Examine Information on Windows NT System Level Primitives

Environment: Windows NT 4.0/2000 only, VC6 SP4, NT DDK is not needed :)

Overview

This article presents two separate utilities (NtSysInfo and WhoUses) to examine low level information on such Windows NT system primitives such as processes, threads, windows, modules and objects. Some of the things that I'm doing here are similar to the utilities found on the sysinternals Web site.

NtSysInfo Syntax

NtSysInfo enables you to explore the Windows NT internals and enumerate the system's processes, windows, threads, objects.
Usage: NtSysInfo.exe [/H[type]|/M[dllname]|/P|/T|/W] [processId]}
 /H          Handle list. Can be filtered by "type"
             type: File, Thread, Semaphore, Process, Event,...
 /M          Module list. Can be filtered by "dllname"
 /P          Process list (processId not used)
 /T          Thread list
 /W          Window list
 processId   Process ID, dec. or 0x??? (-1 = every process, default)

Examples:
  NtSysInfo.exe /HFile 651
  NtSysInfo.exe /H 1248
  NtSysInfo.exe /Mkernel32.dll
  NtSysInfo.exe /P
  NtSysInfo.exe /W
  NtSysInfo.exe /W 1215

WhoUses Syntax

NtSysInfo allows you to list processes, windows, threads, objects. The WhoUses utility enalbes you to determine what process has a file or DLL locked.
Usage: WhoUses.exe [/M] fileName
  /M         fileName is a module name ( EXE, DLL, ... )
  fileName   File name

Examples:
  WhoUses.exe /M kernel32.dll
  WhoUses.exe /M c:\test\test.dll
  WhoUses.exe yourTextFile.txt
  WhoUses.exe c:\pagefile.sys
  WhoUses.exe Serial0

Code Examples

  1. Get the process list
  2. SystemProcessInformation pi;
    pi.Refresh();
    // Iterate through pi.m_ProcessInfos
    
  3. Get the thread list
  4. // processId == -1 means every process
    SystemThreadInformation ti( processId ); 
    ti.Refresh();
    // Iterate through ti.m_ThreadInfos
    
  5. Get the object list
  6. // processId == -1 means every process
    SystemHandleInformation oi( processId ); 
    oi.Refresh();
    // Iterate through oi.m_HandleInfos
    
  7. Get the file object list
  8. // processId == -1 means every process
    SystemHandleInformation fi( processId ); 
    fi.SetFilter( _T("File"), TRUE ); // Refresh
    // Iterate through fi.m_HandleInfos
    
  9. Get the window list
  10. // processId == -1 means every process
    SystemWindowInformation wi( processId ); 
    wi.Refresh();
    // Iterate through wi.m_WindowInfos
    
  11. Get window list
  12. // processId == -1 means every process
    SystemModuleInformation mi( processId ); 
    mi.Refresh();
    // Iterate through mi.m_ModuleInfos
    

Warnings & Disclaimers

This software uses a few undocumented functions (ntdll.dll), peeks around in your systems internals. Use at your own risk! It works for me. :)

Resources

  • Book: Undocumented Windows NT by Prasad Dabak, Sandeep Phadke, Milind Borate
  • Book: Windows NT/2000 Native API Reference by Gary Nebbett
  • Web: System Internals, www.sysinternals.com

Downloads

Download source/demo code - 38 Kb


Comments

  • Thanks

    Posted by Praveen on 08/15/2012 02:40am

    Hi, Excellent stuff!! thanks a lot Regards, Praveen

    Reply
Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • Live Event Date: March 19, 2015 @ 1:00 p.m. ET / 10:00 a.m. PT The 2015 Enterprise Mobile Application Survey asked 250 mobility professionals what their biggest mobile challenges are, how many employees they are equipping with mobile apps, and their methods for driving value with mobility. Join Dan Woods, Editor and CTO of CITO Research, and Alan Murray, SVP of Products at Apperian, as they break down the results of this survey and discuss how enterprises are using mobile application management and private …

  • Companies undertaking an IT project need to find the right balance between cost and functionality. It's important to start by determining whether to build a solution from scratch, buy an out-of-the-box solution, or a combination of both. In reality, most projects will require some system tailoring to meet business requirements. Decision-makers must understand how much software development is enough and craft a detailed implementation plan to ensure the project's success. This white paper examines the different …

Most Popular Programming Stories

More for Developers

RSS Feeds

Thanks for your registration, follow us on our social networks to keep up-to-date