Список потоков под Windows NT? Как получить?

Ищи описалово NtQuerySystemInformation, с параметром SystemProcessesAndThreadsInformation.

Нашел следующее:

NtQuerySystemInformation имеет прототип

NTSTATUS NTAPI NtQuerySystemInformation(
IN SYSTEMINFOCLASS SystemInformationClass,
OUT PVOID pSystemInformation,
IN ULONG uSystemInformationLength,
OUT PULONG puReturnLength
);

SystemInformationClass = SystemProcessesAndThreadsInformation (это 5, если кто не знает, описалово не везде есть)
pSystemInformation = выходной буфер, который будет содержать структуры "SYSTEM_PROCESS_INFORMATION"
uSystemInformationLength = размер подаваемого буфера
puReturnLength = кол-во записанных байт в буфер

структуры:

typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;

typedef enum
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
} THREAD_STATE;

typedef LONG KPRIORITY;

typedef struct _SYSTEM_THREAD
{
LARGE_INTEGER liKernelTime; // 100 nsec units
LARGE_INTEGER liUserTime; // 100 nsec units
LARGE_INTEGER liCreateTime; // relative to 01-01-1601
ULONG WaitTime; // ticks
PVOID pStartAddress; // EIP
CLIENT_ID Cid; // process/thread ids
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitches;
THREAD_STATE ThreadState;
KWAIT_REASON WaitReason;
} SYSTEM_THREAD, *PSYSTEM_THREAD;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
ULONG uNext; // relative offset
ULONG uThreadCount;
LARGE_INTEGER liUnknown1;
LARGE_INTEGER liUnknown2;
LARGE_INTEGER liUnknown3;
LARGE_INTEGER liCreateTime; // relative to 01-01-1601
LARGE_INTEGER liUserTime; // 100 nsec units
LARGE_INTEGER liKernelTime; // 100 nsec units
UNICODE_STRING usName;
KPRIORITY BasePriority;
ULONG uUniqueProcessId;
ULONG uInheritedFromUniqueProcessId;
ULONG uHandleCount;
ULONG uSessionId; // W2K Only!
DWORD dwUnknown5;
VM_COUNTERS VmCounters;
ULONG uCommitCharge; // bytes
SYSTEM_THREAD aST[];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

Меня интересует массив "SYSTEM_THREAD aST[];", а в структуре "SYSTEM_THREAD" отсутствует поле УНИКАЛЬНОГО ИДЕНТИФИКАТОРА ПОТОКА!!! В ней есть поле "CLIENT_ID Cid;", но что это два ХЭНДЛА?? И как выцепить DWORD dwThreadId; ??

Может и так. Вот мой код:

BYTE system_processes[102400];
DWORD dwError = 0;
ULONG ulLength = 0;
dwError = NtQuerySystemInformation((SYSTEMINFOCLASS)SystemProcessesAndThreadsInformation, (PSYSTEM_PROCESS_INFORMATION)system_processes, sizeof(system_processes), &ulLength);
if (dwError == 0)
{
PSYSTEM_PROCESS_INFORMATION pThisProc = (PSYSTEM_PROCESS_INFORMATION)system_processes;
PSYSTEM_PROCESS_INFORMATION pNextProc = pThisProc;
while (pNextProc->uNext != 0)
{
pNextProc = (PSYSTEM_PROCESS_INFORMATION)((PBYTE)pNextProc + pNextProc->uNext);
PSYSTEM_THREAD pThreads = pNextProc->aST;
DWORD dwThreadId = 0;
DWORD dwProcessId = 0;
for (int i = 0; i < pNextProc->uThreadCount; i++)
{
dwThreadId = (DWORD)pThreads.Cid.UniqueThread;
dwProcessId = (DWORD)pThreads.Cid.UniqueProcess;
}//for
}//while
}//if

Так вот в "dwThreadId" и в "dwProcessId" всякая херь, никак не соответствующая тому что есть!

Мот я чего не так вызываю???

Где же ты таких структур то понабрался? Они неправильные, смещения не соответствуют. Вот переделанный код с правильными структурами(_SYSTEM_THREADS и _SYSTEM_PROCESSES):

typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
} KWAIT_REASON, *PKWAIT_REASON;

typedef enum
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
} THREAD_STATE;

typedef LONG KPRIORITY;

typedef struct _SYSTEM_THREADS {
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG WaitTime;
PVOID StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG ContextSwitchCount;
THREAD_STATE State;
KWAIT_REASON WaitReason;
} SYSTEM_THREADS, *PSYSTEM_THREADS;

typedef struct _VM_COUNTERS {
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
ULONG QuotaPeakPagedPoolUsage;
ULONG QuotaPagedPoolUsage;
ULONG QuotaPeakNonPagedPoolUsage;
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
} VM_COUNTERS, *PVM_COUNTERS;

typedef struct _SYSTEM_PROCESSES { // Information Class 5
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters; // Windows 2000 only
SYSTEM_THREADS Threads[1];
} SYSTEM_PROCESSES, *PSYSTEM_PROCESSES;




BYTE system_processes[102400];
DWORD dwError = 0;
ULONG ulLength = 0;

void Main()
{char buff[256];


dwError = NtQuerySystemInformation(SystemProcessesAndThreadsInformation,
(PSYSTEM_PROCESSES)system_processes,
sizeof(system_processes),
&ulLength);
if (dwError == 0)
{
PSYSTEM_PROCESSES pThisProc = (PSYSTEM_PROCESSES)system_processes;
PSYSTEM_PROCESSES pNextProc = pThisProc;

wsprintf(buff, "Process ID = %lX, ThreadID = %lX", pNextProc->Threads->ClientId.UniqueThread, pNextProc->Threads->ClientId.UniqueProcess);
MessageBox(NULL, buff, "info", MB_OK);

while (pNextProc->NextEntryDelta != 0)
{
pNextProc = (PSYSTEM_PROCESSES)((PBYTE)pNextProc + pNextProc->NextEntryDelta);
PSYSTEM_THREADS pThreads = pNextProc->Threads;
DWORD dwThreadId = 0;
DWORD dwProcessId = 0;
for (int i = 0; i < pNextProc->ThreadCount; i++)
{
dwThreadId = (DWORD)pThreads.ClientId.UniqueThread;
dwProcessId = (DWORD)pThreads.ClientId.UniqueProcess;

wsprintf(buff, "Process ID = %lX, ThreadID = %lX", dwProcessId, dwThreadId);
MessageBox(NULL, buff, "info", MB_OK);

}//for
}//while
}//if

ExitProcess(NULL);}

В MessageBox показываются правильные идентификаторы процессов и потоков.

А в комплект какой доки SDK, DDK входят *.h-файлы с этими структурами?
А пока не мог бы ты мне кинуть эти файлы на мыло: [email]sjob@tut.by[/email]

Уже слил с етого сайта! Большое СПАСИБО что уделил свое время!