From: Christian ASTOR on
On 17 jan, 16:09, "Noixe" <no...(a)TOGLIMIemail.it> wrote:

>     // I must import this function from ntdll.dll, but I don't know how.
>
>     ZwQuerySystemInformation(SystemInformationClass,
>                              SystemInformation,
>                              SystemInformationLength,
>                              ReturnLength);

You call it dynamically :
HMODULE hNtDll = LoadLibrary("NtDll.dll");
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress
(hNtDll, "NtQuerySystemInformation");
SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION ProcPerfInfo[16];
NtQuerySystemInformation(SystemProcessorPerformanceInformation,
ProcPerfInfo,
sizeof(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION) * 16, NULL);
// etc...
From: Noixe on
"Christian ASTOR" <castorix(a)club-internet.fr> ha scritto:

I obtain an error in
NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,
"NtQuerySystemInformation");

Undefined symbol 'NtQuerySystemInformation'



From: Christian ASTOR on
On 17 jan, 17:54, "Noixe" <no...(a)TOGLIMIemail.it> wrote:
> "Christian ASTOR" <casto...(a)club-internet.fr> ha scritto:
>
> I obtain an error in
> NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,
> "NtQuerySystemInformation");
>
> Undefined symbol 'NtQuerySystemInformation'

If you don't define it, it's normal...
typedef NTSTATUS (CALLBACK* NTQUERYSYSTEMINFORMATION)
(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;

(and SYSTEM_INFORMATION_CLASS also...)
From: Noixe on
"Christian ASTOR" <castorix(a)club-internet.fr> ha scritto:

> If you don't define it, it's normal...
> typedef NTSTATUS (CALLBACK* NTQUERYSYSTEMINFORMATION)
> (
> IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
> OUT PVOID SystemInformation,
> IN ULONG SystemInformationLength,
> OUT PULONG ReturnLength OPTIONAL
> );
> NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
>
> (and SYSTEM_INFORMATION_CLASS also...)

I obtain
Undefined symbol 'NTQUERYSYSTEMINFORMATION'

Sorry, but this argument is new for me and all info are in english. It is
too hard.

There is alway some problem.

Could you write an example that I can copy and past and compile?

From: Noixe on
I found this code that compile correctly but the result is always 0.

#include <iostream>
#include "stdafx.h"
#include <windows.h>

typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
ULONG IdleTime;
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER Reserved1[2];
ULONG Reserved2;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;

SYSTEM_INFO SysInfo;
const int nCPU = SysInfo.dwNumberOfProcessors;

HINSTANCE hNtDll = LoadLibraryW(L"ntdll.dll");
PFN_NTQUERYSYSTEMINFORMATION NTQSI =
PFN_NTQUERYSYSTEMINFORMATION(GetProcAddress(hNtDll,
"NtQuerySystemInformation"));

SYSTEM_INFORMATION_CLASS SystemInformationClass =
SystemProcessorPerformanceInformation;

ULONG SystemInformationLength;
PULONG ReturnLength;

SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION SystemInformation[4];


int main() {
GetSystemInfo(&SysInfo);

NTQSI(SystemInformationClass, SystemInformation, SystemInformationLength,
ReturnLength);

std::cout << SystemInformation[0].IdleTime << std::endl;
}