16 #define WIN32_NO_STATUS 20 #define NTOS_MODE_USER 33 #define MAX_MODULES 0x2710 // Matches 10.000 modules 34 #define INIT_MEMORY_SIZE 0x1000 // Matches 4kB 94 memcpy(MatchingModule, &Module,
sizeof(Module));
148 if (LoaderData ==
NULL)
170 while (ListEntry != ListHead)
183 if (Module->DllBase ==
hModule)
195 ListEntry = Module->InMemoryOrderLinks.
Flink;
226 if (AnsiFileName ==
NULL)
241 Ret =
Context->pCallbackRoutine(
Context->lpContext, pPageFileInfo, AnsiFileName);
342 sizeof(QuotaLimits));
455 if (ProcInfoArray ==
NULL)
481 ProcInfo = ProcInfoArray;
571 while (ListEntry != ListHead)
577 sizeof(CurrentModule),
584 if (
Count < NbOfModules)
654 if (
Len == LenWithNull)
693 if (
Len == LenWithNull)
846 &SectionName,
sizeof(SectionName), &OutSize);
855 OutSize = SectionName.SectionFileName.Length /
sizeof(
WCHAR);
856 if (OutSize + 1 >
nSize)
868 memcpy(lpFilename, SectionName.SectionFileName.Buffer,
Len *
sizeof(
WCHAR));
890 if (BaseName ==
NULL)
1093 memcpy(lpmodinfo, &LocalInfo,
sizeof(LocalInfo));
1175 if (ImageFileName ==
NULL)
1217 LPSTR lpImageFileName,
1228 if (ImageFileName ==
NULL)
1277 Context.lpContext = lpContext;
1278 Context.pCallbackRoutine = pCallbackRoutine;
1311 if (PageFileInfoArray ==
NULL)
1346 PageFileInfo = PageFileInfoArray;
1433 &SystemFileCacheInfo,
1434 sizeof(SystemFileCacheInfo),
1446 if (ProcInfoArray ==
NULL)
1486 SystemProcInfo = ProcInfoArray;
1526 pPerformanceInformation->
HandleCount = HandleCount;
1528 pPerformanceInformation->
ThreadCount = ThreadsCount;
DWORD WINAPI GetDeviceDriverFileNameW(LPVOID ImageBase, LPWSTR lpFilename, DWORD nSize)
BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKW)(LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCWSTR)
#define STATUS_PRIVILEGE_NOT_HELD
NTSYSAPI NTSTATUS NTAPI NtQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInfoClass, OUT PVOID SystemInfoBuffer, IN ULONG SystemInfoBufferSize, OUT PULONG BytesReturned OPTIONAL)
#define STATUS_INSUFFICIENT_RESOURCES
#define STATUS_INFO_LENGTH_MISMATCH
#define WideCharToMultiByte
SIZE_T PeakWorkingSetSize
static BOOL NTAPI FindModule(IN HANDLE hProcess, IN HMODULE hModule OPTIONAL, OUT PLDR_DATA_TABLE_ENTRY Module)
ACPI_SIZE strlen(const char *String)
LIST_ENTRY InLoadOrderModuleList
SIZE_T QuotaPagedPoolUsage
struct _INTERNAL_ENUM_PAGE_FILES_CONTEXT INTERNAL_ENUM_PAGE_FILES_CONTEXT
DWORD WINAPI GetDeviceDriverBaseNameA(LPVOID ImageBase, LPSTR lpBaseName, DWORD nSize)
DWORD WINAPI GetModuleBaseNameA(HANDLE hProcess, HMODULE hModule, LPSTR lpBaseName, DWORD nSize)
#define ERROR_INVALID_HANDLE
*nSize LPSTR _Inout_ LPDWORD nSize
LIST_ENTRY InMemoryOrderModuleList
BOOL WINAPI DisableThreadLibraryCalls(IN HMODULE hLibModule)
BOOL WINAPI InitializeProcessForWsWatch(HANDLE hProcess)
DWORD WINAPI GetDeviceDriverFileNameA(LPVOID ImageBase, LPSTR lpFilename, DWORD nSize)
NTSTATUS NTAPI NtQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT PSIZE_T ReturnLength)
IN PVOID IN PVOID IN USHORT IN USHORT Size
DWORD WINAPI GetLastError(VOID)
_In_ BOOL _In_ HANDLE hProcess
#define DLL_PROCESS_ATTACH
#define ReadProcessMemory(a, b, c, d, e)
BOOL WINAPI EnumPageFilesW(PENUM_PAGE_FILE_CALLBACKW pCallbackRoutine, LPVOID lpContext)
SIZE_T QuotaNonPagedPoolUsage
_In_ WDFREQUEST _In_ NTSTATUS _In_ ULONG_PTR Information
#define ERROR_NO_SYSTEM_RESOURCES
struct _RTL_PROCESS_MODULES RTL_PROCESS_MODULES
IN PVCB IN PBCB OUT PDIRENT IN USHORT IN POEM_STRING Filename
#define STATUS_BUFFER_TOO_SMALL
static BOOL CALLBACK CallBackConvertToAscii(LPVOID pContext, PENUM_PAGE_FILE_INFORMATION pPageFileInfo, LPCWSTR lpFilename)
struct _SYSTEM_PAGEFILE_INFORMATION * PSYSTEM_PAGEFILE_INFORMATION
UNICODE_STRING PageFileName
struct _PROCESS_MEMORY_COUNTERS_EX PROCESS_MEMORY_COUNTERS_EX
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
SIZE_T QuotaPeakNonPagedPoolUsage
#define RTL_USER_PROCESS_PARAMETERS_PROFILE_USER
BOOL WINAPI EmptyWorkingSet(HANDLE hProcess)
PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine
SIZE_T QuotaNonPagedPoolUsage
_Reserved_ PVOID Reserved
#define SystemPerformanceInformation
DWORD WINAPI GetModuleBaseNameW(HANDLE hProcess, HMODULE hModule, LPWSTR lpBaseName, DWORD nSize)
static BOOL NTAPI FindDeviceDriver(IN PVOID ImageBase, OUT PRTL_PROCESS_MODULE_INFORMATION MatchingModule)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
BOOLEAN WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
BOOL WINAPI QueryWorkingSetEx(IN HANDLE hProcess, IN OUT PVOID pv, IN DWORD cb)
#define DLL_PROCESS_DETACH
SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo
DWORD WINAPI GetModuleFileNameExA(HANDLE hProcess, HMODULE hModule, LPSTR lpFilename, DWORD nSize)
struct _LIST_ENTRY * Flink
BOOL WINAPI GetPerformanceInfo(PPERFORMANCE_INFORMATION pPerformanceInformation, DWORD cb)
DWORD WINAPI GetMappedFileNameW(HANDLE hProcess, LPVOID lpv, LPWSTR lpFilename, DWORD nSize)
struct _PERFORMANCE_INFORMATION PERFORMANCE_INFORMATION
BOOL WINAPI EnumProcessModules(HANDLE hProcess, HMODULE *lphModule, DWORD cb, LPDWORD lpcbNeeded)
SIZE_T QuotaPagedPoolUsage
_CONST_RETURN wchar_t *__cdecl wcschr(_In_z_ const wchar_t *_Str, wchar_t _Ch)
#define NT_SUCCESS(StatCode)
#define EXCEPTION_EXECUTE_HANDLER
SYSTEM_BASIC_INFORMATION SystemBasicInfo
static VOID NTAPI PsInitializeAndStartProfile(VOID)
DWORD WINAPI GetModuleFileNameExW(HANDLE hProcess, HMODULE hModule, LPWSTR lpFilename, DWORD nSize)
DWORD WINAPI GetProcessImageFileNameA(HANDLE hProcess, LPSTR lpImageFileName, DWORD nSize)
#define STATUS_ACCESS_DENIED
static VOID NTAPI PsStopAndAnalyzeProfile(VOID)
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
BOOL WINAPI EnumPageFilesA(PENUM_PAGE_FILE_CALLBACKA pCallbackRoutine, LPVOID lpContext)
#define memcpy(s1, s2, n)
SIZE_T QuotaPeakNonPagedPoolUsage
static VOID NTAPI PsParseCommandLine(VOID)
_Must_inspect_result_ _In_ USHORT NewSize
struct _PROCESS_MEMORY_COUNTERS_EX * PPROCESS_MEMORY_COUNTERS_EX
INT64 MinimumWorkingSetSize
LIST_ENTRY InLoadOrderLinks
struct _SYSTEM_PROCESS_INFORMATION * PSYSTEM_PROCESS_INFORMATION
struct _FileName FileName
SIZE_T QuotaPeakPagedPoolUsage
NTSTATUS NTAPI NtSetInformationProcess(IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
BOOL WINAPI EnumProcesses(DWORD *lpidProcess, DWORD cb, LPDWORD lpcbNeeded)
HLOCAL NTAPI LocalFree(HLOCAL hMem)
struct _MEMORY_SECTION_NAME MEMORY_SECTION_NAME
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
VOID WINAPI GetSystemInfo(IN LPSYSTEM_INFO lpSystemInfo)
INT64 MaximumWorkingSetSize
BOOL WINAPI GetModuleInformation(HANDLE hProcess, HMODULE hModule, LPMODULEINFO lpmodinfo, DWORD cb)
_CRTIMP size_t __cdecl wcslen(_In_z_ const wchar_t *_Str)
#define MultiByteToWideChar
struct _UNICODE_STRING UNICODE_STRING
#define STATUS_PARTIAL_COPY
static HMODULE MODULEINFO DWORD cb
struct _PROCESS_MEMORY_COUNTERS PROCESS_MEMORY_COUNTERS
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
struct tagContext Context
DWORD WINAPI GetProcessImageFileNameW(HANDLE hProcess, LPWSTR lpImageFileName, DWORD nSize)
BOOL WINAPI QueryWorkingSet(HANDLE hProcess, PVOID pv, DWORD cb)
SIZE_T PeakWorkingSetSize
struct _INTERNAL_ENUM_PAGE_FILES_CONTEXT * PINTERNAL_ENUM_PAGE_FILES_CONTEXT
HLOCAL NTAPI LocalAlloc(UINT uFlags, SIZE_T dwBytes)
#define _SEH2_EXCEPT(...)
BOOL WINAPI GetProcessMemoryInfo(HANDLE Process, PPROCESS_MEMORY_COUNTERS ppsmemCounters, DWORD cb)
_Must_inspect_result_ _In_ WDFDEVICE _In_ PWDF_DEVICE_PROPERTY_DATA _In_ ULONG _Out_ PVOID _Out_ PULONG RequiredSize
#define _SEH2_GetExceptionCode()
BOOL WINAPI GetWsChanges(HANDLE hProcess, PPSAPI_WS_WATCH_INFORMATION lpWatchInfo, DWORD cb)
#define _SEH2_YIELD(__stmt)
DWORD WINAPI GetDeviceDriverBaseNameW(LPVOID ImageBase, LPWSTR lpBaseName, DWORD nSize)
SIZE_T QuotaPeakPagedPoolUsage
BOOL(CALLBACK * PENUM_PAGE_FILE_CALLBACKA)(LPVOID, PENUM_PAGE_FILE_INFORMATION, LPCSTR)
NTSTATUS NTAPI NtQueryInformationProcess(_In_ HANDLE ProcessHandle, _In_ PROCESSINFOCLASS ProcessInformationClass, _Out_ PVOID ProcessInformation, _In_ ULONG ProcessInformationLength, _Out_opt_ PULONG ReturnLength)
_In_ WDFMEMORY _Out_opt_ size_t * BufferSize
#define ERROR_INSUFFICIENT_BUFFER
#define STATUS_PORT_ALREADY_SET
PULONG MinorVersion OPTIONAL
BOOL WINAPI EnumDeviceDrivers(LPVOID *lpImageBase, DWORD cb, LPDWORD lpcbNeeded)
DWORD WINAPI GetMappedFileNameA(HANDLE hProcess, LPVOID lpv, LPSTR lpFilename, DWORD nSize)