWORD WINAPI GetDeviceDriverBaseNameW(LPVOID ImageBase, LPWSTR lpBaseName, DWORD nSize)
DWORD WINAPI GetProcessImageFileNameW(HANDLE hProcess, LPWSTR lpImageFileName, DWORD nSize)
DWORD WINAPI GetProcessImageFileNameA(HANDLE hProcess, LPSTR lpImageFileName, DWORD nSize)
struct _INTERNAL_ENUM_PAGE_FILES_CONTEXT INTERNAL_ENUM_PAGE_FILES_CONTEXT
DWORD WINAPI GetDeviceDriverFileNameA(LPVOID ImageBase, LPSTR lpFilename, DWORD nSize)
DWORD WINAPI GetMappedFileNameA(HANDLE hProcess, LPVOID lpv, LPSTR lpFilename, DWORD nSize)
struct _INTERNAL_ENUM_PAGE_FILES_CONTEXT * PINTERNAL_ENUM_PAGE_FILES_CONTEXT
static VOID NTAPI PsInitializeAndStartProfile(VOID)
BOOL WINAPI EnumProcesses(DWORD *lpidProcess, DWORD cb, LPDWORD lpcbNeeded)
BOOL WINAPI GetModuleInformation(HANDLE hProcess, HMODULE hModule, LPMODULEINFO lpmodinfo, DWORD cb)
DWORD WINAPI GetModuleBaseNameW(HANDLE hProcess, HMODULE hModule, LPWSTR lpBaseName, DWORD nSize)
BOOL WINAPI QueryWorkingSetEx(IN HANDLE hProcess, IN OUT PVOID pv, IN DWORD cb)
BOOL WINAPI EnumPageFilesA(PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine, LPVOID lpContext)
struct _UNICODE_STRING UNICODE_STRING
IN PVCB IN PBCB OUT PDIRENT IN USHORT IN POEM_STRING Filename
struct _FileName FileName
@ SystemModuleInformation
@ SystemFileCacheInformation
@ SystemProcessInformation
@ SystemPageFileInformation
_Must_inspect_result_ _In_ USHORT NewSize
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
HLOCAL NTAPI LocalAlloc(UINT uFlags, SIZE_T dwBytes)
HLOCAL NTAPI LocalFree(HLOCAL hMem)
#define EXCEPTION_EXECUTE_HANDLER
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
@ ProcessBasicInformation
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
_In_ BOOL _In_ HANDLE hProcess
#define SystemPerformanceInformation
#define memcpy(s1, s2, n)
static HMODULE MODULEINFO DWORD cb
struct _SYSTEM_PROCESS_INFORMATION * PSYSTEM_PROCESS_INFORMATION
struct _SYSTEM_PAGEFILE_INFORMATION * PSYSTEM_PAGEFILE_INFORMATION
struct _RTL_PROCESS_MODULES RTL_PROCESS_MODULES
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER
NTSTATUS NTAPI NtQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT PSIZE_T ReturnLength)
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
#define STATUS_PORT_ALREADY_SET
#define STATUS_PARTIAL_COPY
SYSTEM_BASIC_INFORMATION SystemBasicInfo
SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo
struct _PROCESS_MEMORY_COUNTERS_EX PROCESS_MEMORY_COUNTERS_EX
BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKW)(LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCWSTR)
struct _PROCESS_MEMORY_COUNTERS_EX * PPROCESS_MEMORY_COUNTERS_EX
struct _PERFORMANCE_INFORMATION PERFORMANCE_INFORMATION
struct _PROCESS_MEMORY_COUNTERS PROCESS_MEMORY_COUNTERS
BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKA)(LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCSTR)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define STATUS_BUFFER_TOO_SMALL
PULONG MinorVersion OPTIONAL
NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInfoClass, OUT PVOID SystemInfoBuffer, IN ULONG SystemInfoBufferSize, OUT PULONG BytesReturned OPTIONAL)
PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine
UNICODE_STRING FullDllName
LIST_ENTRY InLoadOrderLinks
UNICODE_STRING BaseDllName
struct _LIST_ENTRY * Flink
LIST_ENTRY InMemoryOrderModuleList
LIST_ENTRY InLoadOrderModuleList
SIZE_T QuotaNonPagedPoolUsage
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
INT64 MaximumWorkingSetSize
INT64 MinimumWorkingSetSize
UNICODE_STRING PageFileName
SIZE_T QuotaNonPagedPoolUsage
SIZE_T PeakWorkingSetSize
SIZE_T QuotaPeakNonPagedPoolUsage
SIZE_T QuotaPeakPagedPoolUsage
SIZE_T QuotaPagedPoolUsage
#define CONTAINING_RECORD(address, type, field)
#define STATUS_ACCESS_DENIED
#define STATUS_INFO_LENGTH_MISMATCH
#define STATUS_INSUFFICIENT_RESOURCES
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ DEVPROPTYPE _In_ ULONG Size
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
_In_ WDFREQUEST _In_ NTSTATUS _In_ ULONG_PTR Information
DWORD WINAPI GetLastError(void)
*nSize LPSTR _Inout_ LPDWORD nSize
_Reserved_ PVOID Reserved
#define ERROR_NO_SYSTEM_RESOURCES