Skip to content

Commit 5a035db

Browse files
tyranidtyranid
committed
Added some additional object queries.
1 parent 33f0cfd commit 5a035db

6 files changed

Lines changed: 147 additions & 5 deletions

File tree

‎NtApiDotNet/NtEvent.cs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,23 @@ public override NtStatus QueryInformation(EventInformationClass info_class, Safe
246246
return NtSystemCalls.NtQueryEvent(Handle, info_class, buffer, buffer.GetLength(), out return_length);
247247
}
248248

249+
/// <summary>
250+
/// Query the information class as an object.
251+
/// </summary>
252+
/// <param name="info_class">The information class.</param>
253+
/// <param name="throw_on_error">True to throw on error.</param>
254+
/// <returns>The information class as an object.</returns>
255+
public override NtResult<object> QueryObject(EventInformationClass info_class, bool throw_on_error)
256+
{
257+
switch (info_class)
258+
{
259+
case EventInformationClass.EventBasicInformation:
260+
return Query<EventBasicInformation>(info_class, default, throw_on_error).Cast<object>();
261+
}
262+
263+
return base.QueryObject(info_class, throw_on_error);
264+
}
265+
249266
#endregion
250267

251268
#region Public Properties

‎NtApiDotNet/NtFile.cs‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4829,6 +4829,32 @@ public override NtStatus SetInformation(FileInformationClass info_class, SafeBuf
48294829
return NtSystemCalls.NtSetInformationFile(Handle, io_status, buffer, buffer.GetLength(), info_class);
48304830
}
48314831

4832+
/// <summary>
4833+
/// Query the information class as an object.
4834+
/// </summary>
4835+
/// <param name="info_class">The information class.</param>
4836+
/// <param name="throw_on_error">True to throw on error.</param>
4837+
/// <returns>The information class as an object.</returns>
4838+
public override NtResult<object> QueryObject(FileInformationClass info_class, bool throw_on_error)
4839+
{
4840+
switch (info_class)
4841+
{
4842+
case FileInformationClass.FileBasicInformation:
4843+
return Query<FileBasicInformation>(info_class, default, throw_on_error).Cast<object>();
4844+
case FileInformationClass.FileEndOfFileInformation:
4845+
return Query<FileEndOfFileInformation>(info_class, default, throw_on_error).Cast<object>();
4846+
case FileInformationClass.FileStandardInformation:
4847+
return Query<FileStandardInformation>(info_class, default, throw_on_error).Cast<object>();
4848+
case FileInformationClass.FileNetworkOpenInformation:
4849+
return Query<FileNetworkOpenInformation>(info_class, default, throw_on_error).Cast<object>();
4850+
case FileInformationClass.FileInternalInformation:
4851+
return Query<FileInternalInformation>(info_class, default, throw_on_error).Cast<object>();
4852+
case FileInformationClass.FileRemoteProtocolInformation:
4853+
return Query<FileRemoteProtocolInformation>(info_class, default, throw_on_error).Cast<object>();
4854+
}
4855+
return base.QueryObject(info_class, throw_on_error);
4856+
}
4857+
48324858
#endregion
48334859

48344860
#region Public Properties

‎NtApiDotNet/NtFileNative.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -952,6 +952,13 @@ public struct FilePipeLocalInformation
952952
public NamedPipeEnd NamedPipeEnd;
953953
}
954954

955+
[StructLayout(LayoutKind.Sequential)]
956+
public struct FilePipeRemoteInformation
957+
{
958+
public LargeIntegerStruct CollectDataTime;
959+
public int MaximumCollectionCount;
960+
}
961+
955962
[StructLayout(LayoutKind.Sequential)]
956963
public struct FileMailslotQueryInformation
957964
{

‎NtApiDotNet/NtNamedPipeFile.cs‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,27 @@ public string GetAttributeString(PipeAttributeType attribute_type, string name)
301301
{
302302
return GetAttributeString(attribute_type, name, true).Result;
303303
}
304+
305+
/// <summary>
306+
/// Query the information class as an object.
307+
/// </summary>
308+
/// <param name="info_class">The information class.</param>
309+
/// <param name="throw_on_error">True to throw on error.</param>
310+
/// <returns>The information class as an object.</returns>
311+
public override NtResult<object> QueryObject(FileInformationClass info_class, bool throw_on_error)
312+
{
313+
switch (info_class)
314+
{
315+
case FileInformationClass.FilePipeInformation:
316+
return Query<FilePipeInformation>(info_class, default, throw_on_error).Cast<object>();
317+
case FileInformationClass.FilePipeLocalInformation:
318+
return Query<FilePipeLocalInformation>(info_class, default, throw_on_error).Cast<object>();
319+
case FileInformationClass.FilePipeRemoteInformation:
320+
return Query<FilePipeRemoteInformation>(info_class, default, throw_on_error).Cast<object>();
321+
}
322+
return base.QueryObject(info_class, throw_on_error);
323+
}
324+
304325
#endregion
305326

306327
#region Public Properties

‎NtApiDotNet/NtProcess.cs‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2201,6 +2201,14 @@ public override NtResult<object> QueryObject(ProcessInformationClass info_class,
22012201
return Query<IoCounters>(info_class, default, throw_on_error).Cast<object>();
22022202
case ProcessInformationClass.ProcessTimes:
22032203
return Query<KernelUserTimes>(info_class, default, throw_on_error).Cast<object>();
2204+
case ProcessInformationClass.ProcessQuotaLimits:
2205+
return Query<QuotaLimitsEx>(info_class, default, throw_on_error).Cast<object>();
2206+
case ProcessInformationClass.ProcessVmCounters:
2207+
return Query<VmCountersEx>(info_class, default, throw_on_error).Cast<object>();
2208+
case ProcessInformationClass.ProcessCycleTime:
2209+
return Query<ProcessCycleTimeInformation>(info_class, default, throw_on_error).Cast<object>();
2210+
case ProcessInformationClass.ProcessProtectionInformation:
2211+
return Query<PsProtection>(info_class, default, throw_on_error).Cast<object>();
22042212
}
22052213
return base.QueryObject(info_class, throw_on_error);
22062214
}
@@ -2491,10 +2499,8 @@ public int HardErrorMode
24912499

24922500

24932501
/// <summary>
2494-
/// Get the process handle table and try and get them as objects.
2502+
/// Does the process has a child process restriction?
24952503
/// </summary>
2496-
/// <returns>The list of handles as objects.</returns>
2497-
/// <remarks>This function will drop handles it can't duplicate.</remarks>
24982504
public bool IsChildProcessRestricted
24992505
{
25002506
get
@@ -2631,7 +2637,6 @@ public bool VirtualizationEnabled
26312637
/// Get the time spent in user mode.
26322638
/// </summary>
26332639
public double UserTimeSeconds => new TimeSpan(UserTime).TotalSeconds;
2634-
26352640
/// <summary>
26362641
/// Get the process IO counters.
26372642
/// </summary>

‎NtApiDotNet/NtProcessNative.cs‎

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,13 @@ public struct ProcessCombineSecurityDomainInformation
446446
public IntPtr ProcessHandle;
447447
}
448448

449+
[StructLayout(LayoutKind.Sequential)]
450+
public struct ProcessCycleTimeInformation
451+
{
452+
public long AccumulatedCycles;
453+
public long CurrentCycleCount;
454+
}
455+
449456
public enum ProcessInformationClass
450457
{
451458
ProcessBasicInformation,
@@ -547,7 +554,9 @@ public enum ProcessInformationClass
547554
ProcessEnableLogging,
548555
ProcessLeapSecondInformation,
549556
ProcessFiberShadowStackAllocation,
550-
ProcessFreeFiberShadowStackAllocation
557+
ProcessFreeFiberShadowStackAllocation,
558+
ProcessAltSystemCallInformation,
559+
ProcessDynamicEHContinuationTargets,
551560
}
552561

553562
public enum ProcessMitigationPolicy
@@ -701,6 +710,63 @@ public struct ProcessRevokeFileHandlesInformation
701710
public UnicodeString TargetDevicePath;
702711
}
703712

713+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
714+
public struct RateQuotaLimit
715+
{
716+
public int RateData;
717+
public int RatePercent => RateData & 0x7F;
718+
719+
public override string ToString()
720+
{
721+
return $"{RatePercent}%";
722+
}
723+
}
724+
725+
[Flags]
726+
public enum QuotaLimitsExFlags
727+
{
728+
None = 0,
729+
MinEnable = 1,
730+
MinDisable = 2,
731+
MaxEnable = 4,
732+
MaxDisable = 8,
733+
UseDefaultLimits = 0x10
734+
}
735+
736+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
737+
public struct QuotaLimitsEx
738+
{
739+
public IntPtr PagedPoolLimit;
740+
public IntPtr NonPagedPoolLimit;
741+
public IntPtr MinimumWorkingSetSize;
742+
public IntPtr MaximumWorkingSetSize;
743+
public IntPtr PagefileLimit;
744+
public LargeIntegerStruct TimeLimit;
745+
public IntPtr WorkingSetLimit;
746+
public IntPtr Reserved2;
747+
public IntPtr Reserved3;
748+
public IntPtr Reserved4;
749+
public QuotaLimitsExFlags Flags;
750+
public RateQuotaLimit CpuRateLimit;
751+
}
752+
753+
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
754+
public struct VmCountersEx
755+
{
756+
public IntPtr PeakVirtualSize;
757+
public IntPtr VirtualSize;
758+
public int PageFaultCount;
759+
public IntPtr PeakWorkingSetSize;
760+
public IntPtr WorkingSetSize;
761+
public IntPtr QuotaPeakPagedPoolUsage;
762+
public IntPtr QuotaPagedPoolUsage;
763+
public IntPtr QuotaPeakNonPagedPoolUsage;
764+
public IntPtr QuotaNonPagedPoolUsage;
765+
public IntPtr PagefileUsage;
766+
public IntPtr PeakPagefileUsage;
767+
public IntPtr PrivateUsage;
768+
}
769+
704770
public static partial class NtSystemCalls
705771
{
706772
[DllImport("ntdll.dll")]

0 commit comments

Comments
 (0)