problem calling NtQuerySystemInformation
-
So I want to enumerate the processes using NtQuerySystemInformation() native api. I load it from ntdll.dll i use the process structure below unlike the one documented by microsoft. but i've seen that others use it too. typedef struct _SYSTEM_PROCESS_INFORMATION { DWORD dNext; DWORD dThreadCount; DWORD dReserved01; DWORD dReserved02; DWORD dReserved03; DWORD dReserved04; DWORD dReserved05; DWORD dReserved06; QWORD qCreateTime; QWORD qUserTime; QWORD qKernelTime; UNICODE_STRING usName; DWORD BasePriority; DWORD dUniqueProcessId; DWORD dInheritedFromUniqueProcessId; DWORD dHandleCount; DWORD dReserved07; DWORD dReserved08; VM_COUNTERS VmCounters; DWORD dCommitCharge; SYSTEM_THREAD Threads[1]; } SYSTEM_PROCESS_INFORMATION; the thing is that when I call it I don't get any error code or null pointers but the structure's members are zeros. the dNext member is not zero but I can't obtain the next pointer for another system_process_information because i get the invalid pointer error when I try this: if (ProcessInfo->dNext!=0) ProcessInfo=(SYSTEM_PROCESS_INFORMATION_DEF *)((ULONG *)ProcessInfo+ProcessInfo->dNext); And I have another question. How much space should I allocate for the ProcessInfo structure i only allocate for one structure SYSTEM_PROCESS_INFORMATION *ProcessInfo=(SYSTEM_PROCESS_INFORMATION *)malloc(sizeof(SYSTEM_PROCESS_INFORMATION)); or I shouldn't allocate at all. I will obtain a pointer to the structure anyway ? here is the code I use: HMODULE ntHinst; ntHinst=LoadLibraryA(NTDLL); if (ntHinst==NULL) { MessageBoxA(GetDesktopWindow(),"Error loading ntdll\nThe program will now end","ERROR",MB_ICONSTOP); return 0; } _NtQuerySystemInformation=(NTQUERYSYSTEMINFORMATION)GetProcAddress(ntHinst,"NtQuerySystemInformation"); if(!_NtQuerySystemInformation) { MessageBoxA(GetDesktopWindow(),"Error obtaining function pointer\nThe program will now terminate","ERROR",MB_ICONSTOP); return 0; } SYSTEM_PROCESS_INFORMATION *ProcessInfo=(SYSTEM_PROCESS_INFORMATION *)malloc(sizeof(SYSTEM_PROCESS_INFORMATION); if (IsBadReadPtr(ProcessInfo,sizeof(SYSTEM_PROCESS_INFORMATION))||IsBadWritePtr(ProcessInfo,sizeof(SYSTEM_PROCESS_INFORMATION))) return 0; _NtQuerySystemInformation(SystemProcessInformation ,(PVOID)ProcessInfo,sizeof(SYSTEM_P