VPF::Отследить активность приложения

Rouse_

Дата 6.5.2006, 18:44 (ссылка)

(нет голосов)

Загрузка ...

Опытный

Профиль
Группа: Участник
Сообщений: 469
Регистрация: 23.4.2005

Репутация: 18
Всего: 29

Цитата(AVGu @ 6.5.2006, 19:33

)

Подскажи пожалуйста какие еще могут быть значения или ссылочку на информацию.

Вот тебе кусочек:

Цитата

NTSTATUS
NtQuerySystemInformation (
    IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
    OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    )

/*++

Routine Description:

    This function queries information about the system.

Arguments:

    SystemInformationClass - The system information class about which
        to retrieve information.

    SystemInformation - A pointer to a buffer which receives the specified
        information.  The format and content of the buffer depend on the
        specified system information class.

        SystemInformation Format by Information Class:

        SystemBasicInformation - Data type is SYSTEM_BASIC_INFORMATION

            SYSTEM_BASIC_INFORMATION Structure

                ULONG Reserved - Always zero.

                ULONG TimerResolutionInMicroSeconds - The resolution of
                    the hardware time.  All time values in NT are
                    specified as 64-bit LARGE_INTEGER values in units of
                    100 nanoseconds.  This field allows an application to
                    understand how many of the low order bits of a system
                    time value are insignificant.

                ULONG PageSize - The physical page size for virtual memory
                    objects.  Physical memory is committed in PageSize
                    chunks.

                ULONG AllocationGranularity - The logical page size for
                    virtual memory objects.  Allocating 1 byte of virtual
                    memory will actually allocate AllocationGranularity
                    bytes of virtual memory.  Storing into that byte will
                    commit the first physical page of the virtual memory.

                ULONG MinimumUserModeAddress - The smallest valid user mode
                    address.  The first AllocationGranularity bytes of
                    the virtual address space are reserved.  This forces
                    access violations for code the dereferences a zero
                    pointer.

                ULONG MaximumUserModeAddress -  The largest valid user mode
                    address.  The next AllocationGranularity bytes of
                    the virtual address space are reserved.  This allows
                    system service routines to validate user mode pointer
                    parameters quickly.

                KAFFINITY ActiveProcessorsAffinityMask - The affinity mask
                    for the current hardware configuration.

                CCHAR NumberOfProcessors - The number of processors
                    in the current hardware configuration.

        SystemProcessorInformation - Data type is SYSTEM_PROCESSOR_INFORMATION

            SYSTEM_PROCESSOR_INFORMATION Structure

                USHORT ProcessorArchitecture - The processor architecture:
                    PROCESSOR_ARCHITECTURE_INTEL
                    PROCESSOR_ARCHITECTURE_MIPS
                    PROCESSOR_ARCHITECTURE_ALPHA
                    PROCESSOR_ARCHITECTURE_PPC

                USHORT ProcessorLevel - architecture dependent processor level.
                    This is the least common denominator for an MP system:

                    For PROCESSOR_ARCHITECTURE_INTEL:
                        3 - 386
                        4 - 486
                        5 - 586 or Pentium

                    For PROCESSOR_ARCHITECTURE_MIPS:
                        00xx - where xx is 8-bit implementation number (bits 8-15 of
                            PRId register.
                        0004 - R4000

                    For PROCESSOR_ARCHITECTURE_ALPHA:
                        xxxx - where xxxx is 16-bit processor version number (low
                            order 16 bits of processor version number from firmware)

                        21064 - 21064
                        21066 - 21066
                        21164 - 21164

                    For PROCESSOR_ARCHITECTURE_PPC:
                        xxxx - where xxxx is 16-bit processor version number (high
                            order 16 bits of Processor Version Register).
                        1 - 601
                        3 - 603
                        4 - 604
                        6 - 603+
                        9 - 604+
                        20 - 620

                USHORT ProcessorRevision - architecture dependent processor revision.
                    This is the least common denominator for an MP system:

                    For PROCESSOR_ARCHITECTURE_INTEL:
                        For Old Intel 386 or 486:
                            FFxx - where xx is displayed as a hexadecimal CPU stepping
                            (e.g. FFD0 is D0 stepping)

                        For Intel Pentium or Cyrix/NexGen 486
                            xxyy - where xx is model number and yy is stepping, so
                            0201 is Model 2, Stepping 1

                    For PROCESSOR_ARCHITECTURE_MIPS:
                        00xx is 8-bit revision number of processor (low order 8 bits
                            of PRId Register

                    For PROCESSOR_ARCHITECTURE_ALPHA:
                        xxyy - where xxyy is 16-bit processor revision number (low
                            order 16 bits of processor revision number from firmware).
                            Displayed as Model 'A'+xx, Pass yy

                    For PROCESSOR_ARCHITECTURE_PPC:
                        xxyy - where xxyy is 16-bit processor revision number (low
                            order 16 bits of Processor Version Register).  Displayed
                            as a fixed point number xx.yy

                USHORT Reserved - Always zero.

                ULONG ProcessorFeatureBits - architecture dependent processor feature bits.
                    This is the least common denominator for an MP system.

        SystemPerformanceInformation - Data type is SYSTEM_PERFORMANCE_INFORMATION

            SYSTEM_PERFORMANCE_INFORMATION Structure

                LARGE_INTEGER IdleProcessTime - Returns the kernel time of the idle
                    process.
        BUGBUG complete comment.
            LARGE_INTEGER IoReadTransferCount;
            LARGE_INTEGER IoWriteTransferCount;
            LARGE_INTEGER IoOtherTransferCount;
            LARGE_INTEGER KernelTime;
            LARGE_INTEGER UserTime;
            ULONG IoReadOperationCount;
            ULONG IoWriteOperationCount;
            ULONG IoOtherOperationCount;
            ULONG AvailablePages;
            ULONG CommittedPages;
            ULONG PageFaultCount;
            ULONG CopyOnWriteCount;
            ULONG TransitionCount;
            ULONG CacheTransitionCount;
            ULONG DemandZeroCount;
            ULONG PageReadCount;
            ULONG PageReadIoCount;
            ULONG CacheReadCount;
            ULONG CacheIoCount;
            ULONG DirtyPagesWriteCount;
            ULONG DirtyWriteIoCount;
            ULONG MappedPagesWriteCount;
            ULONG MappedWriteIoCount;
            ULONG PagedPoolPages;
            ULONG NonPagedPoolPages;
            ULONG PagedPoolAllocs;
            ULONG PagedPoolFrees;
            ULONG NonPagedPoolAllocs;
            ULONG NonPagedPoolFrees;
            ULONG LpcThreadsWaitingInReceive;
            ULONG LpcThreadsWaitingForReply;

        SystemProcessInformation - Data type is SYSTEM_PROCESS_INFORMATION

            SYSTEM_PROCESSOR_INFORMATION Structure
                BUGBUG - add here when done.

        SystemDockInformation - Data type is SYSTEM_DOCK_INFORMATION

             SYSTEM_DOCK_INFORMATION Structure

                 SYSTEM_DOCKED_STATE DockState - Ordinal specifying the current docking state. Possible values:
                     SystemDockStateUnknown - The docking state of the system could not be determined.
                     SystemUndocked - The system is undocked.
                     SystemDocked - The system is docked.

                 ULONG DockIdLength - Specifies the length in characters of the Dock ID string
                                      (not including terminating NULL).

                 ULONG SerialNumberOffset - Specifies the character offset of the Serial Number within
                                            the DockId buffer.

                 ULONG SerialNumberLength - Specifies the length in characters of the Serial Number
                                            string (not including terminating NULL).

                 WCHAR DockId - Character buffer containing two null-terminated strings.  The first
                                string is a character representation of the dock ID number, starting
                                at the beginning of the buffer.  The second string is a character
                                representation of the machine's serial number, starting at character
                                offset SerialNumberOffset in the buffer.

        SystemPowerSettings - Data type is SYSTEM_POWER_SETTINGS
            SYSTEM_POWER_INFORMATION Structure
                BOOLEAN SystemSuspendSupported - Supplies a BOOLEAN as to
                    whether the system suspend is enabled or not.
                BOOLEAN SystemHibernateSupported - Supplies a BOOLEAN as to
                    whether the system hibernate is enabled or not.
                BOOLEAN ResumeTimerSupportsSuspend - Supplies a BOOLEAN as to
                    whether the resuming from an external programmed timer
                    from within a system suspend is enabled or not.
                BOOLEAN ResumeTimerSupportsHibernate - Supplies a BOOLEAN as to
                    whether or resuming from an external programmed timer
                    from within a system hibernate is enabled or not.
                BOOLEAN LidSupported - Supplies a BOOLEAN as to whether or not
                    the suspending and resuming by Lid are enabled or not.
                BOOLEAN TurboSettingSupported - Supplies a BOOLEAN as to whether
                    or not the system supports a turbo mode setting.
                BOOLEAN TurboMode - Supplies a BOOLEAN as to whether or not
                    the system is in turbo mode.
                BOOLEAN SystemAcOrDc - Supplies a BOOLEAN as to whether or not
                    the system is in AC mode.
                BOOLEAN DisablePowerDown - If TRUE, signifies that all requests to
                    PoRequestPowerChange for a SET_POWER-PowerDown irp are to
                    be ignored.
                LARGE_INTEGER SpindownDrives - If non-zero, signifies to the
                    cache manager (or the IO subsystem) to optimize drive
                    accesses based upon power saves, are that drives are to
                    be spun down as appropriate. The value represents to user's
                    requested disk spin down timeout.

        SystemProcessorSpeedInformation - Data type is SYSTEM_PROCESSOR_SPEED_INFORMATION
            SYSTEM_PROCESSOR_SPEED_INFORMATION Structure (same as HalProcessorSpeedInformation)
                ULONG MaximumProcessorSpeed - The maximum hertz the processor is
                    capable of. This information is used by the UI to draw the
                    appropriate scale. This field is read-only and cannot be
                    set.
                ULONG CurrentAvailableSpeed - The hertz for which the processor
                    runs at when not idle. This field is read-only and cannot
                    be set.
                ULONG ConfiguredSpeedLimit - The hertz for which the processor
                    is limited to due to the current configuration.
                UCHAR PowerState
                    0 - Normal
                    1 - The processor speed is being limited due to available
                    power restrictions. This field id read-only by the system.
                UCHAR ThermalState
                    0 - Normal
                    1 - The processors speed is being limited due to thermal
                    restrictions. This field is read-only by the system.
                UCHAR TurboState
                    0 - Normal
                    1 - The processors speed is being limited by the fact that
                    the system turbo mode is currently disabled which is
                    requested to obtain more processor speed.

    SystemInformationLength - Specifies the length in bytes of the system
        information buffer.

    ReturnLength - An optional pointer which, if specified, receives the
        number of bytes placed in the system information buffer.

Return Value:

    Returns one of the following status codes:

        STATUS_SUCCESS - normal, successful completion.

        STATUS_INVALID_INFO_CLASS - The SystemInformationClass parameter
            did not specify a valid value.

        STATUS_INFO_LENGTH_MISMATCH - The value of the SystemInformationLength
            parameter did not match the length required for the information
            class requested by the SystemInformationClass parameter.

        STATUS_ACCESS_VIOLATION - Either the SystemInformation buffer pointer
            or the ReturnLength pointer value specified an invalid address.

        STATUS_WORKING_SET_QUOTA - The process does not have sufficient
            working set to lock the specified output structure in memory.

        STATUS_INSUFFICIENT_RESOURCES - Insufficient system resources exist
            for this request to complete.

Это сообщение отредактировал(а) Rouse_ - 6.5.2006, 19:09

--------------------

Vae Victis
(Горе побежденным (лат.))
Демо с открытым кодом: http://rouse.drkb.ru

AVGu

Дата 22.5.2006, 11:32 (ссылка)

(нет голосов)

Загрузка ...

Новичок

Профиль
Группа: Участник
Сообщений: 8
Регистрация: 21.8.2005

Репутация: 1
Всего: 1

Rouse_, спасибо огромное.
Все получилось как нужно. Оказалось, что дочерние потоки передают родителю свое состояние. Таким образом я отслеживаю State и WaitReason для основного потока и все получается удачно.

Пытаясь запустить твой демо Taskmon под W2K Server и под XP
внес в него некоторые коррективы (идея не моя, подсмотрел здесь )

вот откорректированные куски

1. Собственно объявление

Код


//  так было

  function NtQuerySystemInformation(
    SystemInformationClass: DWORD;   // тип требуемой информации
    SystemInformation : Pointer;     // указатель на буфер, в который вернется информация
    SystemInformationLength : DWORD; // размер буфера в байтах
    var ReturnLength: DWORD          // <- оригинал сколько байт было возвращено или требуется
    ): DWORD; stdcall; external 'ntdll.dll';

// так стало

  function NtQuerySystemInformation(
    SystemInformationClass: DWORD;   // тип требуемой информации
    SystemInformation : Pointer;     // указатель на буфер, в который вернется информация
    SystemInformationLength : DWORD; // размер буфера в байтах
    ReturnLength: PDWORD          //<- моя корректива  сколько байт было возвращено или требуется
    ): DWORD; stdcall; external 'ntdll.dll';

в противном случае выдавалась ошибка

2. код в котором определяется необходимый объем памяти

Код


function TTMDemo.GetSystemInformation: Boolean;
      .................................................

    ReturnLength := $1000; // в оригинале было $4000 но только не $0 насколько я понимаю
    repeat
          GetMem(Temp, ReturnLength);
          St:= NtQuerySystemInformation(SystemProcessesAndThreadsInformation,
               Temp, ReturnLength, nil);
          if St = STATUS_INFO_LENGTH_MISMATCH then begin
             FreeMem(Temp);
             ReturnLength := ReturnLength * 2;
          end;
    until St <> STATUS_INFO_LENGTH_MISMATCH;
    FreeMem(Temp);

3. Собственно вызовы

Код


procedure TTMDemo.tmrRefreshTimer(Sender: TObject);

    ..................................................

// оригинал в Taskmon

  GetSystemInformation;
  if NTQuerySystemInformation(SystemBasicInformation, @sbi,
    SizeOf(SYSTEM_BASIC_INFORMATION), Dummy) = NO_ERROR then
    if NTQuerySystemInformation(SystemTimeOfDayInformation, @sti,
      SizeOf(SYSTEM_TIME_INFORMATION), Dummy) = NO_ERROR then
      if NTQuerySystemInformation(SystemPerformanceInformation, @spi,
        SizeOf(SYSTEM_PERFORMANCE_INFORMATION), Dummy) = NO_ERROR then

// мои коррективы

  GetSystemInformation;
  if NTQuerySystemInformation(SystemBasicInformation, @sbi,
    SizeOf(SYSTEM_BASIC_INFORMATION), @Dummy) = NO_ERROR then
    if NTQuerySystemInformation(SystemTimeOfDayInformation, @sti,
      SizeOf(SYSTEM_TIME_INFORMATION), @Dummy) = NO_ERROR then
      if NTQuerySystemInformation(SystemPerformanceInformation, @spi,
        SizeOf(SYSTEM_PERFORMANCE_INFORMATION), @Dummy) = NO_ERROR then

Еще раз огромная благодарность и мои извинения .... был в командировке не мог сразу ответить.

Rouse_

Дата 22.5.2006, 13:46 (ссылка)

(нет голосов)

Загрузка ...

Опытный

Профиль
Группа: Участник
Сообщений: 469
Регистрация: 23.4.2005

Репутация: 18
Всего: 29

Угу, спасибо за корректировку, поэксперементировал и выяснилось что под ХР на запрос SystemProcessesAndThreadsInformation размер возвращается, но на запрос SystemHandleInformation уже переменная пуста. Как выяснилось, об этом упомянуто у Неббета...

Цитата

The ReturnLength information is not always valid (depending on the information
class),even when the routine returns STATUS_SUCCESS.When the return value indicates
STATUS_INFO_LENGTH_MISMATCH,only some of the information classes return an estimate
of the required length.

Это сообщение отредактировал(а) Rouse_ - 22.5.2006, 13:47

--------------------

Vae Victis
(Горе побежденным (лат.))
Демо с открытым кодом: http://rouse.drkb.ru

1 Пользователей читают эту тему (1 Гостей и 0 Скрытых Пользователей)
0 Пользователей:
« Предыдущая тема \| Delphi: WinAPI и системное программирование \| Следующая тема »