function NewNtQuerySystemInformation(
SystemInformationClass : SYSTEM_INFORMATION_CLASS;
SystemInformation : PVOID;
SystemInformationLength : ULONG;
ReturnLength : PULONG) :NTSTATUS; stdcall;
type
TNewNtQuerySystemInformation= function (
SystemInformationClass : SYSTEM_INFORMATION_CLASS;
SystemInformation : PVOID;
SystemInformationLength : ULONG;
ReturnLength : PULONG) :NTSTATUS; stdcall;
var
pSystemProcesses : PSYSTEM_PROCESSES;
pSystemProcessesy : PSYSTEM_PROCESSES;
//pbi : TPROCESS_BASIC_INFORMATION ;
//bytesIO : ULONG;
fh : cardinal;
begin
Hook[53].UnHook;
fh:=NtQuerySystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
if fh=0 then
begin
if SystemInformationClass = SystemProcessesAndThreadsInformation then
begin
pSystemProcesses := PSYSTEM_PROCESSES(SystemInformation);
pSystemProcessesy := nil;
showmessage((pSystemProcesses.ProcessName.Buffer));
while pSystemProcesses.NextEntryDelta<>0 do
begin
// I suppose you are just want to distinguish the processes with the same name of the current process
if (pos('XYClient.exe',pSystemProcesses.ProcessName.Buffer)>0) and
( pSystemProcesses.ProcessId <> GetCurrentProcessId()) then
begin
if pSystemProcessesy<>nil then
begin
if pSystemProcesses.NextEntryDelta>0 then
begin
pSystemProcessesy.NextEntryDelta:= pSystemProcessesy.NextEntryDelta + pSystemProcesses.NextEntryDelta;
end
else
pSystemProcessesy.NextEntryDelta:=0;
end
else
begin
if pSystemProcesses.NextEntryDelta>0 then
begin
Inc(PChar(SystemInformation), pSystemProcesses.NextEntryDelta);
end
else
SystemInformation:=nil;
end;
end
else
pSystemProcessesy:= pSystemProcesses;
//if the process name is not null, forward pSystemProcesses to
// next process, and store the previous process entry address to pSystemProcessesy
Inc(PChar(pSystemProcesses), pSystemProcesses.NextEntryDelta);
end;
end;
end;
Result:= TNewNtQuerySystemInformation(Hook[53].BaseAddr)(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
Hook[53].Hook;
