_SYSTEM_PROCESS_INFORMATION struct backward compatibility - c++

Question

Goal
Write a function the queries a process' threads state.
Solution
Use this helpful post: Unique Technique for Iterating Through Processes and formulate an initial function:
bool IterateOverThreads() {
NTSTATUS status;
PSYSTEM_PROCESS_INFORMATION spi;
ULONG lBufferSize = 0;
status = ::NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS::SystemProcessInformation, 0, 0, & lBufferSize);
if (0xC0000004L != status || 0 == lBufferSize)
return false;
unique_ptr<byte[]> pMemory(new byte[lBufferSize]);
spi = (PSYSTEM_PROCESS_INFORMATION)pMemory.get();
// get System Information
if (!NT_SUCCESS(status = ::NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS::SystemProcessInformation, spi, lBufferSize, & lBufferSize)))
return false;
// Loop over the list until we reach the last entry
while (spi->NextEntryDelta) {
// Calculate the address of the next entry.
spi = (PSYSTEM_PROCESS_INFORMATION)((LPBYTE)spi + spi->NextEntryDelta);
// iterate over threads
for (size_t ii = 0; ii < spi->ThreadCount; ++ii) {
// do whatever with thread attributes
spi->Threads[ii].State;
spi->Threads[ii].WaitReason;
}
}
return true;
}
Problem 1
My solution/projects must use Microsoft SDK version 7.1.
Struct SYSTEM_PROCESS_INFORMATION had changed between the SDKs versions in the following manner:
Microsoft SDKs\Windows\v7.1A\Include\winternl.h
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
BYTE Reserved1[52];
PVOID Reserved2[3];
HANDLE UniqueProcessId;
PVOID Reserved3;
ULONG HandleCount;
BYTE Reserved4[4];
PVOID Reserved5[11];
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
Documented in NtQuerySystemInformation
typedef struct _SYSTEM_PROCESS_INFORMATION {
ULONG NextEntryOffset;
ULONG NumberOfThreads;
BYTE Reserved1[48];
UNICODE_STRING ImageName;
KPRIORITY BasePriority;
HANDLE UniqueProcessId;
PVOID Reserved2;
ULONG HandleCount;
ULONG SessionId;
PVOID Reserved3;
SIZE_T PeakVirtualSize;
SIZE_T VirtualSize;
ULONG Reserved4;
SIZE_T PeakWorkingSetSize;
SIZE_T WorkingSetSize;
PVOID Reserved5;
SIZE_T QuotaPagedPoolUsage;
PVOID Reserved6;
SIZE_T QuotaNonPagedPoolUsage;
SIZE_T PagefileUsage;
SIZE_T PeakPagefileUsage;
SIZE_T PrivatePageCount;
LARGE_INTEGER Reserved7[6];
} SYSTEM_PROCESS_INFORMATION;
So, I cannot "enjoy" using such members as NumberOfThreads (or others).
Fix problem 1:
Define SYSTEM_PROCESS_INFORMATION myself in my code, base on the documentation
Problem 2
My application runs on all Windows greater than equal to XP.
Question
Is my code safe? meaning, is accessing spi->ThreadCount safe? can I assume that the bytes there are valid? will it be risky to read bytes from my own defined struct on older Windows versions?

Answer 1

currently the one of the best (i think) definition of SYSTEM_PROCESS_INFORMATION
now it valid for all current windows version (including xp).
accessing spi->ThreadCount safe?
yes, safe. how minimum on all current build. (say xp already will not change). are this will be safe on future builds (are structure not changed) already another question.
Is my code safe?
no, it wrong. how minimum in 2 points. at first after you got lBufferSize in first call to NtQuerySystemInformation and before use it in second call - required size can changed (grow) - so need really do single call to NtQuerySystemInformation but in loop until you got STATUS_INFO_LENGTH_MISMATCH. your code can work, but sometime fail.
// Loop over the list until we reach the last entry
while (spi->NextEntryDelta) {
this is always error - you lost the last entry, which have NextEntryDelta == 0
return bool not the best idea for function, better return NTSTATUS.
minimal correct code can look like
NTSTATUS IterateOverThreads()
{
NTSTATUS status;
PVOID buf;
ULONG cb = 0x1000;
do
{
if (buf = LocalAlloc(0, cb))
{
if (0 <= (status = NtQuerySystemInformation(SystemProcessInformation, buf, cb, &cb)))
{
union {
PVOID pv;
PBYTE pb;
PSYSTEM_PROCESS_INFORMATION spi;
};
pv = buf;
ULONG NextEntryOffset = 0;
do
{
pb += NextEntryOffset;
DbgPrint("%wZ\n", &spi->ImageName);
if (ULONG NumberOfThreads = spi->NumberOfThreads)
{
PSYSTEM_THREAD_INFORMATION TH = spi->Threads;
do
{
DbgPrint("\t%p %x %x\n", TH->ClientId.UniqueThread, TH->ThreadState, TH->WaitReason);
} while (TH++, --NumberOfThreads);
}
} while (NextEntryOffset = spi->NextEntryOffset);
}
LocalFree(buf);
}
else
{
status = STATUS_INSUFFICIENT_RESOURCES;
}
} while (status == STATUS_INFO_LENGTH_MISMATCH);
return status;
}