Вопрос, как теперь выцепить что это за класс и какая структура там передается Что посоветуете? (Номер класса и размер треьуемой памяти определил)
ну если они точно новые и никем до этого не описаны то кроме реверсинга и исследования ядра здесь врядли что-то ещё посоветовать можно
Это я тулзу одну набросал, вот что получилось для ZwQuerySystemInformation на xpsp2 num=0; needed=0; len=-1;error=-1073741820 num=1; needed=12; len=100;error=0 num=2; needed=312; len=400;error=0 num=3; needed=0; res=OK;error=0 num=4; needed=0; res=not implemented;error=-1073741822 num=5; needed=25840; len=25900;error=0 num=6; needed=24; len=100;error=0 num=7; needed=0; len=-1;error=-1073741820 num=8; needed=48; len=100;error=0 num=9; needed=0; len=-1;error=-1073741820 num=10; needed=0; res=not implemented;error=-1073741822 num=11; needed=34084; len=34100;error=0 num=12; needed=199912; len=-1;error=-1073741820 num=13; needed=0; len=200;error=-1073741823 num=14; needed=40996; len=41000;error=0 num=15; needed=12856; len=12900;error=0 num=16; needed=92484; len=-1;error=-1073741820 num=17; needed=0; len=100;error=-1073741823 num=18; needed=64; len=100;error=0 num=19; needed=136; len=200;error=0 num=20; needed=0; res=invalid number;error=-1073741821 num=21; needed=36; len=100;error=0 num=22; needed=0; len=100;error=-1073741822 num=23; needed=0; len=100;error=0 num=24; needed=0; len=-1;error=-1073741820 num=25; needed=0; len=100;error=-1073741822 num=26; needed=0; res=invalid number;error=-1073741821 num=27; needed=0; res=invalid number;error=-1073741821 num=28; needed=0; len=-1;error=-1073741820 num=29; needed=0; len=100;error=-1073741822 num=30; needed=0; res=invalid number;error=-1073741821 num=31; needed=0; res=invalid number;error=-1073741821 num=32; needed=0; res=invalid number;error=-1073741821 num=33; needed=16; len=100;error=0 num=34; needed=0; res=invalid number;error=-1073741821 num=35; needed=2; len=100;error=0 num=36; needed=48; len=100;error=0 num=37; needed=12; len=100;error=0 num=38; needed=0; res=invalid number;error=-1073741821 num=39; needed=0; res=invalid number;error=-1073741821 num=40; needed=0; res=invalid number;error=-1073741821 num=41; needed=0; res=invalid number;error=-1073741821 num=42; needed=48; len=100;error=0 num=43; needed=12; len=100;error=0 num=44; needed=172; len=200;error=0 num=45; needed=0; res=OK;error=0 num=46; needed=0; res=invalid number;error=-1073741821 num=47; needed=0; res=invalid number;error=-1073741821 num=48; needed=0; res=invalid number;error=-1073741821 num=49; needed=0; res=invalid number;error=-1073741821 num=50; needed=0; len=-1;error=-1073741820 num=51; needed=0; len=200;error=0 num=52; needed=0; res=invalid number;error=-1073741821 num=53; needed=0; len=100;error=-2147483646 num=54; needed=0; res=invalid number;error=-1073741821 num=55; needed=16; len=100;error=0 num=56; needed=0; res=other error;error=-1073741790 num=57; needed=36048; len=36100;error=0 num=58; needed=4; len=100;error=0 num=59; needed=0; len=-1;error=-1073741820 num=60; needed=16; len=100;error=0 num=61; needed=72; len=100;error=0 num=62; needed=0; len=-1;error=-1073741820 num=63; needed=12; len=100;error=0 num=64; needed=161876; len=-1;error=-1073741820 num=65; needed=4; len=100;error=0 num=66; needed=0; len=-1;error=-1073741820 num=67; needed=0; res=invalid number;error=-1073741821 num=68; needed=0; res=invalid number;error=-1073741821 num=69; needed=0; res=invalid number;error=-1073741821 num=70; needed=0; len=-1;error=-1073741820 num=71; needed=0; res=OK;error=0 72-... не определены
Код (Text): typedef enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation, SystemProcessorInformation, // obsolete...delete SystemPerformanceInformation, SystemTimeOfDayInformation, SystemPathInformation, SystemProcessInformation, SystemCallCountInformation, SystemDeviceInformation, SystemProcessorPerformanceInformation, SystemFlagsInformation, SystemCallTimeInformation, SystemModuleInformation, SystemLocksInformation, SystemStackTraceInformation, SystemPagedPoolInformation, SystemNonPagedPoolInformation, SystemHandleInformation, SystemObjectInformation, SystemPageFileInformation, SystemVdmInstemulInformation, SystemVdmBopInformation, SystemFileCacheInformation, SystemPoolTagInformation, SystemInterruptInformation, SystemDpcBehaviorInformation, SystemFullMemoryInformation, SystemLoadGdiDriverInformation, SystemUnloadGdiDriverInformation, SystemTimeAdjustmentInformation, SystemSummaryMemoryInformation, SystemMirrorMemoryInformation, SystemPerformanceTraceInformation, SystemObsolete0, SystemExceptionInformation, SystemCrashDumpStateInformation, SystemKernelDebuggerInformation, SystemContextSwitchInformation, SystemRegistryQuotaInformation, SystemExtendServiceTableInformation, SystemPrioritySeperation, SystemVerifierAddDriverInformation, SystemVerifierRemoveDriverInformation, SystemProcessorIdleInformation, SystemLegacyDriverInformation, SystemCurrentTimeZoneInformation, SystemLookasideInformation, SystemTimeSlipNotification, SystemSessionCreate, SystemSessionDetach, SystemSessionInformation, SystemRangeStartInformation, SystemVerifierInformation, SystemVerifierThunkExtend, SystemSessionProcessInformation, SystemLoadGdiDriverInSystemSpace, SystemNumaProcessorMap, SystemPrefetcherInformation, SystemExtendedProcessInformation, SystemRecommendedSharedDataAlignment, SystemComPlusPackage, SystemNumaAvailableMemory, SystemProcessorPowerInformation, SystemEmulationBasicInformation, SystemEmulationProcessorInformation, SystemExtendedHandleInformation, SystemLostDelayedWriteInformation, SystemBigPoolInformation, SystemSessionPoolTagInformation, SystemSessionMappedViewInformation, SystemHotpatchInformation, SystemObjectSecurityMode, SystemWatchdogTimerHandler, SystemWatchdogTimerInformation, SystemLogicalProcessorInformation, SystemWow64SharedInformation, SystemRegisterFirmwareTableInformationHandler, SystemFirmwareTableInformation, SystemModuleInformationEx, SystemVerifierTriageInformation, SystemSuperfetchInformation, SystemMemoryListInformation, SystemFileCacheInformationEx, MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum } SYSTEM_INFORMATION_CLASS; Как не трудно заметить классов определено раза в полтора больше 50.
что, кто круче? Код (Text): typedef enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation, SystemProcessorInformation, SystemPerformanceInformation, SystemTimeOfDayInformation, SystemPathInformation, SystemProcessInformation, SystemCallCountInformation, SystemDeviceInformation, SystemProcessorPerformanceInformation, SystemFlagsInformation, SystemCallTimeInformation, SystemModuleInformation, SystemLocksInformation, SystemStackTraceInformation, SystemPagedPoolInformation, SystemNonPagedPoolInformation, SystemHandleInformation, SystemObjectInformation, SystemPageFileInformation, SystemVdmInstemulInformation, SystemVdmBopInformation, SystemFileCacheInformation, SystemPoolTagInformation, SystemInterruptInformation, SystemDpcBehaviorInformation, SystemFullMemoryInformation, SystemLoadGdiDriverInformation, SystemUnloadGdiDriverInformation, SystemTimeAdjustmentInformation, SystemSummaryMemoryInformation, SystemMirrorMemoryInformation, SystemPerformanceTraceInformation, SystemObsolete0, SystemExceptionInformation, SystemCrashDumpStateInformation, SystemKernelDebuggerInformation, SystemContextSwitchInformation, SystemRegistryQuotaInformation, SystemExtendServiceTableInformation, SystemPrioritySeperation, SystemPlugPlayBusInformation, SystemDockInformation, SystemPowerInformationNative, SystemProcessorSpeedInformation, SystemCurrentTimeZoneInformation, SystemLookasideInformation, SystemTimeSlipNotification, SystemSessionCreate, SystemSessionDetach, SystemSessionInformation, SystemRangeStartInformation, SystemVerifierInformation, SystemAddVerifier, SystemSessionProcessesInformation, SystemLoadGdiDriverInSystemSpaceInformation, SystemNumaProcessorMap, SystemPrefetcherInformation, SystemExtendedProcessInformation, SystemRecommendedSharedDataAlignment, SystemComPlusPackage, SystemNumaAvailableMemory, SystemProcessorPowerInformation, SystemEmulationBasicInformation, SystemEmulationProcessorInformation, SystemExtendedHanfleInformation, SystemLostDelayedWriteInformation, SystemBigPoolInformation, SystemSessionPoolTagInformation, SystemSessionMappedViewInformation, SystemHotpatchInformation, SystemObjectSecurityMode, SystemWatchDogTimerHandler, SystemWatchDogTimerInformation, SystemLogicalProcessorInformation, SystemWo64SharedInformationObosolete, SystemRegisterFirmwareTableInformationHandler, SystemFirmwareTableInformation, SystemModuleInformationEx, SystemVerifierTriageInformation, SystemSuperfetchInformation, SystemMemoryListInformation, SystemFileCacheInformationEx, SystemThreadPriorityClientIdInformation, SystemProcessorIdleCycleTimeInformation, SystemVerifierCancellationInformation, SystemProcessorPowerInformationEx, SystemRefTraceInformation, SystemSpecialPoolInformation, SystemProcessIdInformation, SystemErrorPortInformation, SystemBootEnvironmentInformation, SystemHypervisorInformation, SystemVerifierInformationEx, SystemTimeZoneInformation, SystemImageFileExecutionOptionsInformation, SystemCoverageInformation, SystemPrefetchPathInformation, SystemVerifierFaultsInformation, MaxSystemInfoClass, } SYSTEM_INFORMATION_CLASS;
