src/WhoUses/SystemInfo.h

   1 // Written by Zoltan Csizmadia, zoltan_csizmadia@yahoo.com
   2 // For companies(Austin,TX): If you would like to get my resume, send an email.
   3 //
   4 // The source is free, but if you want to use it, mention my name and e-mail address
   5 //
   6 //////////////////////////////////////////////////////////////////////////////////////
   7 //
   8 // SystemInfo.h, v1.1
   9
  10 #ifndef SYSTEMINFO_H_INCLUDED
  11 #define SYSTEMINFO_H_INCLUDED
  12
  13 #ifndef WINNT
  14 #error You need Windows NT to use this source code. Define WINNT!
  15 #endif
  16
  17 #if _MSC_VER > 1000
  18 #pragma once
  19 #endif // _MSC_VER > 1000
  20
  21 #pragma warning( disable : 4786 )
  22 #pragma warning( disable : 4200 )
  23
  24 #include <map>
  25 #include <string>
  26 #include <list>
  27 using std::map;
  28 using std::string;
  29 using std::list;
  30
  31 ///////////////////////////////////////////////////////////////////////////////
  32 //
  33 // Typedefs
  34 //
  35 ///////////////////////////////////////////////////////////////////////////////
  36
  37 typedef struct _UNICODE_STRING
  38 {
  39         WORD  Length;
  40         WORD  MaximumLength;
  41         PWSTR Buffer;
  42 } UNICODE_STRING;
  43
  44 ///////////////////////////////////////////////////////////////////////////////
  45 //
  46 // SystemInfoUtils
  47 //
  48 ///////////////////////////////////////////////////////////////////////////////
  49
  50 // Helper functions
  51
  52 class SystemInfoUtils
  53 {
  54 public:
  55
  56         ///////////////////////////////////////////////////////////////////////
  57         // String conversion functions
  58
  59         // From wide char string to string
  60         static void LPCWSTR2string( LPCWSTR strW, string& str );
  61         // From unicode string to string
  62         static void Unicode2string( UNICODE_STRING* strU, string& str );
  63
  64         ///////////////////////////////////////////////////////////////////////
  65         // File name conversion functions
  66
  67         static BOOL GetDeviceFileName( LPCTSTR, string& );
  68         static BOOL GetFsFileName( LPCTSTR, string& );
  69
  70         ///////////////////////////////////////////////////////////////////////
  71         // Information functions
  72
  73         static DWORD GetNTMajorVersion();
  74 };
  75
  76 ///////////////////////////////////////////////////////////////////////////////
  77 //
  78 // INtDll
  79 //
  80 ///////////////////////////////////////////////////////////////////////////////
  81
  82 class INtDll
  83 {
  84 public:
  85         typedef DWORD (WINAPI *PNtQueryObject)( HANDLE, DWORD, VOID*, DWORD, VOID* );
  86         typedef DWORD (WINAPI *PNtQuerySystemInformation)( DWORD, VOID*, DWORD, ULONG* );
  87         typedef DWORD (WINAPI *PNtQueryInformationThread)(HANDLE, ULONG, PVOID, DWORD, DWORD* );
  88         typedef DWORD (WINAPI *PNtQueryInformationFile)(HANDLE, PVOID,  PVOID, DWORD, DWORD );
  89         typedef DWORD (WINAPI *PNtQueryInformationProcess)(HANDLE, DWORD, PVOID, DWORD, PVOID );
  90
  91 public:
  92         static PNtQuerySystemInformation        NtQuerySystemInformation;
  93         static PNtQueryObject                           NtQueryObject;
  94         static PNtQueryInformationThread        NtQueryInformationThread;
  95         static PNtQueryInformationFile          NtQueryInformationFile;
  96         static PNtQueryInformationProcess       NtQueryInformationProcess;
  97
  98         static BOOL                                                     NtDllStatus;
  99
 100         static DWORD                                            dwNTMajorVersion;
 101
 102 protected:
 103         static BOOL Init();
 104 };
 105
 106 ///////////////////////////////////////////////////////////////////////////////
 107 //
 108 // SystemProcessInformation
 109 //
 110 ///////////////////////////////////////////////////////////////////////////////
 111
 112 class SystemProcessInformation : public INtDll
 113 {
 114 public:
 115         typedef LARGE_INTEGER   QWORD;
 116
 117         typedef struct _PROCESS_BASIC_INFORMATION {
 118                         DWORD ExitStatus;
 119                         PVOID PebBaseAddress;
 120                         DWORD AffinityMask;
 121                         DWORD BasePriority;
 122                         DWORD UniqueProcessId;
 123                         DWORD InheritedFromUniqueProcessId;
 124                 } PROCESS_BASIC_INFORMATION;
 125
 126         typedef struct _VM_COUNTERS
 127                 {
 128                 DWORD PeakVirtualSize;
 129                 DWORD VirtualSize;
 130                 DWORD PageFaultCount;
 131                 DWORD PeakWorkingSetSize;
 132                 DWORD WorkingSetSize;
 133                 DWORD QuotaPeakPagedPoolUsage;
 134                 DWORD QuotaPagedPoolUsage;
 135                 DWORD QuotaPeakNonPagedPoolUsage;
 136                 DWORD QuotaNonPagedPoolUsage;
 137                 DWORD PagefileUsage;
 138                 DWORD PeakPagefileUsage;
 139                 } VM_COUNTERS;
 140
 141         typedef struct _SYSTEM_THREAD
 142                 {
 143                 DWORD        u1;
 144                 DWORD        u2;
 145                 DWORD        u3;
 146                 DWORD        u4;
 147                 DWORD        ProcessId;
 148                 DWORD        ThreadId;
 149                 DWORD        dPriority;
 150                 DWORD        dBasePriority;
 151                 DWORD        dContextSwitches;
 152                 DWORD        dThreadState;      // 2=running, 5=waiting
 153                 DWORD        WaitReason;
 154                 DWORD        u5;
 155                 DWORD        u6;
 156                 DWORD        u7;
 157                 DWORD        u8;
 158                 DWORD        u9;
 159                 } SYSTEM_THREAD;
 160
 161         typedef struct _SYSTEM_PROCESS_INFORMATION
 162                 {
 163                 DWORD          dNext;
 164                 DWORD          dThreadCount;
 165                 DWORD          dReserved01;
 166                 DWORD          dReserved02;
 167                 DWORD          dReserved03;
 168                 DWORD          dReserved04;
 169                 DWORD          dReserved05;
 170                 DWORD          dReserved06;
 171                 QWORD          qCreateTime;
 172                 QWORD          qUserTime;
 173                 QWORD          qKernelTime;
 174                 UNICODE_STRING usName;
 175                 DWORD          BasePriority;
 176                 DWORD          dUniqueProcessId;
 177                 DWORD          dInheritedFromUniqueProcessId;
 178                 DWORD          dHandleCount;
 179                 DWORD          dReserved07;
 180                 DWORD          dReserved08;
 181                 VM_COUNTERS    VmCounters;
 182                 DWORD          dCommitCharge;
 183                 SYSTEM_THREAD  Threads[1];
 184                 } SYSTEM_PROCESS_INFORMATION;
 185
 186         enum { BufferSize = 0x10000 };
 187
 188 public:
 189         SystemProcessInformation( BOOL bRefresh = FALSE );
 190         virtual ~SystemProcessInformation();
 191
 192         BOOL Refresh();
 193
 194 public:
 195         map< DWORD, SYSTEM_PROCESS_INFORMATION*> m_ProcessInfos;
 196         SYSTEM_PROCESS_INFORMATION* m_pCurrentProcessInfo;
 197
 198 protected:
 199         UCHAR*                                          m_pBuffer;
 200 };
 201
 202 ///////////////////////////////////////////////////////////////////////////////
 203 //
 204 // SystemThreadInformation
 205 //
 206 ///////////////////////////////////////////////////////////////////////////////
 207
 208 class SystemThreadInformation : public INtDll
 209 {
 210 public:
 211         typedef struct _THREAD_INFORMATION
 212                 {
 213                 DWORD           ProcessId;
 214                 DWORD           ThreadId;
 215                 HANDLE          ThreadHandle;
 216                 } THREAD_INFORMATION;
 217
 218
 219         typedef struct _BASIC_THREAD_INFORMATION {
 220                 DWORD u1;
 221                 DWORD u2;
 222                 DWORD u3;
 223                 DWORD ThreadId;
 224                 DWORD u5;
 225                 DWORD u6;
 226                 DWORD u7;
 227         } BASIC_THREAD_INFORMATION;
 228
 229 public:
 230         SystemThreadInformation( DWORD pID = (DWORD)-1, BOOL bRefresh = FALSE );
 231
 232         BOOL Refresh();
 233
 234 public:
 235         list< THREAD_INFORMATION > m_ThreadInfos;
 236         DWORD m_processId;
 237 };
 238
 239
 240 ///////////////////////////////////////////////////////////////////////////////
 241 //
 242 // SystemHandleInformation
 243 //
 244 ///////////////////////////////////////////////////////////////////////////////
 245
 246 class SystemHandleInformation : public INtDll
 247 {
 248 public:
 249         enum {
 250                 OB_TYPE_UNKNOWN = 0,
 251                 OB_TYPE_TYPE = 1,
 252                 OB_TYPE_DIRECTORY,
 253                 OB_TYPE_SYMBOLIC_LINK,
 254                 OB_TYPE_TOKEN,
 255                 OB_TYPE_PROCESS,
 256                 OB_TYPE_THREAD,
 257                 OB_TYPE_UNKNOWN_7,
 258                 OB_TYPE_EVENT,
 259                 OB_TYPE_EVENT_PAIR,
 260                 OB_TYPE_MUTANT,
 261                 OB_TYPE_UNKNOWN_11,
 262                 OB_TYPE_SEMAPHORE,
 263                 OB_TYPE_TIMER,
 264                 OB_TYPE_PROFILE,
 265                 OB_TYPE_WINDOW_STATION,
 266                 OB_TYPE_DESKTOP,
 267                 OB_TYPE_SECTION,
 268                 OB_TYPE_KEY,
 269                 OB_TYPE_PORT,
 270                 OB_TYPE_WAITABLE_PORT,
 271                 OB_TYPE_UNKNOWN_21,
 272                 OB_TYPE_UNKNOWN_22,
 273                 OB_TYPE_UNKNOWN_23,
 274                 OB_TYPE_UNKNOWN_24,
 275                 //OB_TYPE_CONTROLLER,
 276                 //OB_TYPE_DEVICE,
 277                 //OB_TYPE_DRIVER,
 278                 OB_TYPE_IO_COMPLETION,
 279                 OB_TYPE_FILE
 280         } SystemHandleType;
 281
 282 public:
 283         typedef struct _SYSTEM_HANDLE
 284         {
 285                 DWORD   ProcessID;
 286                 WORD    HandleType;
 287                 WORD    HandleNumber;
 288                 DWORD   KernelAddress;
 289                 DWORD   Flags;
 290         } SYSTEM_HANDLE;
 291
 292         typedef struct _SYSTEM_HANDLE_INFORMATION
 293         {
 294                 DWORD                   Count;
 295                 SYSTEM_HANDLE   Handles[1];
 296         } SYSTEM_HANDLE_INFORMATION;
 297
 298 protected:
 299         typedef struct _GetFileNameThreadParam
 300         {
 301                 HANDLE          hFile;
 302                 string* pName;
 303                 ULONG           rc;
 304         } GetFileNameThreadParam;
 305
 306 public:
 307         SystemHandleInformation( DWORD pID = (DWORD)-1, BOOL bRefresh = FALSE, LPCTSTR lpTypeFilter = NULL );
 308         ~SystemHandleInformation();
 309
 310         BOOL SetFilter( LPCTSTR lpTypeFilter, BOOL bRefresh = TRUE );
 311         const string& GetFilter();
 312
 313         BOOL Refresh();
 314
 315 public:
 316         //Information functions
 317         static BOOL GetType( HANDLE, WORD&, DWORD processId = GetCurrentProcessId() );
 318         static BOOL GetTypeToken( HANDLE, string&, DWORD processId = GetCurrentProcessId() );
 319         static BOOL GetTypeFromTypeToken( LPCTSTR typeToken, WORD& type );
 320         static BOOL GetNameByType( HANDLE, WORD, string& str, DWORD processId = GetCurrentProcessId());
 321         static BOOL GetName( HANDLE, string&, DWORD processId = GetCurrentProcessId() );
 322
 323         //Thread related functions
 324         static BOOL GetThreadId( HANDLE, DWORD&, DWORD processId = GetCurrentProcessId() );
 325
 326         //Process related functions
 327         static BOOL GetProcessId( HANDLE, DWORD&, DWORD processId = GetCurrentProcessId() );
 328         static BOOL GetProcessPath( HANDLE h, string& strPath, DWORD processId = GetCurrentProcessId());
 329
 330         //File related functions
 331         static BOOL GetFileName( HANDLE, string&, DWORD processId = GetCurrentProcessId() );
 332
 333 public:
 334         //For remote handle support
 335         static HANDLE OpenProcess( DWORD processId );
 336         static HANDLE DuplicateHandle( HANDLE hProcess, HANDLE hRemote );
 337
 338 protected:
 339         static void GetFileNameThread( PVOID /* GetFileNameThreadParam* */ );
 340         BOOL IsSupportedHandle( SYSTEM_HANDLE& handle );
 341
 342 public:
 343         list< SYSTEM_HANDLE > m_HandleInfos;
 344         DWORD   m_processId;
 345
 346 protected:
 347         string  m_strTypeFilter;
 348 };
 349
 350 ///////////////////////////////////////////////////////////////////////////////
 351 //
 352 // SystemModuleInformation
 353 //
 354 ///////////////////////////////////////////////////////////////////////////////
 355
 356 class SystemModuleInformation
 357 {
 358 public:
 359         typedef struct _MODULE_INFO
 360         {
 361                 DWORD   ProcessId;
 362                 TCHAR   FullPath[_MAX_PATH];
 363                 HMODULE Handle;
 364         } MODULE_INFO;
 365
 366 public:
 367         typedef DWORD (WINAPI *PEnumProcessModules)(
 368                                 HANDLE hProcess,      // handle to process
 369                                 HMODULE *lphModule,   // array of module handles
 370                                 DWORD cb,             // size of array
 371                                 LPDWORD lpcbNeeded    // number of bytes required
 372                         );
 373
 374         typedef DWORD (WINAPI *PGetModuleFileNameEx)(
 375                                 HANDLE hProcess,    // handle to process
 376                                 HMODULE hModule,    // handle to module
 377                                 LPTSTR lpFilename,  // path buffer
 378                                 DWORD nSize         // maximum characters to retrieve
 379                         );
 380
 381 public:
 382         SystemModuleInformation( DWORD pID = (DWORD)-1, BOOL bRefresh = FALSE );
 383
 384         BOOL Refresh();
 385
 386 protected:
 387         void GetModuleListForProcess( DWORD processID );
 388
 389 public:
 390         DWORD m_processId;
 391         list< MODULE_INFO > m_ModuleInfos;
 392
 393 protected:
 394         PEnumProcessModules             m_EnumProcessModules;
 395         PGetModuleFileNameEx    m_GetModuleFileNameEx;
 396 };
 397
 398 ///////////////////////////////////////////////////////////////////////////////
 399 //
 400 // SystemWindowInformation
 401 //
 402 ///////////////////////////////////////////////////////////////////////////////
 403
 404 class SystemWindowInformation
 405 {
 406 public:
 407         enum { MaxCaptionSize = 1024 };
 408
 409         typedef struct _WINDOW_INFO
 410         {
 411                 DWORD   ProcessId;
 412                 TCHAR   Caption[MaxCaptionSize];
 413                 HWND    hWnd;
 414         } WINDOW_INFO;
 415
 416 public:
 417         SystemWindowInformation( DWORD pID = (DWORD)-1, BOOL bRefresh = FALSE );
 418
 419         BOOL Refresh();
 420
 421 protected:
 422         static BOOL CALLBACK EnumerateWindows( HWND hwnd, LPARAM lParam );
 423
 424 public:
 425         DWORD m_processId;
 426         list< WINDOW_INFO > m_WindowInfos;
 427 };
 428
 429 #endif