Timothy's Space 君看一叶舟，出没风波里

利用ntdll.dll中没有公开的API函数: NtQuerySystemInformation

typedef LONG (WINAPI *PROCNTQSI)(UINT,PVOID,ULONG,PULONG);
PROCNTQSI NtQuerySystemInformation;

NtQuerySystemInformation = (PROCNTQSI)GetProcAddress(
GetModuleHandle(“ntdll”),
“NtQuerySystemInformation”
);
if (!NtQuerySystemInformation)
{
return;
}

// get number of processors in the system
status = NtQuerySystemInformation(SystemBasicInformation,
&SysBaseInfo,sizeof(SysBaseInfo),NULL);
if (status != NO_ERROR)
{
return;
}
status = NtQuerySystemInformation(SystemTimeInformation,
&SysTimeInfo,sizeof(SysTimeInfo),0);
if (status!=NO_ERROR)
{
return;
}
// get new CPU”s idle time
status = NtQuerySystemInformation(SystemPerformanceInformation,
&SysPerfInfo,sizeof(SysPerfInfo),NULL);
if (status != NO_ERROR)
{
return;
}
// if it”s a first call – skip it
if (m_liOldIdleTime.QuadPart != 0)
{
// CurrentValue = NewValue – OldValue
dbIdleTime = Li2Double(SysPerfInfo.liIdleTime) – Li2Double(m_liOldIdleTime);
dbSystemTime = Li2Double(SysTimeInfo.liKeSystemTime) – Li2Double(m_liOldSystemTime);

// CurrentCpuIdle = IdleTime / SystemTime
dbIdleTime = dbIdleTime / dbSystemTime;

// CurrentCpuUsage% = 100 – (CurrentCpuIdle * 100) / NumberOfProcessors
dbIdleTime = 100.0 – dbIdleTime * 100.0 / (double)SysBaseInfo.bKeNumberProcessors + 0.5;

m_fNewUsges = (UINT)dbIdleTime;
}

声明: 此Blog中的文章和随笔仅代表作者在某一特定时间内的观点和结论，对其完全的正确不做任何担保或假设
本站文章均采用 知识共享署名-相同方式共享3.0 协议进行授权，除非注明，本站文章均为原创，转载请注明转自 Timothy's Space 并应以链接形式标明本文地址!