public static IntPtr GetSystemInformation(SYSTEM_INFORMATION_CLASS infoClass, out NTSTATUS result, uint infoLength = 0)
{
if (infoLength == 0)
{
infoLength = 0x10000;
}
IntPtr infoPtr = Marshal.AllocHGlobal((int)infoLength);
int tries = 0;
while (true)
{
result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);
if (result == NTSTATUS.SUCCESS)
{
return(infoPtr);
}
Marshal.FreeHGlobal(infoPtr); //free pointer when not Successful
if (result != NTSTATUS.INFO_LENGTH_MISMATCH && result != NTSTATUS.BUFFER_OVERFLOW && result != NTSTATUS.BUFFER_TOO_SMALL)
{
return(IntPtr.Zero);
}
else if (++tries > 5)
{
return(IntPtr.Zero);
}
else
{
infoPtr = Marshal.AllocHGlobal((int)infoLength);
}
}
}
public static NTSTATUS ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength)
{
byte[] syscall = bZwQuerySystemInformation10;
GCHandle pinnedArray = GCHandle.Alloc(syscall, GCHandleType.Pinned);
IntPtr memoryAddress = pinnedArray.AddrOfPinnedObject();
if (!Natives.VirtualProtect(memoryAddress,
(UIntPtr)syscall.Length, memoryPtrotection, out uint oldprotect))
{
throw new Win32Exception();
}
Delegates.ZwQuerySystemInformation myAssemblyFunction = (Delegates.ZwQuerySystemInformation)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwQuerySystemInformation));
return((NTSTATUS)myAssemblyFunction(SystemInformationClass, SystemInformation, SystemInformationLength, ref ReturnLength));
}
public static NTSTATUS ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength)
{
byte[] syscall = bZwQuerySystemInformation10;
unsafe
{
fixed(byte *ptr = syscall)
{
IntPtr memoryAddress = (IntPtr)ptr;
if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
(UIntPtr)syscall.Length, 0x40, out uint oldprotect))
{
throw new Win32Exception();
}
Delegates.ZwQuerySystemInformation myAssemblyFunction = (Delegates.ZwQuerySystemInformation)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwQuerySystemInformation));
return((NTSTATUS)myAssemblyFunction(SystemInformationClass, SystemInformation, SystemInformationLength, ref ReturnLength));
}
}
}
public static IntPtr NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS infoClass, uint infoLength = 0)
{
if (infoLength == 0)
{
infoLength = 0x10000;
}
var infoPtr = Marshal.AllocHGlobal((int)infoLength);
var tries = 0;
while (true)
{
var result = NtQuerySystemInformation(infoClass, infoPtr, infoLength, out infoLength);
if (result == NtStatus.Success)
{
return(infoPtr);
}
Marshal.FreeHGlobal(infoPtr); //free pointer when not Successful
if (result != NtStatus.InfoLengthMismatch && result != NtStatus.BufferOverflow && result != NtStatus.BufferTooSmall)
{
//throw new Exception("Unhandled NtStatus " + result);
return(IntPtr.Zero);
}
if (++tries > 5)
{
return(IntPtr.Zero);
}
infoPtr = Marshal.AllocHGlobal((int)infoLength);
}
}
private static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS systemInformationClass,
out KernelVaShadowFlags systemInformation,
uint systemInformationLength,
IntPtr returnLength);
public static extern IntPtr ZwQuerySystemInformation(
SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation,
uint SystemInformationLength,
ref uint ReturnLength);
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
internal static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, uint Size, out uint Length);
public static extern int NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation,
int SystemInformationLength,
out int ReturnLength
);
static extern NTSTATUS NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS SystemInformationClass,
PVOID SystemInformation,
ULONG Length,
out ULONG ResultLength);
protected extern static UInt32 NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation,
UInt32 SystemInformationLength,
out UInt32 ReturnLength
);
internal static extern NTSTATUS NtQuerySystemInformation(
[In] SYSTEM_INFORMATION_CLASS systemInformationClass,
[In] IntPtr systemInformation,
[In] uint systemInformationLength,
[Out] out uint returnLength);
private static extern uint _NtSetSystemInformation(SYSTEM_INFORMATION_CLASS NtSystemInformationClass, [In, Out] int[] hParameters, ulong hBufferSizeIn);
private static extern uint _NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS NtSystemInformationClass, [In, Out] IntPtr hBuffer, ulong hBufferSizeIn, [Out] out ulong hBufferSizeOut);
internal static extern NtStatus NtQuerySystemInformation([In] SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, [In] int SystemInformationLength, [Out][Optional] out int ReturnLength);
private static extern NTSTATUS NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
public static unsafe extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, SYSTEM_PROCESS_INFO *Info, uint Size, uint *ReturnLength);
private static extern NTSTATUS NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
public static extern NTSTATUS NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS InfoClass,
IntPtr info,
int size,
IntPtr length);
static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, byte[] Info, int Size, IntPtr Length);
public static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS query, IntPtr dataPtr, int size, out int returnedSize);
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
[MarshalAs(UnmanagedType.LPArray)] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation,
int SystemInformationLength, out int ReturnLength);
private static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, UInt32 Size, out UInt32 Length);
public static extern uint ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_LOAD_AND_CALL_IMAGE SystemInformation, int SystemInformationLength);
public static extern IntPtr ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, System.IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength);
public static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, uint Size, out uint Length);
internal static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS systemInformationClass,
IntPtr systemInformation,
uint systemInformationLength,
out uint returnLength);
private static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS systemInformationClass,
out DmaGuardPolicyInfo systemInformation,
uint systemInformationLength,
IntPtr returnLength);
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_PERFORMANCE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
public static extern NT_STATUS NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, int SystemInformationLength, ref int returnLength);
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
[MarshalAs(UnmanagedType.LPArray)] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation,
int SystemInformationLength, out int ReturnLength);
static extern uint NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS SystemInformationClass,
[In, Out] IntPtr SystemInformation,
ulong SystemInformationLength,
[Out, Optional] UIntPtr ReturnLength
);
public static extern uint ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_LOAD_AND_CALL_IMAGE SystemInformation, int SystemInformationLength);
private static extern NtStatus NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS InfoClass, IntPtr Info, UInt32 Size, out UInt32 Length);
private static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS systemInformationClass,
out SecureSpeculationControlFlags systemInformation,
uint systemInformationLength,
IntPtr returnLength);
public static extern NtStatus NtQuerySystemInformation(
SYSTEM_INFORMATION_CLASS systemInformationClass,
IntPtr systemInformation,
int systemInformationLength,
ref int returnLength);
internal static extern int NtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, [Out] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation, int SystemInformationLength, out IntPtr ReturnLength);
internal static extern NT_STATUS NtQuerySystemInformation(
[In] SYSTEM_INFORMATION_CLASS SystemInformationClass,
[In] IntPtr SystemInformation,
[In] int SystemInformationLength,
[Out] out int ReturnLength);
static extern Int32 APIQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation,
int SystemInformationLength,
out long ReturnLength);
