Examine Information on Windows NT System Level Primitives

Overview

NtSysInfo Syntax

Usage: NtSysInfo.exe [/H[type]|/M[dllname]|/P|/T|/W] [processId]}
 /H          Handle list. Can be filtered by "type"
             type: File, Thread, Semaphore, Process, Event,...
 /M          Module list. Can be filtered by "dllname"
 /P          Process list (processId not used)
 /T          Thread list
 /W          Window list
 processId   Process ID, dec. or 0x??? (-1 = every process, default)

Examples:
  NtSysInfo.exe /HFile 651
  NtSysInfo.exe /H 1248
  NtSysInfo.exe /Mkernel32.dll
  NtSysInfo.exe /P
  NtSysInfo.exe /W
  NtSysInfo.exe /W 1215

WhoUses Syntax

Usage: WhoUses.exe [/M] fileName
  /M         fileName is a module name ( EXE, DLL, ... )
  fileName   File name

Examples:
  WhoUses.exe /M kernel32.dll
  WhoUses.exe /M c:\test\test.dll
  WhoUses.exe yourTextFile.txt
  WhoUses.exe c:\pagefile.sys
  WhoUses.exe Serial0

Code Examples

1. Get the process list

SystemProcessInformation pi;
pi.Refresh();
// Iterate through pi.m_ProcessInfos

2. Get the thread list

// processId == -1 means every process
SystemThreadInformation ti( processId ); 
ti.Refresh();
// Iterate through ti.m_ThreadInfos

3. Get the object list

// processId == -1 means every process
SystemHandleInformation oi( processId ); 
oi.Refresh();
// Iterate through oi.m_HandleInfos

4. Get the file object list

// processId == -1 means every process
SystemHandleInformation fi( processId ); 
fi.SetFilter( _T("File"), TRUE ); // Refresh
// Iterate through fi.m_HandleInfos

5. Get the window list

// processId == -1 means every process
SystemWindowInformation wi( processId ); 
wi.Refresh();
// Iterate through wi.m_WindowInfos

6. Get window list

// processId == -1 means every process
SystemModuleInformation mi( processId ); 
mi.Refresh();
// Iterate through mi.m_ModuleInfos

Warnings & Disclaimers

Resources

• Book: Undocumented Windows NT by Prasad Dabak, Sandeep Phadke, Milind Borate
• Book: Windows NT/2000 Native API Reference by Gary Nebbett
• Web: System Internals, www.sysinternals.com

Downloads