ZwQuerySystemInformation | SystemProcessInformation

Question

So my problem is :

  int nHandleInfoSize = 0x10000;

            void* ipHandlePointer = (void*)Marshal.AllocHGlobal((IntPtr)nHandleInfoSize);
            int nLength = 0;


            while (ZwQuerySystemInformation(Enumerations._SYSTEM_INFORMATION_CLASS.SystemProcessInformation, ipHandlePointer, nHandleInfoSize, out nLength) == NtDll.NTSTATUS.STATUS_INFO_LENGTH_MISMATCH)
            {
                nHandleInfoSize = nLength;
                Marshal.FreeHGlobal((IntPtr)ipHandlePointer);
                ipHandlePointer = (void*)Marshal.AllocHGlobal(nLength);

            }
            //          MessageBox.Show(RtlGetNativeSystemInformation(Enumerations._SYSTEM_INFORMATION_CLASS.SystemBasicInformation, ipHandlePointer, nHandleInfoSize, out nLength).ToString());

            Structures._SYSTEM_PROCESS_INFORMATION* strstr = (Structures._SYSTEM_PROCESS_INFORMATION*)ipHandlePointer;


            MessageBox.Show(nLength.ToString());
            MessageBox.Show(strstr-> UniqueProcessId.ToString());

When I try this code, I got success with NTSTATUS of my function , I got the lenght of information , but when I try to read information , some of them got 0 like UniqueProcessId but NumberOfThreads returned a number any idea or advice ?

Answer 1

Okay I solved my issue while looking at : http://www.dotnetframework.org/default.aspx/DotNET/DotNET/8@0/untmp/whidbey/REDBITS/ndp/fx/src/Services/Monitoring/system/Diagnosticts/ProcessManager@cs/1/ProcessManager@cs