#include<windows.h>
  
#include <stdio.h>

#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004L

typedef LONG NTSTATUS; 

typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation, // 0 Y N
SystemProcessorInformation, // 1 Y N
SystemPerformanceInformation, // 2 Y N
SystemTimeOfDayInformation, // 3 Y N
SystemNotImplemented1, // 4 Y N
SystemProcessesAndThreadsInformation, // 5 Y N
SystemCallCounts, // 6 Y N
SystemConfigurationInformation, // 7 Y N
SystemProcessorTimes, // 8 Y N
SystemGlobalFlag, // 9 Y Y
SystemNotImplemented2, // 10 Y N
SystemModuleInformation, // 11 Y N
SystemLockInformation, // 12 Y N
SystemNotImplemented3, // 13 Y N
SystemNotImplemented4, // 14 Y N
SystemNotImplemented5, // 15 Y N
SystemHandleInformation, // 16 Y N
SystemObjectInformation, // 17 Y N
SystemPagefileInformation, // 18 Y N
SystemInstructionEmulationCounts, // 19 Y N
SystemInvalidInfoClass1, // 20
SystemCacheInformation, // 21 Y Y
SystemPoolTagInformation, // 22 Y N
SystemProcessorStatistics, // 23 Y N
SystemDpcInformation, // 24 Y Y
SystemNotImplemented6, // 25 Y N
SystemLoadImage, // 26 N Y
SystemUnloadImage, // 27 N Y
SystemTimeAdjustment, // 28 Y Y
SystemNotImplemented7, // 29 Y N
SystemNotImplemented8, // 30 Y N
SystemNotImplemented9, // 31 Y N
SystemCrashDumpInformation, // 32 Y N
SystemExceptionInformation, // 33 Y N
SystemCrashDumpStateInformation, // 34 Y Y/N
SystemKernelDebuggerInformation, // 35 Y N
SystemContextSwitchInformation, // 36 Y N
SystemRegistryQuotaInformation, // 37 Y Y
SystemLoadAndCallImage, // 38 N Y
SystemPrioritySeparation, // 39 N Y
SystemNotImplemented10, // 40 Y N
SystemNotImplemented11, // 41 Y N
SystemInvalidInfoClass2, // 42
SystemInvalidInfoClass3, // 43
SystemTimeZoneInformation, // 44 Y N
SystemLookasideInformation, // 45 Y N
SystemSetTimeSlipEvent, // 46 N Y
SystemCreateSession, // 47 N Y
SystemDeleteSession, // 48 N Y
SystemInvalidInfoClass4, // 49
SystemRangeStartInformation, // 50 Y N
SystemVerifierInformation, // 51 Y Y
SystemAddVerifier, // 52 N Y
SystemSessionProcessesInformation // 53 Y N
}SYSTEM_INFORMATION_CLASS;

typedef LONG KPRIORITY;

typedef struct _CLIENT_ID

{

HANDLE UniqueProcess;

HANDLE UniqueThread;

}CLIENT_ID;

typedef enum _THREAD_STATE

{

StateInitialized,

StateReady,

StateRunning,

StateStandby,

StateTerminated,

StateWait,

StateTransition,

StateUnknown

}THREAD_STATE;

typedef enum _KWAIT_REASON {
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel
} KWAIT_REASON;

typedef struct _SYSTEM_THREADS
{

LARGE_INTEGER KernelTime;

LARGE_INTEGER UserTime;

LARGE_INTEGER CreateTime;

ULONG WaitTime;

PVOID StartAddress;

CLIENT_ID ClientId;

KPRIORITY Priority;

KPRIORITY BasePriority;

ULONG ContextSwitchCount;

THREAD_STATE State;

KWAIT_REASON WaitReason;

}SYSTEM_THREADS,*PSYSTEM_THREADS;

typedef struct _IO_COUNTERS
{

LARGE_INTEGER ReadOperationCount; //I/O读操作数目;

LARGE_INTEGER WriteOperationCount; //I/O写操作数目;

LARGE_INTEGER OtherOperationCount; //I/O其他操作数目;

LARGE_INTEGER ReadTransferCount;//I/O读数据数目;

LARGE_INTEGER WriteTransferCount; //I/O写数据数目;

LARGE_INTEGER OtherTransferCount; //I/O其他操作数据数目;
}IO_COUNTERS,*PIO_COUNTERS;

typedef struct _VM_COUNTERS {
ULONG PeakVirtualSize; //虚拟存储峰值大小;

ULONG VirtualSize; //虚拟存储大小;

ULONG PageFaultCount; //页故障数目;

ULONG PeakWorkingSetSize; //工作集峰值大小;

ULONG WorkingSetSize; //工作集大小;

ULONG QuotaPeakPagedPoolUsage; //分页池使用配额峰值;

ULONG QuotaPagedPoolUsage; //分页池使用配额;

ULONG QuotaPeakNonPagedPoolUsage; //非分页池使用配额峰值;

ULONG QuotaNonPagedPoolUsage; //非分页池使用配额;

ULONG PagefileUsage;//页文件使用情况;

ULONG PeakPagefileUsage;//页文件使用峰值;
}VM_COUNTERS,*PVM_COUNTERS;

typedef struct _LSA_UNICODE_STRING {  USHORT Length;  USHORT MaximumLength;  PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;

typedef struct _SYSTEM_PROCESSES
{ULONG NextEntryDelta; //构成结构序列的偏移量;
ULONG ThreadCount; //线程数目;

ULONG Reserved1[6];

LARGE_INTEGER CreateTime; //创建时间;

LARGE_INTEGER UserTime;//用户模式(Ring 3)的CPU时间;

LARGE_INTEGER KernelTime; //内核模式(Ring 0)的CPU时间;

UNICODE_STRING ProcessName; //进程名称;

KPRIORITY BasePriority;//进程优先权;

ULONG ProcessId; //进程标识符;

ULONG InheritedFromProcessId; //父进程的标识符;

ULONG HandleCount; //句柄数目;

ULONG Reserved2[2];

VM_COUNTERS  VmCounters; //虚拟存储器的结构，见下;

IO_COUNTERS IoCounters; //IO计数结构，见下;

SYSTEM_THREADS Threads[1]; //进程相关线程的结构数组，见下;

}SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

typedef NTSTATUS (WINAPI *NTQUERYSYSTEMINFORMATION)

(SYSTEM_INFORMATION_CLASS,

IN OUT PVOID,

IN ULONG,

ULONG OPTIONAL);

/*typedef LONG (WINAPI *NTQUERYSYSTEMINFORMATION)
(SYSTEM_INFORMATION_CLASS,
PVOID,
ULONG,
OPTIONAL);*/

int main()   
    
{ 
        SYSTEM_THREADS Systhread;
        char buff[100];
     NTSTATUS        status;
        Systhread.ClientId.UniqueProcess=(HANDLE)3656;
        Systhread.ClientId.UniqueThread=(HANDLE)0;
        
  NTQUERYSYSTEMINFORMATION dwAddress=(NTQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwQuerySystemInformation");
if(dwAddress) printf("地址是%p\n",dwAddress); 
//printf("%d\n",SystemProcessesAndThreadsInformation);
        status=dwAddress(SystemProcessesAndThreadsInformation,&buff,sizeof(buff),NULL);
        if(status==STATUS_INFO_LENGTH_MISMATCH)
                printf("不够");
        //printf("%p",Systhread.StartAddress);
   return  0;   
  }

好象有点问题，帮我该改了！！status总是返回STATUS_INFO_LENGTH_MISMATCH，我想可能要在数组上做文章，可是我。。帮帮我吧！！！(请详细说一说)谢谢！！！！

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！