process_windows_amd64.go

Documentation: github.com/shirou/gopsutil/process

     1  // +build windows
     2  
     3  package process
     4  
     5  import (
     6  	"syscall"
     7  	"unsafe"
     8  
     9  	"github.com/shirou/gopsutil/internal/common"
    10  	"golang.org/x/sys/windows"
    11  )
    12  
    13  type PROCESS_MEMORY_COUNTERS struct {
    14  	CB                         uint32
    15  	PageFaultCount             uint32
    16  	PeakWorkingSetSize         uint64
    17  	WorkingSetSize             uint64
    18  	QuotaPeakPagedPoolUsage    uint64
    19  	QuotaPagedPoolUsage        uint64
    20  	QuotaPeakNonPagedPoolUsage uint64
    21  	QuotaNonPagedPoolUsage     uint64
    22  	PagefileUsage              uint64
    23  	PeakPagefileUsage          uint64
    24  }
    25  
    26  func queryPebAddress(procHandle syscall.Handle, is32BitProcess bool) (uint64, error) {
    27  	if is32BitProcess {
    28  		//we are on a 64-bit process reading an external 32-bit process
    29  		var wow64 uint
    30  
    31  		ret, _, _ := common.ProcNtQueryInformationProcess.Call(
    32  			uintptr(procHandle),
    33  			uintptr(common.ProcessWow64Information),
    34  			uintptr(unsafe.Pointer(&wow64)),
    35  			uintptr(unsafe.Sizeof(wow64)),
    36  			uintptr(0),
    37  		)
    38  		if status := windows.NTStatus(ret); status == windows.STATUS_SUCCESS {
    39  			return uint64(wow64), nil
    40  		} else {
    41  			return 0, windows.NTStatus(ret)
    42  		}
    43  	} else {
    44  		//we are on a 64-bit process reading an external 64-bit process
    45  		var info processBasicInformation64
    46  
    47  		ret, _, _ := common.ProcNtQueryInformationProcess.Call(
    48  			uintptr(procHandle),
    49  			uintptr(common.ProcessBasicInformation),
    50  			uintptr(unsafe.Pointer(&info)),
    51  			uintptr(unsafe.Sizeof(info)),
    52  			uintptr(0),
    53  		)
    54  		if status := windows.NTStatus(ret); status == windows.STATUS_SUCCESS {
    55  			return info.PebBaseAddress, nil
    56  		} else {
    57  			return 0, windows.NTStatus(ret)
    58  		}
    59  	}
    60  }
    61  
    62  func readProcessMemory(procHandle syscall.Handle, _ bool, address uint64, size uint) []byte {
    63  	var read uint
    64  
    65  	buffer := make([]byte, size)
    66  
    67  	ret, _, _ := common.ProcNtReadVirtualMemory.Call(
    68  		uintptr(procHandle),
    69  		uintptr(address),
    70  		uintptr(unsafe.Pointer(&buffer[0])),
    71  		uintptr(size),
    72  		uintptr(unsafe.Pointer(&read)),
    73  	)
    74  	if int(ret) >= 0 && read > 0 {
    75  		return buffer[:read]
    76  	}
    77  	return nil
    78  }
    79
View as plain text