To use with an handle to a thread kernel object. (Possibly obtained by NtQuerySystemInformation with SYSTEM_INFORMATION_CLASS.SystemHandleInformation)

2: GetProcessIdOfThread

To use with an handle to a thread kernel object. (Possibly obtained by NtQuerySystemInformation with SYSTEM_INFORMATION_CLASS.SystemHandleInformation)

ntdll

3: NtQuerySystemInformation

public static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, uint Size, out uint Length);

Declare Function NtQuerySystemInformation Lib "ntdll.dll" (TODO) As TODO

public static IntPtr NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS infoClass, uint infoLength = 0)

var result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);

result = (UInt32)NativeMethods.NtQuerySystemInformation(NativeMethods.SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation, buff, result, out returnSize);

Documentation

[NtQuerySystemInformation] on MSDN

4: NtSetSystemInformation

This works in the same manner as NtQuerySystemInformation.

5: SYSTEM_INFORMATION_CLASS

Summary

Tells NtQuerySystemInformation and NtSetSystemInformation what you would like to read/change.

6: SYSTEM_MEMORY_LIST_INFORMATION

Summary

Structure returned by NtQuerySystemInformation in response to SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation = 0x0050

result = (UInt32)NativeMethods.NtQuerySystemInformation(NativeMethods.SYSTEM_INFORMATION_CLASS.SystemMemoryListInformation, buff, result, out returnSize);

Access PInvoke.net directly from VS: