葡京网上娱乐场NtQuerySystemInformation的动

  dwNumberBytes = sizeof(SYSTEM_CACHE_INFORMATION);
  Status  = NtQuerySystemInformation(SYSTEM_CACHE_INFO,
                           
&SystemCacheInfo,dwNumberBytes,&dwReturnLength);
  if(Status != STATUS_SUCCESS)
  {
   printf(“NtQuerySystemInformation for Cache Error:
%d\n”,GetLastError());
   __leave;
  }

总结C#中窗体间传递数据的几乎种植方式 (由别人的计整理)

转自:http://blog.csdn.net/daisy423xu/article/details/1579854

 
在编写C#windows应用程序的当儿我们常会面碰到这种问题,怎么样当有限只窗体间传递数据呢?以下是我整的网上的各种方式,在撞一个实际上问题:在form1中开拓一个form2窗口作为录入界面,将录入的值经转换后以form1中显得。
采用了托的方,可以实现。(与VC的回调的采取一般)

1.足以由此委托的道来化解

问题:通过form1做一个录入界面,将内通过文本框录入的数值复值给
form2中之listview各列,用3单textbox1.text比方吧,分别针对诺listview的3只列。

好如此做,如果少个窗体是以跟一个命名空间下

概念一个摄,注意这个代理是全局的:(即一律命名空间下,与Form1,Form2平级的)

public delegate void MyInvoke(string Item1,string Item2,string Item3);

 

//在窗体From2中生这样一个回调函数,用于在ListView里添加一个新项的:

private void UpdateListView(string Item1,string Item2,string Item3)

{

    ListView1.Items.Add(Item1);

    ListView1.Items[ListView1.Items.Count – 1].SubItems.Add(Item2);

    ListView1.Items[ListView1.Items.Count – 1].SubItems.Add(Item3);

}

 

//比如说点击Form2的一个按钮弹出Form1进行录入,在点击按钮的波下:

//把信托传过去

Form1 frmEdit=new Form1(new MyInvoke(UpdateListView));

frmEdit.ShowDialog(this);

 

//在Form1里定义一个特性

private MyInvoke mi=null;

 

当构造函数中吸收这委托:

public Form1(MyInvoke myInvoke)

{

   this.mi=myInvoke;

}

 

//录入数据后,点击OK按钮,在点击事件下:

//回调

this.mi(this.TextBox1.Text,this.TextBox3.Text,this.TextBox3.Text);

this.Close();//关闭Form1

补偿:如果自身只要想再将form2的价为form1,

Form1 frmEdit=new Form1(new MyInvoke(UpdateListView),string para1,string
para2…);

frmEdit.ShowDialog(this);

然后以Form1的构造函数改成为可以收几只参数的饶推行了。

 

2.假如主框架为Form1,打开的寻找对话框是Form2.一直当Form2类中表明一个Form1实例:Form1
f1=new
Form1();然后就是好透过f1来调用Form1中的地区和函数了。其实不是这般的,你发明的新的Form1实例不是原来的坏Form1对象了,这样操作的凡新的Form1中之所在和函数,和冠打开的Form1是没涉嫌之。

咱们如果开的是拿当前之Form1实例传递让Form2,如果是这样的话,问题就是坏好解决了。

方法1:首先,我们在Form2中定义:

private Form1 mF_Form

咱转移Form2的构造函数为来参数的

public Form2 ( Form1 myForm )
{
//
// Windows 窗体设计器支持所不可或缺的
//
InitializeComponent ( ) ;
this.mF_Form  = myForm ;  
/////这样在Form1中申明Form2的时节便拿Form1的实例传递过来了
//
// TODO: 在 InitializeComponent 调用后上加另构造函数代码
//
}

在Form1中,我以 要用到Form2的地方申明如下:

Form2 f2=new 
Form2(this);////这里的this指的就算是Form1当前底实例,也就是管目前Form1的实例通过Form2的构造函数传递让Form2类(其实当网上看了较笨的法门,就是当构造函数里面传递要传送的音讯要:字符串或是数字相当于,这样做老有局限性,不能够传递其他的,所有我们可以直接传送实例,来成功传递更多之音信。)

如此于Form2中运用myForm 就可本着原的Form1窗口进行操作了。但是你要把要操作的Form1中之地带和函数定义成public形式的(这样或不安全),此时底myForm就是当真的顶开始打开的Form1了,你得就此者实例来展开简单个窗体的报道了。
()

3.其实C#中提供了窗体间进行报道的备的性能,呵呵,我们能想到的,微软呢想到了,他们创造的语言其实诚可以说凡是人性化了。

当Form1类中申明Form2时用如下代码:

Form2 f2=new Form2();//////类Form2中的构造函数不改,还是无参的

f2.owner=this;////这里的this指的凡相仿Form1当前之实例。

//也足以利用函数的道,给当下实例添加一个隶属窗口 
代码:this.AddOwnedForm(f2);

于Form2类的概念着写如下代码:

Form1 f1=this.owner;

诸如此类f1对准许之饶是原先的Form1的实例了,也就是得就此者进行报道了。但是还是如把不同类中访问的地带和函数定义成public,哎,安全的确是一个题材!!

 

  4.行使静态类
    这个为是咱们常要用到的同等种植多少交互方式。

下面是概念的一个类:

using System;

using System.Collections;

namespace ZZ

{

     public class AppDatas

     {

         private static ArrayList listData;

         static AppDatas()

         {

              listData = new ArrayList();

              listData.Add(“DotNet”);

              listData.Add(“C#”);

              listData.Add(“Asp.net”);

              listData.Add(“WebService”);

              listData.Add(“XML”);

         }

         public static ArrayList ListData

         {

              get{return listData;}

         }

         public static ArrayList GetListData()

         {

              return listData;

         }

     }

}

面包含了一个静态类成员,listData,一个静态构造函数static
AppDatas(),用来初始化listData的数。还有一个静态属性ListData和一个静态GetListData()方法,他们落实了同一的效益就是归listData。

由于前两首文章就出口了不少,这里不仔细说了,下面是圆的代码:

Form1.cs文件

using System;

using System.Drawing;

using System.Collections;

using System.ComponentModel;

using System.Windows.Forms;

namespace ZZ

{

     public class Form1 : System.Windows.Forms.Form

     {

         private System.Windows.Forms.Button buttonEdit;

         private System.Windows.Forms.ListBox listBoxFrm1;

         private System.ComponentModel.Container components = null;

         public Form1()

         {

              InitializeComponent();

              this.listBoxFrm1.DataSource = AppDatas.ListData;

             

         }

         protected override void Dispose( bool disposing )

         {

              if( disposing )

                   if(components != null)

                       components.Dispose();

              base.Dispose( disposing );

         }

         [STAThread]

         static void Main()

         {

              Application.Run(new Form1());

         }

         private void InitializeComponent()

         {

              this.buttonEdit = new System.Windows.Forms.Button();

              this.listBoxFrm1 = new System.Windows.Forms.ListBox();

              this.SuspendLayout();

              this.buttonEdit.Location = new System.Drawing.Point(128,
108);

              this.buttonEdit.Name = “buttonEdit”;

              this.buttonEdit.TabIndex = 1;

              this.buttonEdit.Text = “修改”;

              this.buttonEdit.Click += new
System.EventHandler(this.buttonEdit_Click);

              this.listBoxFrm1.ItemHeight = 12;

              this.listBoxFrm1.Location = new System.Drawing.Point(12,
8);

              this.listBoxFrm1.Name = “listBoxFrm1”;

              this.listBoxFrm1.Size = new System.Drawing.Size(108, 124);

              this.listBoxFrm1.TabIndex = 2;

              this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);

              this.ClientSize = new System.Drawing.Size(208, 141);

              this.Controls.Add(this.listBoxFrm1);

              this.Controls.Add(this.buttonEdit);

              this.Name = “Form1”;

              this.Text = “Form1”;

              this.ResumeLayout(false);

         }

         private void buttonEdit_Click(object sender, System.EventArgs
e)

         {

              Form2 formChild = new Form2();

              formChild.ShowDialog();

              this.listBoxFrm1.DataSource = null;

              this.listBoxFrm1.DataSource = AppDatas.ListData;

         }

     }

}

 

Form2.cs文件

using System.Drawing;

using System.Collections;

using System.ComponentModel;

using System.Windows.Forms;

namespace ZZ

{

     public class Form2 : System.Windows.Forms.Form

     {

         private System.Windows.Forms.Button buttonOK;

         private System.ComponentModel.Container components = null;

         private System.Windows.Forms.ListBox listBoxFrm2;

         private System.Windows.Forms.Button buttonAdd;

         private System.Windows.Forms.Button buttonDel;

         private System.Windows.Forms.TextBox textBoxAdd;

         public Form2()

         {

              InitializeComponent();

              foreach(object o in AppDatas.ListData)

                   this.listBoxFrm2.Items.Add(o);

         }

         protected override void Dispose( bool disposing )

         {

              if( disposing )

                   if(components != null)

                       components.Dispose();

              base.Dispose( disposing );

         }

         private void InitializeComponent()

         {

              this.buttonOK = new System.Windows.Forms.Button();

              this.listBoxFrm2 = new System.Windows.Forms.ListBox();

              this.buttonAdd = new System.Windows.Forms.Button();

              this.buttonDel = new System.Windows.Forms.Button();

              this.textBoxAdd = new System.Windows.Forms.TextBox();

              this.SuspendLayout();

              this.buttonOK.Location = new System.Drawing.Point(188,
108);

              this.buttonOK.Name = “buttonOK”;

              this.buttonOK.TabIndex = 0;

              this.buttonOK.Text = “确定”;

              this.buttonOK.Click += new
System.EventHandler(this.buttonOK_Click);

              this.listBoxFrm2.ItemHeight = 12;

              this.listBoxFrm2.Location = new System.Drawing.Point(8,
8);

              this.listBoxFrm2.Name = “listBoxFrm2”;

              this.listBoxFrm2.Size = new System.Drawing.Size(168, 124);

              this.listBoxFrm2.TabIndex = 2;

              this.buttonAdd.Location = new System.Drawing.Point(188,
44);

              this.buttonAdd.Name = “buttonAdd”;

              this.buttonAdd.TabIndex = 3;

              this.buttonAdd.Text = “增加”;

              this.buttonAdd.Click += new
System.EventHandler(this.buttonAdd_Click);

              this.buttonDel.Location = new System.Drawing.Point(188,
76);

              this.buttonDel.Name = “buttonDel”;

              this.buttonDel.TabIndex = 4;

              this.buttonDel.Text = “删除”;

              this.buttonDel.Click += new
System.EventHandler(this.buttonDel_Click);

              this.textBoxAdd.Location = new System.Drawing.Point(188,
12);

              this.textBoxAdd.Name = “textBoxAdd”;

              this.textBoxAdd.Size = new System.Drawing.Size(76, 21);

              this.textBoxAdd.TabIndex = 5;

              this.textBoxAdd.Text = “”;

              this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);

              this.ClientSize = new System.Drawing.Size(272, 141);

              this.Controls.Add(this.textBoxAdd);

              this.Controls.Add(this.buttonDel);

              this.Controls.Add(this.buttonAdd);

              this.Controls.Add(this.listBoxFrm2);

              this.Controls.Add(this.buttonOK);

              this.Name = “Form2”;

              this.Text = “Form2”;

              this.ResumeLayout(false);

         }

         private void buttonOK_Click(object sender, System.EventArgs
e)
         {
              this.Close();
         }

         private void buttonAdd_Click(object sender, System.EventArgs
e)

         {

              if(this.textBoxAdd.Text.Trim().Length>0)

              {

                   AppDatas.ListData.Add(this.textBoxAdd.Text.Trim());

                  
this.listBoxFrm2.Items.Add(this.textBoxAdd.Text.Trim());

              }

              else

                   MessageBox.Show(“请输入添加的始末!”);

             

         }

         private void buttonDel_Click(object sender, System.EventArgs
e)

         {

              int index = this.listBoxFrm2.SelectedIndex;

              if(index!=-1)

              {

                    AppDatas.ListData.RemoveAt(index);

                   this.listBoxFrm2.Items.RemoveAt(index);

              }

              else

                   MessageBox.Show(“请捎去项!”);

         }

     }

}    

    
总结,我当使静态类比较多的地方就是是把应用程序的部署文件装载至一个静态类里面,让具备的窗体和其它实例都可透过静态属性与静态方法使用这些数量,比如三交汇构造还是多重叠构造都得以拜它,而非是当差不多个实例之中传来传去。在此间我们谈论的凡Windows窗体,其实以少数只例外之实例之中互动数据,都可以动用三篇稿子中之方案实现,除非是者近乎特有的属性或正法。现在都谈了了,虽然非是啊奥秘的东西,但是期望能够针对有些新家有所助,同时也接各位朋友进行技术交流,共同提高。

 

 

浅析者几乎栽方式:

1. 
下了寄托的艺术,可以兑现。:很好之落实了数码处理以及数量显示的分开,即FORM2(主)显示和FORM1数据处理,(不欲拿FORM2的亮身处FORM1中)与VC的回调的行使来可持续性。并且保证了FORM1中若改的特性的私有性。

 

2. 
方法2、3都是传递主窗口的援,比较简单易用。可以实现FORM2(主)与FORM1所发多少的传递(不过用以使FORM1传递及如改的数设为PUBLIC),而这么见面是安全题材。

 

寄方可充分好地实现数量的保安

 

总结C#中窗体间传递数据的几种办法(由人家的办法整理)

 

 
在编写C#windows应用程序的时我们常常会遇到这种问题,怎么样当有限单窗体间传递数据呢?以下是自身整理的网上的各种艺术,在碰到一个实在问题:在form1中开辟一个form2窗口作为录入界面,将录入的值经转换后当form1中形。
采用了寄托的方法,可以兑现。(与VC的回调的行使一般)

1.可经信托的点子来解决

问题:通过form1做一个录入界面,将内部通过文本框录入的数值复值给
form2中的listview各列,用3个textbox1.text举例吧,分别指向许listview的3单列。

可以这么做,如果简单独窗体是当与一个命名空间下

概念一个摄,注意是代理是全局的:(即一律命名空间下,与Form1,Form2平级的)

public delegate void MyInvoke(string Item1,string Item2,string Item3);

 

//在窗体From2遇产生这般一个回调函数,用于在ListView里添加一个新项的:

private void UpdateListView(string Item1,string Item2,string Item3)

{

    ListView1.Items.Add(Item1);

    ListView1.Items[ListView1.Items.Count – 1].SubItems.Add(Item2);

    ListView1.Items[ListView1.Items.Count – 1].SubItems.Add(Item3);

}

 

//比如说点击Form2的一个按钮弹出Form1进行录入,在点击按钮的波下:

//把信托传过去

Form1 frmEdit=new Form1(new MyInvoke(UpdateListView));

frmEdit.ShowDialog(this);

 

//在Form1里定义一个特性

private MyInvoke mi=null;

 

于构造函数中收取这委托:

public Form1(MyInvoke myInvoke)

{

   this.mi=myInvoke;

}

 

//录入数据后,点击OK按钮,在点击事件下:

//回调

this.mi(this.TextBox1.Text,this.TextBox3.Text,this.TextBox3.Text);

this.Close();//关闭Form1

补:如果自身如果想更将form2的价为form1,

Form1 frmEdit=new Form1(new MyInvoke(UpdateListView),string para1,string
para2…);

frmEdit.ShowDialog(this);

然后以Form1的构造函数改成为可以收到几只参数的即使执行了。

 

2.假如主框架为Form1,打开的搜对话框是Form2.直以Form2类中表明一个Form1实例:Form1
f1=new
Form1();然后就是得经f1来调用Form1中的处和函数了。其实不是这样的,你发明的新的Form1实例不是原来的好Form1对象了,这样操作的是初的Form1中之地面和函数,和第一打开的Form1是从未提到之。

咱若做的是拿当下底Form1实例传递让Form2,如果是这样的话,问题即充分好解决了。

方法1:首先,我们在Form2中定义:

private Form1 mF_Form

咱反Form2的构造函数为出参数的

public Form2 ( Form1 myForm )
{
//
// Windows 窗体设计器支持所不可或缺的
//
InitializeComponent ( ) ;
this.mF_Form  = myForm ;  
/////这样在Form1中申明Form2的时光便把Form1的实例传递过来了
//
// TODO: 在 InitializeComponent 调用后上加任何构造函数代码
//
}

在Form1中,我在 要用到Form2的地方申明如下:

Form2 f2=new 
Form2(this);////这里的this指的即是Form1当前底实例,也就算是拿目前Form1的实例通过Form2的构造函数传递让Form2类(其实以网上来看了较笨的方法,就是当构造函数里面传递要传送的消息要:字符串或是数字相当于,这样做充分有局限性,不克传递其他的,所有我们可以一直传送实例,来成功传递更多之音讯。)

诸如此类在Form2中采取myForm 就可对本来的Form1窗口进行操作了。但是若要是管要操作的Form1中的地面和函数定义成public形式的(如此也许未安全),此时之myForm就是真的的极致初步打开的Form1了,你可以用这实例来拓展有限只窗体的简报了。
()

3.其实C#受提供了窗体间展开报道的现的性,呵呵,我们能够想到的,微软也想到了,他们创造的语言其实确实可以说凡是人性化了。

以Form1类中申明Form2时用如下代码:

Form2 f2=new Form2();//////类Form2中之构造函数不更改,还是无参的

f2.owner=this;////这里的this指的是相近Form1当前的实例。

//也可行使函数的法门,给当下实例添加一个专属窗口 
代码:this.AddOwnedForm(f2);

当Form2类的定义着描写如下代码:

Form1 f1=this.owner;

如此f1针对许的就是是本来的Form1的实例了,也即可为此此进行报道了。但是还是如拿不同类中访问的地段和函数定义成public,哎,安全的确是一个题材!!

 

  4.采用静态类
    这个吧是咱们常要因此到的一律种植多少交互方式。

下面是概念的一个类似:

using System;

using System.Collections;

namespace ZZ

{

     public class AppDatas

     {

         private static ArrayList listData;

         static AppDatas()

         {

              listData = new ArrayList();

              listData.Add(“DotNet”);

              listData.Add(“C#”);

              listData.Add(“Asp.net”);

              listData.Add(“WebService”);

              listData.Add(“XML”);

         }

         public static ArrayList ListData

         {

              get{return listData;}

         }

         public static ArrayList GetListData()

         {

              return listData;

         }

     }

}

上面包含了一个静态类成员,listData,一个静态构造函数static
AppDatas(),用来初始化listData的数据。还有一个静态属性ListData和一个静态GetListData()方法,他们落实了一致的机能就是是返回listData。

由前两首文章曾讲了森,这里不密切说了,下面是圆的代码:

Form1.cs文件

using System;

using System.Drawing;

using System.Collections;

using System.ComponentModel;

using System.Windows.Forms;

namespace ZZ

{

     public class Form1 : System.Windows.Forms.Form

     {

         private System.Windows.Forms.Button buttonEdit;

         private System.Windows.Forms.ListBox listBoxFrm1;

         private System.ComponentModel.Container components = null;

         public Form1()

         {

              InitializeComponent();

              this.listBoxFrm1.DataSource = AppDatas.ListData;

             

         }

         protected override void Dispose( bool disposing )

         {

              if( disposing )

                   if(components != null)

                       components.Dispose();

              base.Dispose( disposing );

         }

         [STAThread]

         static void Main()

         {

              Application.Run(new Form1());

         }

         private void InitializeComponent()

         {

              this.buttonEdit = new System.Windows.Forms.Button();

              this.listBoxFrm1 = new System.Windows.Forms.ListBox();

              this.SuspendLayout();

              this.buttonEdit.Location = new System.Drawing.Point(128,
108);

              this.buttonEdit.Name = “buttonEdit”;

              this.buttonEdit.TabIndex = 1;

              this.buttonEdit.Text = “修改”;

              this.buttonEdit.Click += new
System.EventHandler(this.buttonEdit_Click);

              this.listBoxFrm1.ItemHeight = 12;

              this.listBoxFrm1.Location = new System.Drawing.Point(12,
8);

              this.listBoxFrm1.Name = “listBoxFrm1”;

              this.listBoxFrm1.Size = new System.Drawing.Size(108, 124);

              this.listBoxFrm1.TabIndex = 2;

              this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);

              this.ClientSize = new System.Drawing.Size(208, 141);

              this.Controls.Add(this.listBoxFrm1);

              this.Controls.Add(this.buttonEdit);

              this.Name = “Form1”;

              this.Text = “Form1”;

              this.ResumeLayout(false);

         }

         private void buttonEdit_Click(object sender, System.EventArgs
e)

         {

              Form2 formChild = new Form2();

              formChild.ShowDialog();

              this.listBoxFrm1.DataSource = null;

              this.listBoxFrm1.DataSource = AppDatas.ListData;

         }

     }

}

 

Form2.cs文件

using System.Drawing;

using System.Collections;

using System.ComponentModel;

using System.Windows.Forms;

namespace ZZ

{

     public class Form2 : System.Windows.Forms.Form

     {

         private System.Windows.Forms.Button buttonOK;

         private System.ComponentModel.Container components = null;

         private System.Windows.Forms.ListBox listBoxFrm2;

         private System.Windows.Forms.Button buttonAdd;

         private System.Windows.Forms.Button buttonDel;

         private System.Windows.Forms.TextBox textBoxAdd;

         public Form2()

         {

              InitializeComponent();

              foreach(object o in AppDatas.ListData)

                   this.listBoxFrm2.Items.Add(o);

         }

         protected override void Dispose( bool disposing )

         {

              if( disposing )

                   if(components != null)

                       components.Dispose();

              base.Dispose( disposing );

         }

         private void InitializeComponent()

         {

              this.buttonOK = new System.Windows.Forms.Button();

              this.listBoxFrm2 = new System.Windows.Forms.ListBox();

              this.buttonAdd = new System.Windows.Forms.Button();

              this.buttonDel = new System.Windows.Forms.Button();

              this.textBoxAdd = new System.Windows.Forms.TextBox();

              this.SuspendLayout();

              this.buttonOK.Location = new System.Drawing.Point(188,
108);

              this.buttonOK.Name = “buttonOK”;

              this.buttonOK.TabIndex = 0;

              this.buttonOK.Text = “确定”;

              this.buttonOK.Click += new
System.EventHandler(this.buttonOK_Click);

              this.listBoxFrm2.ItemHeight = 12;

              this.listBoxFrm2.Location = new System.Drawing.Point(8,
8);

              this.listBoxFrm2.Name = “listBoxFrm2”;

              this.listBoxFrm2.Size = new System.Drawing.Size(168, 124);

              this.listBoxFrm2.TabIndex = 2;

              this.buttonAdd.Location = new System.Drawing.Point(188,
44);

              this.buttonAdd.Name = “buttonAdd”;

              this.buttonAdd.TabIndex = 3;

              this.buttonAdd.Text = “增加”;

              this.buttonAdd.Click += new
System.EventHandler(this.buttonAdd_Click);

              this.buttonDel.Location = new System.Drawing.Point(188,
76);

              this.buttonDel.Name = “buttonDel”;

              this.buttonDel.TabIndex = 4;

              this.buttonDel.Text = “删除”;

              this.buttonDel.Click += new
System.EventHandler(this.buttonDel_Click);

              this.textBoxAdd.Location = new System.Drawing.Point(188,
12);

              this.textBoxAdd.Name = “textBoxAdd”;

              this.textBoxAdd.Size = new System.Drawing.Size(76, 21);

              this.textBoxAdd.TabIndex = 5;

              this.textBoxAdd.Text = “”;

              this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);

              this.ClientSize = new System.Drawing.Size(272, 141);

              this.Controls.Add(this.textBoxAdd);

              this.Controls.Add(this.buttonDel);

              this.Controls.Add(this.buttonAdd);

              this.Controls.Add(this.listBoxFrm2);

              this.Controls.Add(this.buttonOK);

              this.Name = “Form2”;

              this.Text = “Form2”;

              this.ResumeLayout(false);

         }

         private void buttonOK_Click(object sender, System.EventArgs
e)
         {
              this.Close();
         }

         private void buttonAdd_Click(object sender, System.EventArgs
e)

         {

              if(this.textBoxAdd.Text.Trim().Length>0)

              {

                   AppDatas.ListData.Add(this.textBoxAdd.Text.Trim());

                  
this.listBoxFrm2.Items.Add(this.textBoxAdd.Text.Trim());

              }

              else

                   MessageBox.Show(“请输入添加的情节!”);

             

         }

         private void buttonDel_Click(object sender, System.EventArgs
e)

         {

              int index = this.listBoxFrm2.SelectedIndex;

              if(index!=-1)

              {

                    AppDatas.ListData.RemoveAt(index);

                   this.listBoxFrm2.Items.RemoveAt(index);

              }

              else

                   MessageBox.Show(“请捎去项!”);

         }

     }

}    

    
总结,我道用静态类比较多的地方就是是把应用程序的布文件装载至一个静态类里面,让所有的窗体和其他实例都得经过静态属性和静态方法使用这些多少,比如三重合组织要多重合组织都可以拜它,而休是以差不多个实例之中传来传去。在此地我们谈谈的凡Windows窗体,其实在简单只不等的实例之中互动数据,都可采取三篇稿子中的方案实现,除非是此近乎特有的习性或正办法。现在犹谈了了,虽然未是什么奥秘的事物,但是想能针对一些新家有所助,同时也接各位朋友进行技术交流,共同提高。

 

 

浅析者几乎种方式:

1. 
使了托的措施,可以兑现。:很好的实现了数处理及数展示的分别,即FORM2(主)显示与FORM1数据处理,(不需要以FORM2的示身处FORM1中)与VC的回调的行使来可持续性。并且保证了FORM1中如改的特性的私有性。

 

2. 
方法2、3且是传递主窗口的援,比较简单易用。可以兑现FORM2(主)与FORM1所发出数据的传递(不过需要将设FORM1传递与而修改的多少设为PUBLIC),而这么见面存在安全题材。

 

信托方可死好地贯彻数量的保护

 

printf(“FastMdlReadWait:\t%-10d\t”,SystemPerfInfo.FastMdlReadWait);
printf(“FastMdlReadNoWait:\t%d\n”,SystemPerfInfo.FastMdlReadNoWait);
printf(“FastMdlReadNotPossible:\t%-10d\t”,SystemPerfInfo.FastMdlReadNotPossi
ble);
printf(“FastMdlReadResourceMiss:%d\n”,SystemPerfInfo.FastMdlReadResourceMiss
);

  NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”NtQuerySystemInformation”);
  if(NtQuerySystemInformation == NULL)
  {
   printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetLastError());
   __leave;
  }

#define SYSTEM_PERF_INFO             0x02
#define SYSTEM_PROC_TIME             0x08
#define SYSTEM_PAGE_INFO             0x12
#define SYSTEM_CACHE_INFO            0x15
#define MAX_INFO_BUF_LEN             0x500000
#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)

printf(“Privilege:\t\t
%d%%\t\t”,(pSystemProc->KernelTime.QuadPart * 100)/
(pSystemProc->KernelTime.QuadPart +
pSystemProc->UserTime.QuadPart));
printf(“User:\t\t\t%d%%\n”,(pSystemProc->UserTime.QuadPart *
100)/(pSystem
Proc->KernelTime.QuadPart + pSystemProc->UserTime.QuadPart));

printf(“LazyWriteIos:\t\t%-10d\t”,SystemPerfInfo.LazyWriteIos);
printf(“LazyWritePages:\t\t%d\n”,SystemPerfInfo.LazyWritePages);
printf(“DataPages:\t\t%-10d\t”,SystemPerfInfo.DataPages);
printf(“DataFlushes:\t\t%d\n”,SystemPerfInfo.DataFlushes);
printf(“FirstLevelTbFills:\t%-10d\t”,SystemPerfInfo.FirstLevelTbFills);
printf(“SecondLevelTbFills:\t%d\n”,SystemPerfInfo.SecondLevelTbFills);
printf(“ContextSwitches:\t%-10d\t”,SystemPerfInfo.ContextSwitches);
printf(“SytemCall:\t\t%d\n”,SystemPerfInfo.SystemCall);

    
printf(“%4d%%”,(pSystemProc->Threads[ulIndex].KernelTime.QuadPart
* 10
0)/(pSystemProc->KernelTime.QuadPart +
pSystemProc->UserTime.QuadPart));
     
printf(“%4d%%”,(pSystemProc->Threads[ulIndex].UserTime.QuadPart *
100
)/(pSystemProc->KernelTime.QuadPart +
pSystemProc->UserTime.QuadPart));

   
现在看来的是布局SYSTEM_PROCESSOR_TIMES提供的系处理器的动状况,包括各种状况下的下时以及暂停数目:

   
现在,我们来看看系统的性信息,性能结构SYSTEM_PERFORMANCE_INFORMATION为我们提供了70不必要种植系统性能方面的信,真是太丰富了,请慢慢体会~

switch(pSystemProc->Threads[ulIndex].WaitReason)
{
case Executive:
printf(” %-8s”,”Executi.”);
break;
case FreePage:
printf(” %-8s”,”FreePag.”);
break;
case PageIn:
printf(” %-8s”,”PageIn”);
break;
case PoolAllocation:
printf(” %-8s”,”PoolAll.”);
break;
case DelayExecution:
printf(” %-8s”,”DelayEx.”);
break;
case Suspended:
printf(” %-8s”,”Suspend.”);
break;
case UserRequest:
printf(” %-8s”,”UserReq.”);
break;
case WrExecutive:
printf(” %-8s”,”WrExect.”);
break;
case WrFreePage:
printf(” %-8s”,”WrFrePg.”);
break;
case WrPageIn:
printf(” %-8s”,”WrPageIn”);
break;
case WrPoolAllocation:
printf(” %-8s”,”WrPoolA.”);
break;
case WrSuspended:
printf(” %-8s”,”WrSuspe.”);
break;
case WrUserRequest:
printf(” %-8s”,”WrUsReq.”);
break;
case WrEventPair:
printf(” %-8s”,”WrEvent.”);
break;
case WrQueue:
printf(” %-8s”,”WrQueue”);
break;
case WrLpcReceive:
printf(” %-8s”,”WrLpcRv.”);
break;
case WrLpcReply:
printf(” %-8s”,”WrLpcRp.”);
break;
case WrVertualMemory:
printf(” %-8s”,”WrVerMm.”);
break;
case WrPageOut:
printf(” %-8s”,”WrPgOut.”);
break;
case WrRendezvous:
printf(” %-8s”,”WrRende.”);
break;
case WrKernel:
printf(” %-8s”,”WrKernel”);
break;
default:
printf(” %-8s”,”Unknown”);
break;
}
                 printf(“\n”);
}
                 
printf(“—————————————————-
—————————\n\n”);
                    printf(“Total %d Thread(s) !\n\n”,ulIndex);

printf(“UserTime:\t\t”);
llTempTime  = pSystemProc->UserTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

   
系统高速缓存的用状况参见结构SYSTEM_CACHE_INFORMATION提供的消息:

printf(“KernelTime:\t\t “);
llTempTime  = pSystemProc->KernelTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\t”,llTempTime);

typedef struct __SYSTEM_PROCESSOR_TIMES
{
LARGE_INTEGER IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER DpcTime;
LARGE_INTEGER InterruptTime;
ULONG         InterruptCount;
}SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}

typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
}CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

VOID Start()
{
 printf(“T-PMPerf, by TOo2y\n”);
 printf(“E-mail: TOo2y@safechina.net\n”);
 printf(“HomePage: www.safechina.net\n”);
 printf(“Date: 05-09-2003\n\n”);
 return ;
}

__try
{
hNtDll = LoadLibrary(“NtDll.dll”);
       if(hNtDll == NULL)
{
            printf(“LoadLibrary Error: %d\n”,GetLastError());
           __leave;
}

   
页文件之动情况,SYSTEM_PAGEFILE_INFORMATION提供了所急需的系消息:

2.T-PMPerf的条文件源代码:

typedef struct _SYSTEM_PROCESSES
{
ULONG          NextEntryDelta;
ULONG          ThreadCount;
ULONG          Reserved1[6];
LARGE_INTEGER  CreateTime;
LARGE_INTEGER  UserTime;
LARGE_INTEGER  KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY      BasePriority;
ULONG          ProcessId;
ULONG          InheritedFromProcessId;
ULONG          HandleCount;
ULONG          Reserved2[2];
VM_COUNTERS    VmCounters;
IO_COUNTERS    IoCounters;
SYSTEM_THREADS Threads[1];
}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

   
从中可以看,SystemInformationClass是一个类型信息,它大约提供了50不必要栽信息,也就是是咱们得透过是函数对大约50基本上种的系统信息进行探测或设置。SystemInformation是一个LPVOID型的指针,它呢我们提供用取的音讯,或是我们得装的系统信息。SystemInformationLength是SystemInformation的长,它根据探测的信项目来决
毫无疑问。至于ReturnLength则是系统返回的消之长,通常可以设置为空指针(NULL)。

       printf(“%3d”,pSystemProc->Threads[ulIndex].Priority);
printf(“%4d”,pSystemProc->Threads[ulIndex].BasePriority);

1.T-PMList的条文件源代码:

printf(“BasePriority:\t\t %-2d\t\t”,pSystemProc->BasePriority);
printf(“PageFaultCount:\t\t%d\n\n”,pSystemProc->VmCounters.PageFaultCount)
;

printf(“CopyReadWait:\t\t%-10d\t”,SystemPerfInfo.CopyReadWait);
printf(“CopyReadNoWait:\t\t%d\n”,SystemPerfInfo.CopyReadNoWait);
printf(“CopyReadWaitMiss:\t%-10d\t”,SystemPerfInfo.CopyReadWaitMiss);
printf(“CopyReadNoWaitMiss:\t%-10d\n”,SystemPerfInfo.CopyReadNoWaitMiss);
printf(“MdlReadWait:\t\t%-10d\t”,SystemPerfInfo.MdlReadWait);
printf(“MdlReadNoWait:\t\t%d\n”,SystemPerfInfo.MdlReadNoWait);
printf(“MdlReadWaitMiss:\t%-10d\t”,SystemPerfInfo.MdlReadWaitMiss);
printf(“MdlReadNoWaitMiss:\t%d\n”,SystemPerfInfo.MdlReadNoWaitMiss);

printf(” 0x%.8X”,pSystemProc->Threads[ulIndex].StartAddress);
printf(“%7d”,pSystemProc->Threads[ulIndex].ContextSwitchCount);

printf(“\n”);
dwTotalProcess ++;
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc +
pSystemProc->NextEn
tryDelta);
}
printf(“——————————————————————–
——\n”);
printf(“\nTotal %d Process(es) !\n\n”,dwTotalProcess);
printf(“PID\t ==> Process Identification\n”);
printf(“PPID\t ==> Parent Process Identification\n”);
printf(“WsSize\t ==> Working Set Size\n”);
printf(“Prio.\t ==> Base Priority\n”);
printf(“Thread\t ==> Thread Count\n”);
printf(“Handle\t ==> Handle Count\n”);
printf(“CPU Time ==> Processor Time\n”);
}
__finally
{
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
        FreeLibrary(hNtDll);
}
}

typedef struct _LSA_UNICODE_STRING
{
USHORT  Length;
USHORT  MaximumLength;
PWSTR   Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

typedef struct _SYSTEM_THREADS
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG         WaitTime;
PVOID         StartAddress;
CLIENT_ID     ClientId;
KPRIORITY     Priority;
KPRIORITY     BasePriority;
ULONG         ContextSwitchCount;
THREAD_STATE  State;
KWAIT_REASON  WaitReason;
}SYSTEM_THREADS,*PSYSTEM_THREADS;

return 0;
}

typedef enum _KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVertualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel
}KWAIT_REASON;

printf(“FastReadWait:\t\t%-10d\t”,SystemPerfInfo.FastReadWait);
printf(“FastReadNoWait:\t\t%d\n”,SystemPerfInfo.FastReadNoWait);
printf(“FastReadNoPossible:\t%-10d\t”,SystemPerfInfo.FastReadNotPossible);

printf(“IdleTime:\t\t”);
llTempTime  = SystemProcTime.IdleTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

typedef LONG KPRIORITY;

printf(“MapDataWait:\t\t%-10d\t”,SystemPerfInfo.MapDataWait);
printf(“MapDataNoWait:\t\t%d\n”,SystemPerfInfo.MapDataNoWait);
printf(“MapDataWaitMiss:\t%-10d\t”,SystemPerfInfo.MapDataWaitMiss);
printf(“MapDataNoWaitMiss:\t%d\n”,SystemPerfInfo.MapDataNoWaitMiss);

DWORD SpeciProcess(DWORD dwPID)
{
       PSYSTEM_PROCESSES  pSystemProc    = NULL;
PSYSTEM_THREADS    pSystemThre    = NULL;
HMODULE            hNtDll         = NULL;
LPVOID             lpSystemInfo   = NULL;
DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
DWORD              dwTotalProcess = 0;
DWORD              dwReturnLength;
NTSTATUS           Status;
LONGLONG           llTempTime;
ULONG              ulIndex;

VOID Usage()
{
 printf(“Usage:\tT-PMPerf <Option>\n”);
 printf(“Option:\n”);
 printf(”  -Perf   System Performance Information\n”);
 printf(”  -Proc   System Processor Information\n”);
 printf(”  -Page   System Pagefile Information\n”);
 printf(”  -Cache  System Cache Information\n”);
 return ;
}

printf(“PagesRead:\t\t%-10d\t”,SystemPerfInfo.PagesRead);
printf(“PageReadIos:\t\t%d\n”,SystemPerfInfo.PageReadIos);
printf(“PagesWritten:\t\t%-10d\t”,SystemPerfInfo.PagefilePagesWritten);
printf(“PageWriteIos:\t\t%d\n”,SystemPerfInfo.PagefilePageWriteIos);
printf(“MappedFilePagesWritten:\t%-10d\t”,SystemPerfInfo.MappedFilePagesWrit
ten);
printf(“MappedFileWriteIos:\t%d\n”,SystemPerfInfo.MappedFileWriteIos);

typedef struct _IO_COUNTERS
{
LARGE_INTEGER ReadOperationCount;
LARGE_INTEGER WriteOperationCount;
LARGE_INTEGER OtherOperationCount;
LARGE_INTEGER ReadTransferCount;
LARGE_INTEGER WriteTransferCount;
LARGE_INTEGER OtherTransferCount;
}IO_COUNTERS,*PIO_COUNTERS;

附录:(所有完整源代码,您可以到我们FZ5FZ的主页下载)。

DWORD EnumProcess()
{
       PSYSTEM_PROCESSES  pSystemProc;
HMODULE            hNtDll         = NULL;
LPVOID             lpSystemInfo   = NULL;
DWORD              dwNumberBytes  = MAX_INFO_BUF_LEN;
DWORD              dwTotalProcess = 0;
DWORD              dwReturnLength;
NTSTATUS           Status;
LONGLONG           llTempTime;

dwNumberBytes = MAX_INFO_BUF_LEN;
pBuffer = (LPVOID)malloc(dwNumberBytes);
Status  = NtQuerySystemInformation(SYSTEM_PAGE_INFO,
                            pBuffer,
 dwNumberBytes,
 &dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf(“NtQuerySystemInformation for Pagefile Error:
%d\n”,GetLastError());

#endif

printf(“PeakPagefile(K):\t
%-8d\t”,pSystemProc->VmCounters.PeakPagefileUsa
ge/1024);
printf(“Pagefile(K):\t\t%-8d\n”,pSystemProc->VmCounters.PagefileUsage/1024
);

__try
{
hNtDll = LoadLibrary(“NtDll.dll”);
            if(hNtDll == NULL)
{
             printf(“LoadLibrary Error: %d\n”,GetLastError());
        __leave;
}

typedef struct _LSA_UNICODE_STRING
{
USHORT  Length;
USHORT  MaximumLength;
PWSTR   Buffer;
}LSA_UNICODE_STRING,*PLSA_UNICODE_STRING;
typedef LSA_UNICODE_STRING UNICODE_STRING, *PUNICODE_STRING;

printf(“SystemCodePage:\t\t%-10d\t”,SystemPerfInfo.SystemCodePage);
printf(“TotalSystemCodePage:\t%d\n”,SystemPerfInfo.TotalSystemCodePages);
printf(“TotalFreeSysPTE:\t%-10d\t”,SystemPerfInfo.TotalFreeSystemPtes);
printf(“TotalSystemDriverPages:\t%d\n”,SystemPerfInfo.TotalSystemDriverPages
);
printf(“PagedPoolPage:\t\t%-10d\t”,SystemPerfInfo.PagedPoolPage);
printf(“SystemDriverPage:\t%d\n”,SystemPerfInfo.SystemDriverPage);

DWORD PerfInfo()
{
SYSTEM_PERFORMANCE_INFORMATION SystemPerfInfo;
HMODULE         hNtDll = NULL;
DWORD           dwNumberBytes;
DWORD           dwReturnLength;
NTSTATUS        Status;
LONGLONG        llTempTime;

NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
if(NtQuerySystemInformation == NULL)
{
printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetLastErr
or());
__leave;
}

llTempTime  = pSystemProc->Threads[ulIndex].KernelTime.QuadPart;
llTempTime /= 10000;
printf(“%2d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d.”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 100;
printf(“%.2d “,llTempTime);

#include <windows.h>
#include <stdio.h>

return 0;
}

NtQuerySystemInformation的使用
2011-12-19 11:23 77人阅读 评论(0) 收藏 举报
 

typedef LONG NTSTATUS;

printf(“IdleTime:\t\t”);
llTempTime  = SystemPerfInfo.IdleTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

printf(“%-5s%3s%4s%5s%5s%11s%12s%12s%7s%6s%9s\n”,”TID”,”Pri”,”BPr”,”Priv”,
“User”,”KernelTime”,”UserTime”,”StartAddr”,”CSwitC”,”State”,”WtReason”);
           
printf(“———————————————————
———————-\n”);

   
今天,我们要讨论的凡一个函数NtQuerySystemInformation(ZwQuerySystemInformation)。当然,你不要看不起这么一个函数,它却也咱提供了丰富的体系信息,同时还担保
满对一些信息的控制和装。以下是这个函数的原型:

printf(“MemorySystemCachePage:\t\t\t%d\n”,SystemPerfInfo.MmSystemCachePage);

printf(“PagedPoolUsage:\t\t%-10d\t”,SystemPerfInfo.PagedPoolUsage);
printf(“NonPagedPoolUsage:\t%d\n”,SystemPerfInfo.NonPagedPoolUsage);
printf(“PagedPoolAllocs:\t%-10d\t”,SystemPerfInfo.PagedPoolAllocs);
printf(“NonPagedPoolAllocs:\t%d\n”,SystemPerfInfo.NonPagedPoolAllocs);
printf(“PagedPoolFrees:\t\t%-10d\t”,SystemPerfInfo.PagedPoolFrees);
printf(“NonPagedPoolFrees:\t%d\n”,SystemPerfInfo.NonPagedPoolFress);

typedef enum _THREAD_STATE
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
}THREAD_STATE;

printf(“PeakVirtualSize(K):\t
%-8d\t”,pSystemProc->VmCounters.PeakVirtualS
ize/1024);
printf(“VirtualSize(K):\t\t%-8d\n\n”,pSystemProc->VmCounters.VirtualSize/1
024);

printf(“ReadOperationCount:\t%-10d\t”,SystemPerfInfo.ReadOperationCount);
printf(“ReadTransferCount:\t%d\n”,SystemPerfInfo.ReadTransferCount);
printf(“WriteOperationCount:\t%-10d\t”,SystemPerfInfo.WriteOperationCount);

return 0;
}

 typedef struct _SYSTEM_PERFORMANCE_INFORMATION
 {
  LARGE_INTEGER  IdleTime;                    //CPU空闲时;
  LARGE_INTEGER  ReadTransferCount;           //I/O读操作数目;
  LARGE_INTEGER  WriteTransferCount;          //I/O写操作数目;
  LARGE_INTEGER  OtherTransferCount;          //I/O其他操作数目;
  ULONG          ReadOperationCount;          //I/O读数据数目;
  ULONG          WriteOperationCount;         //I/O写多少数目;
  ULONG          OtherOperationCount;         //I/O其他操作数据数目;
  ULONG          AvailablePages;              //可获得的页数目;
  ULONG          TotalCommittedPages;         //总共提交页数目;
  ULONG          TotalCommitLimit;            //已提交页数目;
  ULONG          PeakCommitment;              //页提交峰值;
  ULONG          PageFaults;                  //页故障数目;
  ULONG          WriteCopyFaults;            
//Copy-On-Write故障数目;
  ULONG          TransitionFaults;            //软页故障数目;
  ULONG          Reserved1;
  ULONG          DemandZeroFaults;            //需求0故障数;
  ULONG          PagesRead;                   //读页数目;
  ULONG          PageReadIos;                 //读页I/O操作数;
  ULONG          Reserved2[2];
  ULONG          PagefilePagesWritten;        //已写页文件页数;
  ULONG          PagefilePageWriteIos;        //已写页文件操作数;
  ULONG          MappedFilePagesWritten;      //已写映射文件页数;
  ULONG          MappedFileWriteIos;          //已写映射文件操作数;
  ULONG          PagedPoolUsage;              //分页池使用;
  ULONG          NonPagedPoolUsage;           //非分页池使用;
  ULONG          PagedPoolAllocs;             //分页池分配情况;
  ULONG          PagedPoolFrees;              //分页池释放情况;
  ULONG          NonPagedPoolAllocs;          //非分页池分配情况;
  ULONG          NonPagedPoolFress;           //非分页池释放情况;
  ULONG          TotalFreeSystemPtes;         //系统页表项释放总数;
  ULONG          SystemCodePage;              //操作系统代码页数;
  ULONG          TotalSystemDriverPages;      //可分页驱动程序页数;
  ULONG          TotalSystemCodePages;        //操作系统代码页总数;
  ULONG          SmallNonPagedLookasideListAllocateHits; //
  ULONG          SmallPagedLookasideListAllocateHits;
  ULONG          Reserved3;                  
  ULONG          MmSystemCachePage;          //系统缓存页数;
  ULONG          PagedPoolPage;              //分页池页数;
  ULONG          SystemDriverPage;           //可分页驱动页数;
  ULONG          FastReadNoWait;             //异步快速读数目;
  ULONG          FastReadWait;               //同步快速读数目;
  ULONG          FastReadResourceMiss;       //快速读资源撞数;
  ULONG          FastReadNotPossible;        //快速读失败数;
  ULONG          FastMdlReadNoWait;          //异步MDL快速读数目;
  ULONG          FastMdlReadWait;            //同步MDL快速读数目;
  ULONG          FastMdlReadResourceMiss;    //MDL读资源撞数;
  ULONG          FastMdlReadNotPossible;     //MDL读失败数;
  ULONG          MapDataNoWait;              //异步映射数据次数;
  ULONG          MapDataWait;                //同步映射数据次数;
  ULONG          MapDataNoWaitMiss;          //异步映射数据冲突次数;
  ULONG          MapDataWaitMiss;            //同步映射数据冲突次数;
  ULONG          PinMappedDataCount;         //牵制映射数据数目;
  ULONG          PinReadNoWait;              //牵制异步读数目;
  ULONG          PinReadWait;                //牵制同步读数目;
  ULONG          PinReadNoWaitMiss;          //牵制异步读冲突数目;
  ULONG          PinReadWaitMiss;            //牵制同步读冲突数目;
  ULONG          CopyReadNoWait;             //异步拷贝读次数;
  ULONG          CopyReadWait;               //同步拷贝读次数;
  ULONG          CopyReadNoWaitMiss;         //异步拷贝读故障次数;
  ULONG          CopyReadWaitMiss;           //同步拷贝读故障次数;
  ULONG          MdlReadNoWait;              //异步MDL读次数;
  ULONG          MdlReadWait;                //同步MDL读次数;
  ULONG          MdlReadNoWaitMiss;          //异步MDL读故障次数;
  ULONG          MdlReadWaitMiss;            //同步MDL读故障次数;
  ULONG          ReadAheadIos;               //向前读操作数目;
  ULONG          LazyWriteIos;               //LAZY写操作数目;
  ULONG          LazyWritePages;             //LAZY写页文件数量;
  ULONG          DataFlushes;                //缓存刷新次数;
  ULONG          DataPages;                  //缓存刷新页数;
  ULONG          ContextSwitches;            //环境切换数目;
  ULONG          FirstLevelTbFills;          //第一重合缓冲区填充次数;
  ULONG          SecondLevelTbFills;         //第二重叠缓冲区填充次数;
  ULONG          SystemCall;                 //系统调用次数;
 }SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;

typedef DWORD    SYSTEM_INFORMATION_CLASS;
typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
                 (IN     SYSTEM_INFORMATION_CLASS,
    IN OUT PVOID,
    IN     ULONG,
    OUT    PULONG OPTIONAL);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

 __try
 {
  hNtDll = LoadLibrary(“NtDll.dll”);
         if(hNtDll == NULL)
  {
    printf(“LoadLibrary Error: %d\n”,GetLastError());
   __leave;
  }

printf(“ThreadCount:\t\t %d\t\t”,pSystemProc->ThreadCount);
printf(“HandleCount:\t\t%d\n”,pSystemProc->HandleCount);

 typedef struct _SYSTEM_PAGEFILE_INFORMATION
 {
  ULONG NetxEntryOffset;                //下一个组织的偏移量;
  ULONG CurrentSize;                    //当前页文件大小;
  ULONG TotalUsed;                      //当前采用的页文件数;
  ULONG PeakUsed;                       //当前以的页文件峰值数;
  UNICODE_STRING FileName;              //页文件的文件名称;
 }SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

 typedef struct _SYSTEM_CACHE_INFORMATION
 {
  ULONG SystemCacheWsSize;              //高速缓存大小;
  ULONG SystemCacheWsPeakSize;          //高速缓存峰值大小;
  ULONG SystemCacheWsFaults;            //高速缓存页故障数目;
  ULONG SystemCacheWsMinimum;           //高速缓存最小页大小;
  ULONG SystemCacheWsMaximum;           //高速缓存最充分页大小;
  ULONG TransitionSharedPages;          //共享页数目;
  ULONG TransitionSharedPagesPeak;      //共享页峰值数目;
  ULONG Reserved[2];
 }SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

dwNumberBytes = sizeof(SYSTEM_PERFORMANCE_INFORMATION);
Status = NtQuerySystemInformation(SYSTEM_PERF_INFO,
                           &SystemPerfInfo,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf(“NtQuerySystemInformation for Performance Error:
%d\n”,GetLastError(
));
__leave;
}

printf(“PageFault:\t\t%-10d\t”,SystemPerfInfo.PageFaults);
printf(“WriteCopyFault:\t\t%d\n”,SystemPerfInfo.WriteCopyFaults);
printf(“TransitionFault:\t%-10d\t”,SystemPerfInfo.TransitionFaults);
printf(“DemandZeroFault:\t%d\n”,SystemPerfInfo.DemandZeroFaults);

 typedef NTSTATUS (__stdcall *NTQUERYSYSTEMINFORMATION)
    (IN      SYSTEM_INFORMATION_CLASS SystemInformationClass,
     IN OUT  PVOID                    SystemInformation,
     IN      ULONG                    SystemInformationLength,
     OUT     PULONG                   ReturnLength  OPTIONAL);
 NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

DWORD ProcTime()
{
SYSTEM_PROCESSOR_TIMES  SystemProcTime;
HMODULE                 hNtDll = NULL;
DWORD                   dwNumberBytes;
DWORD                   dwReturnLength;
NTSTATUS                Status;
LONGLONG                llTempTime;

printf(“PeakWorkingSetSize(K):\t
%-8d\t”,pSystemProc->VmCounters.PeakWorki
ngSetSize/1024);
printf(“WorkingSetSize(K):\t%-8d\n”,pSystemProc->VmCounters.WorkingSetSize
/1024);

printf(“%-20s%6s%7s%8s%6s%7s%7s%13s\n”,”ProcessName”,”PID”,”PPID”,”WsSize”,”
Prio.”,”Thread”,”Handle”,”CPU Time”);
printf(“——————————————————————–
——\n”);
pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId != 0)
{
wprintf(L”%-20s”,pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L”%-20s”,L”System Idle Process”);
}
printf(“%6d”,pSystemProc->ProcessId);
printf(“%7d”,pSystemProc->InheritedFromProcessId);
printf(“%7dK”,pSystemProc->VmCounters.WorkingSetSize/1024);
printf(“%6d”,pSystemProc->BasePriority);
printf(“%7d”,pSystemProc->ThreadCount);
printf(“%7d”,pSystemProc->HandleCount);
llTempTime  = pSystemProc->KernelTime.QuadPart +
pSystemProc->UserTime.Quad
Part;
llTempTime /= 10000;
printf(“%3d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d”,llTempTime);

DWORD PagefileInfo()
{
PSYSTEM_PAGEFILE_INFORMATION   pSystemPagefileInfo;
PVOID                          pBuffer;
HMODULE                        hNtDll = NULL;
DWORD                          dwNumberBytes;
DWORD                          dwReturnLength;
       NTSTATUS                       Status;

printf(“SmallPagedLookasideListAllocateHits:\t%d\n”,SystemPerfInfo.SmallPage
dLookasideListAllocateHits);
printf(“SmallNonPagedLookasideListAllocateHits:\t%d\n”,SystemPerfInfo.SmallN
onPagedLookasideListAllocateHits);

#endif

NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
      if(NtQuerySystemInformation == NULL)
{
        printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetL
astError());
             __leave;
}

printf(“DpcTime:\t\t”);
llTempTime  = SystemProcTime.DpcTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

printf(“InterruptTime:\t\t”);
llTempTime  = SystemProcTime.InterruptTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

typedef struct _VM_COUNTERS
{
ULONG PeakVirtualSize;
ULONG VirtualSize;
ULONG PageFaultCount;
ULONG PeakWorkingSetSize;
ULONG WorkingSetSize;
ULONG QuotaPeakPagedPoolUsage;
ULONG QuotaPagedPoolUsage;
ULONG QuotaPeakNonPagedPoolUsage;
ULONG QuotaNonPagedPoolUsage;
ULONG PagefileUsage;
ULONG PeakPagefileUsage;
}VM_COUNTERS,*PVM_COUNTERS;

Status = NtQuerySystemInformation(SYSTEM_PROC_TIME,
                           &SystemProcTime,
dwNumberBytes,
&dwReturnLength);
if(Status != STATUS_SUCCESS)
{
printf(“NtQuerySystemInformation for Processor Time Error:
%d\n”,GetLastErr
or());
__leave;
}

printf(“PeakNonPagedPook(K):\t
%-8d\t”,pSystemProc->VmCounters.QuotaPeakNo
nPagedPoolUsage/1024);
printf(“NonePagedPook(K):\t%-8d\n”,pSystemProc->VmCounters.QuotaNonPagedPo
olUsage/1024);

llTempTime  = pSystemProc->Threads[ulIndex].UserTime.QuadPart;
llTempTime /= 10000;
printf(“%2d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d.”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 100;
printf(“%.2d “,llTempTime);

printf(“PeakPagedPool(K):\t
%-8d\t”,pSystemProc->VmCounters.QuotaPeakPaged
PoolUsage/1024);
printf(“PagedPool(K):\t\t%-8d\n”,pSystemProc->VmCounters.QuotaPagedPoolUsa
ge/1024);

#include “windows.h”
#include “stdio.h”

typedef struct _SYSTEM_CACHE_INFORMATION
{
ULONG SystemCacheWsSize;
ULONG SystemCacheWsPeakSize;
ULONG SystemCacheWsFaults;
ULONG SystemCacheWsMinimum;
ULONG SystemCacheWsMaximum;
ULONG TransitionSharedPages;
ULONG TransitionSharedPagesPeak;
ULONG Reserved[2];
}SYSTEM_CACHE_INFORMATION,*PSYSTEM_CACHE_INFORMATION;

VOID Usage()
{
printf(“Usage:\tT-PMList  [-e] | [-s PID]\n”);
printf(”  -e\t  Enumerate All Processes\n”);
printf(”  -s PID  Show Special Process Information with PID\n\n”);
return ;
}

    以上这些信应该是比较健全的了,在Win32
API里为我们提供了PSAPI(进程状态)和ToolHelp32顿时点儿种植探测系统进程/线程信息的方法,在Windows2K/XP/2003都支持其。

NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
if(NtQuerySystemInformation == NULL)
{
printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetLastErr
or());
__leave;
}

typedef struct _SYSTEM_PAGEFILE_INFORMATION
{
ULONG NetxEntryOffset;
ULONG CurrentSize;
ULONG TotalUsed;
ULONG PeakUsed;
UNICODE_STRING FileName;
}SYSTEM_PAGEFILE_INFORMATION,*PSYSTEM_PAGEFILE_INFORMATION;

#define NT_PROCESSTHREAD_INFO        0x05
#define MAX_INFO_BUF_LEN             0x500000
#define STATUS_SUCCESS               ((NTSTATUS)0x00000000L)
#define STATUS_INFO_LENGTH_MISMATCH  ((NTSTATUS)0xC0000004L)

 typedef struct _SYSTEM_PROCESSES
 {
  ULONG          NextEntryDelta;          //构成组织序列的偏移量;
  ULONG          ThreadCount;             //线程数目;
  ULONG          Reserved1[6];          
  LARGE_INTEGER  CreateTime;              //创建时间;
  LARGE_INTEGER  UserTime;                //用户模式(Ring
3)的CPU时间;
  LARGE_INTEGER  KernelTime;              //内核模式(Ring
0)的CPU时间;
  UNICODE_STRING ProcessName;             //进程名称;
  KPRIORITY      BasePriority;            //进程优先权;
  ULONG          ProcessId;               //进程标识符;
  ULONG          InheritedFromProcessId;  //父进程的标识符;
  ULONG          HandleCount;             //句柄数目;
  ULONG          Reserved2[2];
  VM_COUNTERS    VmCounters;              //虚拟存储器的组织,见下;
  IO_COUNTERS    IoCounters;              //IO计数结构,见下;
  SYSTEM_THREADS Threads[1];             
//进程有关线程的组织数组,见下;
 }SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

printf(“ReadAheadIos:\t\t%-10d\t”,SystemPerfInfo.ReadAheadIos);
printf(“PinMappedDataCount:\t%d\n”,SystemPerfInfo.PinMappedDataCount);
printf(“PinReadWait:\t\t%-10d\t”,SystemPerfInfo.PinReadWait);
printf(“PinReadNoWait:\t\t%d\n”,SystemPerfInfo.PinReadNoWait);
printf(“PinReadWaitMiss:\t%-10d\t”,SystemPerfInfo.PinReadWaitMiss);
printf(“PinReadNoWaitMiss:\t%d\n”,SystemPerfInfo.PinReadNoWaitMiss);

 
printf(“CacheWorkingSetSize:\t\t%d(KB)\n”,SystemCacheInfo.SystemCacheWsSize1024);
 
printf(“CacheWorkingSetPeakSize:\t%d(KB)\n”,SystemCacheInfo.SystemCacheWsPeakSize/1024);
 
printf(“CacheWorkingSetFaults:\t\t%d\n”,SystemCacheInfo.SystemCacheWsFaults);
 
printf(“CacheWorkingSetMinimum:\t\t%d\n”,SystemCacheInfo.SystemCacheWsMinimum);
 
printf(“CacheWorkingSetMaximum:\t\t%d\n”,SystemCacheInfo.SystemCacheWsMaximum);
 
printf(“TransitionSharedPages:\t\t%d\n”,SystemCacheInfo.TransitionSharedPages);
 
printf(“TransitionSharedPagesPeak:\t%d\n”,SystemCacheInfo.TransitionSharedPagesPeak);

printf(“OtherTransfer:\t\t
%-8d\t”,pSystemProc->IoCounters.OtherTransferCo
unt);
printf(“OtherOperationCount:\t%-8d\n\n”,pSystemProc->IoCounters.OtherOpera
tionCount);

 typedef struct _IO_COUNTERS
 {
  LARGE_INTEGER ReadOperationCount;       //I/O读操作数目;
  LARGE_INTEGER WriteOperationCount;      //I/O写操作数目;
  LARGE_INTEGER OtherOperationCount;      //I/O其他操作数目;
  LARGE_INTEGER ReadTransferCount;        //I/O读数据数目;
  LARGE_INTEGER WriteTransferCount;       //I/O写多少数目;
  LARGE_INTEGER OtherTransferCount;       //I/O其他操作数据数目;
 }IO_COUNTERS,*PIO_COUNTERS;

NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
           if(NtQuerySystemInformation == NULL)
{
        printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetL
astError());
         __leave;
}

 typedef struct __SYSTEM_PROCESSOR_TIMES
 {
  LARGE_INTEGER IdleTime;               //空闲时间;
  LARGE_INTEGER KernelTime;             //内核模式时;
  LARGE_INTEGER UserTime;               //用户模式时;
  LARGE_INTEGER DpcTime;                //延迟过程调用时间;
  LARGE_INTEGER InterruptTime;          //中断时间;
  ULONG         InterruptCount;         //中断次数;
 }SYSTEM_PROCESSOR_TIMES,*PSYSTEM_PROCESSOR_TIMES;

#ifndef T_PMPERF_H
#define T_PMPERF_H

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                           lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf(“STATUS_INFO_LENGTH_MISMATCH\n”);
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf(“NtQuerySystemInformation Error: %d\n”,GetLastError());
__leave;
}

#ifndef T_PMLIST_H
#define T_PMLIST_H

pSystemProc = (PSYSTEM_PROCESSES)lpSystemInfo;
while(pSystemProc->NextEntryDelta != 0)
{
if(pSystemProc->ProcessId == dwPID)
{
printf(“ProcessName:\t\t “);
if(pSystemProc->ProcessId != 0)
{
wprintf(L”%-20s\n”,pSystemProc->ProcessName.Buffer);
}
else
{
wprintf(L”%-20s\n”,L”System Idle Process”);
}
printf(“ProcessID:\t\t %d\t\t”,pSystemProc->ProcessId);
printf(“ParentProcessID:\t%d\n”,pSystemProc->InheritedFromProcessId);

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)pBuffer;
do
{
printf(“CurrentPagefileSize:\t%d\n”,pSystemPagefileInfo->CurrentSize);
printf(“TotalPagefileUsed:\t%d\n”,pSystemPagefileInfo->TotalUsed);
printf(“PeakPagefileUsed:\t%d\n”,pSystemPagefileInfo->PeakUsed);
wprintf(L”PagefileFileName:\t%s\n”,pSystemPagefileInfo->FileName.Buffer);

return 0;
}

printf(“ReadTransfer:\t\t
%-8d\t”,pSystemProc->IoCounters.ReadTransferCoun
t);
printf(“ReadOperationCount:\t%-8d\n”,pSystemProc->IoCounters.ReadOperation
Count);

VOID Start()
{
printf(“T-PMList, by TOo2y\n”);
printf(“E-mail: TOo2y@safechina.net\n”);
printf(“HomePage: www.safechina.net\n”);
printf(“Date: 05-10-2003\n\n”);
return ;
}

typedef NTSTATUS (__stdcall * NTQUERYSYSTEMINFORMATION)
                 (IN     SYSTEM_INFORMATION_CLASS,
    IN OUT PVOID,
    INT    ULONG,
           OUT    PULONG OPTION);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

for(ulIndex = 0; ulIndex < pSystemProc->ThreadCount; ulIndex++)
{
pSystemThre = &pSystemProc->Threads[ulIndex];
printf(“%-5d”,pSystemProc->Threads[ulIndex].ClientId.UniqueThread);

__try
{
hNtDll = LoadLibrary(“NtDll.dll”);
       if(hNtDll == NULL)
{
          printf(“LoadLibrary Error: %d\n”,GetLastError());
         __leave;
}

switch(pSystemProc->Threads[ulIndex].State)
{
case StateInitialized:
printf(“%6s”,”Init.”);
break;
case StateReady:
printf(“%6s”,”Ready”);
break;
case StateRunning:
printf(“%6s”,”Run”);
break;
case StateStandby:
printf(“%6s”,”StBy.”);
break;
case StateTerminated:
printf(“%6s”,”Term.”);
break;
case StateWait:
printf(“%6s”,”Wait”);
break;
case StateTransition:
printf(“%6s”,”Tran.”);
break;
case StateUnknown:
printf(“%6s”,”Unkn.”);
break;
default:
printf(“%6s”,”Unkn.”);
break;
}

   
首先,我们来看看大家比较熟悉的网经过/线程相关的音信。这个题目在网上就讨论了N多年了,所以自己便无在末常提了,呵呵。那么就是提出这组织类型的定义:

printf(“InterruptCount:\t\t%d\n”,SystemProcTime.InterruptCount);

printf(“AvailablePages:\t\t%-10d\t”,SystemPerfInfo.AvailablePages);
printf(“TotalCommittedPage:\t%d\n”,SystemPerfInfo.TotalCommittedPages);
printf(“CommitLimit:\t\t%-10d\t”,SystemPerfInfo.TotalCommitLimit);
printf(“PeakCommitment:\t\t%d\n”,SystemPerfInfo.PeakCommitment);

dwNumberBytes = sizeof(SYSTEM_PROCESSOR_TIMES);
NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
if(NtQuerySystemInformation == NULL)
{
printf(“GetProcAddress Error: %d\n”,GetLastError());
__leave;
}

__try
{
hNtDll = LoadLibrary(“NtDll.dll”);
            if(hNtDll == NULL)
{
            printf(“LoadLibrary Error: %d\n”,GetLastError());
               __leave;
}

typedef LONG  NTSTATUS;
typedef DWORD SYSTEM_INFORMATION_CLASS;

printf(“FastReadResourceMiss:\t%d\n”,SystemPerfInfo.FastReadResourceMiss);

__try
{
hNtDll = LoadLibrary(“NtDll.dll”);
       if(hNtDll == NULL)
{
          printf(“LoadLibrary Error: %d\n”,GetLastError());
        __leave;
}

printf(“WriteTransferCount:\t%d\n”,SystemPerfInfo.WriteTransferCount);
printf(“OtherOperationCount:\t%-10d\t”,SystemPerfInfo.OtherOperationCount);

__leave;
}

DWORD CacheInfo()
{
 SYSTEM_CACHE_INFORMATION       SystemCacheInfo;
 HMODULE                        hNtDll = NULL;
 DWORD                          dwNumberBytes;
 DWORD                          dwReturnLength;
 NTSTATUS                       Status;

printf(“WriteTransfer:\t\t
%-8d\t”,pSystemProc->IoCounters.WriteTransferCo
unt);
printf(“WriteOperationCount:\t%-8d\n”,pSystemProc->IoCounters.WriteOperati
onCount);

NtQuerySystemInformation =
(NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,”
NtQuerySystemInformation”);
if(NtQuerySystemInformation == NULL)
{
printf(“GetProcAddress for NtQuerySystemInformation Error:
%d\n”,GetLastErr
or());
__leave;
}

 }__finally
 {
  if(hNtDll != NULL)
  {
  FreeLibrary(hNtDll);
  }
 }

 return 0;
}

dwTotalProcess ++;
break;
}
pSystemProc = (PSYSTEM_PROCESSES)((char *)pSystemProc +
pSystemProc->NextEn
tryDelta);
}
}
__finally
{
if(dwTotalProcess == 0)
{
printf(“Could not found the %d Process !\n”,dwPID);
}
else
{
printf(“TID:\t\t====>\tThread Identification\n”);
printf(“Pri:\t\t====>\tPriority\n”);
printf(“BPr:\t\t====>\tBase Priority\n”);
printf(“Priv:\t\t====>\tPrivilege\n”);
printf(“StartAddr:\t====>\tThread Start Address\n”);
printf(“CSwitC:\t\t====>\tContext Switch Count\n”);
printf(“WtReason:\t====>\tWait Reason\n”);
}
if(lpSystemInfo != NULL)
{
free(lpSystemInfo);
}
if(hNtDll != NULL)
{
        FreeLibrary(hNtDll);
}
}

printf(“KernelTime:\t\t”);
llTempTime  = SystemProcTime.KernelTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

 typedef struct _VM_COUNTERS
 {
  ULONG PeakVirtualSize;                  //虚拟存储峰值大小;
  ULONG VirtualSize;                      //虚拟存储大小;
  ULONG PageFaultCount;                   //页故障数目;
  ULONG PeakWorkingSetSize;               //工作集峰值大小;
  ULONG WorkingSetSize;                   //工作集大小;
  ULONG QuotaPeakPagedPoolUsage;          //分页池使用配额峰值;
  ULONG QuotaPagedPoolUsage;              //分页池使用配额;
  ULONG QuotaPeakNonPagedPoolUsage;       //非分页池使用配额峰值;
  ULONG QuotaNonPagedPoolUsage;           //非分页池使用配额;
  ULONG PagefileUsage;                    //页文件使用状况;
  ULONG PeakPagefileUsage;                //页文件使用峰值;
 }VM_COUNTERS,*PVM_COUNTERS;

}
__finally
{
if(hNtDll != NULL)
{
FreeLibrary(hNtDll);
}
}

pSystemPagefileInfo = (PSYSTEM_PAGEFILE_INFORMATION)((char *)pBuffer

printf(“UserTime:\t\t”);
llTempTime  = SystemProcTime.UserTime.QuadPart;
llTempTime /= 10000;
printf(“%d:”,llTempTime/(60*60*1000));
llTempTime %= 60*60*1000;
printf(“%.2d:”,llTempTime/(60*1000));
llTempTime %= 60*1000;
printf(“%.2d.”,llTempTime/1000);
llTempTime %= 1000;
printf(“%.3d\n”,llTempTime);

 typedef struct _SYSTEM_THREADS
 {
  LARGE_INTEGER KernelTime;               //CPU内核模式下时;
  LARGE_INTEGER UserTime;                 //CPU用户模式采用时间;
  LARGE_INTEGER CreateTime;               //线程创建时间;
  ULONG         WaitTime;                 //等待时;
  PVOID         StartAddress;             //线程开始的虚拟地址;
  CLIENT_ID     ClientId;                 //线程标识符;
  KPRIORITY     Priority;                 //线程优先级;
  KPRIORITY     BasePriority;             //基本优先级;
  ULONG         ContextSwitchCount;       //环境切换数目;
  THREAD_STATE  State;                    //当前状态;
  KWAIT_REASON  WaitReason;               //等待原因;
 }SYSTEM_THREADS,*PSYSTEM_THREADS;

lpSystemInfo = (LPVOID)malloc(dwNumberBytes);
Status = NtQuerySystemInformation(NT_PROCESSTHREAD_INFO,
                           lpSystemInfo,
dwNumberBytes,
&dwReturnLength);
if(Status == STATUS_INFO_LENGTH_MISMATCH)
{
printf(“STATUS_INFO_LENGTH_MISMATCH\n”);
__leave;
}
else if(Status != STATUS_SUCCESS)
{
printf(“NtQuerySystemInformation Error: %d\n”,GetLastError());
__leave;
}

  • pSys
    temPagefileInfo->NetxEntryOffset);
    }while(pSystemPagefileInfo->NetxEntryOffset != 0);
    }
    __finally
    {
    if(pBuffer != NULL)
    {
    free(pBuffer);
    }
    if(hNtDll  != NULL)
    {
    FreeLibrary(hNtDll);
    }
    }

return 0;
}

printf(“OtherTransferCount:\t%d\n”,SystemPerfInfo.OtherTransferCount);

typedef struct _SYSTEM_PERFORMANCE_INFORMATION
{
LARGE_INTEGER  IdleTime;
LARGE_INTEGER  ReadTransferCount;
LARGE_INTEGER  WriteTransferCount;
LARGE_INTEGER  OtherTransferCount;
ULONG          ReadOperationCount;
ULONG          WriteOperationCount;
ULONG          OtherOperationCount;
ULONG          AvailablePages;
ULONG          TotalCommittedPages;
ULONG          TotalCommitLimit;
ULONG          PeakCommitment;
ULONG          PageFaults;
ULONG          WriteCopyFaults;
ULONG          TransitionFaults;
ULONG          Reserved1;
ULONG          DemandZeroFaults;
ULONG          PagesRead;
ULONG          PageReadIos;
ULONG          Reserved2[2];
ULONG          PagefilePagesWritten;
ULONG          PagefilePageWriteIos;
ULONG          MappedFilePagesWritten;
ULONG          MappedFileWriteIos;
ULONG          PagedPoolUsage;
ULONG          NonPagedPoolUsage;
ULONG          PagedPoolAllocs;
ULONG          PagedPoolFrees;
ULONG          NonPagedPoolAllocs;
ULONG          NonPagedPoolFress;
ULONG          TotalFreeSystemPtes;
ULONG          SystemCodePage;
ULONG          TotalSystemDriverPages;
ULONG          TotalSystemCodePages;
ULONG          SmallNonPagedLookasideListAllocateHits;
ULONG          SmallPagedLookasideListAllocateHits;
ULONG          Reserved3;
ULONG          MmSystemCachePage;
ULONG          PagedPoolPage;
ULONG          SystemDriverPage;
ULONG          FastReadNoWait;
ULONG          FastReadWait;
ULONG          FastReadResourceMiss;
ULONG          FastReadNotPossible;
ULONG          FastMdlReadNoWait;
ULONG          FastMdlReadWait;
ULONG          FastMdlReadResourceMiss;
ULONG          FastMdlReadNotPossible;
ULONG          MapDataNoWait;
ULONG          MapDataWait;
ULONG          MapDataNoWaitMiss;
ULONG          MapDataWaitMiss;
ULONG          PinMappedDataCount;
ULONG          PinReadNoWait;
ULONG          PinReadWait;
ULONG          PinReadNoWaitMiss;
ULONG          PinReadWaitMiss;
ULONG          CopyReadNoWait;
ULONG          CopyReadWait;
ULONG          CopyReadNoWaitMiss;
ULONG          CopyReadWaitMiss;
ULONG          MdlReadNoWait;
ULONG          MdlReadWait;
ULONG          MdlReadNoWaitMiss;
ULONG          MdlReadWaitMiss;
ULONG          ReadAheadIos;
ULONG          LazyWriteIos;
ULONG          LazyWritePages;
ULONG          DataFlushes;
ULONG          DataPages;
ULONG          ContextSwitches;
ULONG          FirstLevelTbFills;
ULONG          SecondLevelTbFills;
ULONG          SystemCall;
}SYSTEM_PERFORMANCE_INFORMATION,*PSYSTEM_PERFORMANCE_INFORMATION;