Type a page name and press Enter. You'll jump to the page if it exists, or you can create it if it doesn't.
To create a page in a module other than ntdll, prefix the name with the module name and a period.
NtQuerySystemInformation (ntdll)
.
C# Signature:
/// <summary>Retrieves the specified system information.</summary>
/// <param name="InfoClass">indicate the kind of system information to be retrieved</param>
/// <param name="Info">a buffer that receives the requested information</param>
/// <param name="Size">The allocation size of the buffer pointed to by Info</param>
/// <param name="Length">If null, ignored. Otherwise tells you the size of the information returned by the kernel.</param>
/// <returns>Status Information</returns>
/// http://msdn.microsoft.com/en-us/library/windows/desktop/ms724509%28v=vs.85%29.aspx
[DllImport("ntdll.dll")]
public static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, uint Size, out uint Length);
VB Signature:
Declare Function NtQuerySystemInformation Lib "ntdll.dll" (TODO) As TODO
//helper method with "dynamic" buffer allocation
public static IntPtr NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS infoClass, uint infoLength = 0)
{
if (infoLength == 0)
infoLength = 0x10000;
var infoPtr = Marshal.AllocHGlobal((int)infoLength);
var tries = 0;
while (true)
{
var result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);
if (result == NtStatus.Success)
return infoPtr;
IntPtr infoPtr = Marshal.AllocHGlobal((int)infoLength);
int tries = 0;
NtStatus result;
Marshal.FreeHGlobal(infoPtr); //free pointer when not Successful
if (result != NtStatus.InfoLengthMismatch && result != NtStatus.BufferOverflow && result != NtStatus.BufferTooSmall)
while (true)
{
result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);
if (result == NtStatus.InfoLengthMismatch || result == NtStatus.BufferOverflow || result == NtStatus.BufferTooSmall)
{
//throw new Exception("Unhandled NtStatus " + result);
return IntPtr.Zero;
Marshal.FreeHGlobal(infoPtr);
infoPtr = Marshal.AllocHGlobal((int)infoLength);
tries++;
continue;
}
NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION
MemoryList;
if (result == NtStatus.Success)
return infoPtr;
else
Marshal.FreeHGlobal(infoPtr);//free pointer when not Successful
UInt32
returnSize;
return IntPtr.Zero;
}
public void Test()
{
UInt32
result = 0;
Int32[]
arr = new Int32[] { (Int32)Commands.MEMORYLIST };
NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION
MemoryList;
UInt32
returnSize;
Int32[]
arr = new Int32[] { (Int32)Commands.MEMORYLIST };
IntPtr
buff = Marshal.AllocHGlobal(1024); // should be more than adequate
try
{
result = (UInt32)NativeMethods.NtQuerySystemInformation(NativeMethods.SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation, buff, result, out returnSize);
if (result != 0)
// Most likely error is InfoLengthMismatch = 0xc0000004 -- meaning you need to make the buffer larger
throw new System.ComponentModel.Win32Exception(((NativeMethods.NtStatus)result).ToString());
if (NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION_SIZE == 0)
NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION_SIZE = returnSize;
MemoryList = (NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION)Marshal.PtrToStructure(buff, typeof(NativeMethods.SYSTEM_MEMORY_LIST_INFORMATION));
}
finally
{
Marshal.FreeHGlobal(buff);
}
}
Windows NT status codes
12/4/2015 12:41:37 PM - -58.170.153.39
Please edit this page!
Do you have...
helpful tips or sample code to share for using this API in managed code?
corrections to the existing content?
variations of the signature you want to share?
additional languages you want to include?
Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).