CODEWITHSUNDEEP
windowskernelntdll
cyongji
cyongji

Reputation: 31

Why can't get process id that more than 65535 by 'ntQuerySystemInformation' in Win7 64bit?

I used the 'ntQuerySystemInformation' to get all the handle information like:

NtQuerySystemInformation(SystemHandleInformation, pHandleInfor, ulSize,NULL);//SystemHandleInformation = 16

struct of pHandleInfor is:

typedef struct _SYSTEM_HANDLE_INFORMATION 
{
  ULONG ProcessId;   
  UCHAR ObjectTypeNumber;
    UCHAR Flags;
    USHORT Handle;    
    PVOID Object;
    ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

It works well in xp 32bit, but in Win7 64bit can only get the right pid that less than 65535. The type of processId in this struct is ULONG, I think it can get more than 65535. What's wrong with it? Is there any other API instead?

Upvotes: 3

Views: 1288

Answers (2)

Roland Pihlakas
Roland Pihlakas

Reputation: 4573

There are two enum values for NtQuerySystemInformation to get handle info:

    CNST_SYSTEM_HANDLE_INFORMATION = 16
    CNST_SYSTEM_EXTENDED_HANDLE_INFORMATION = 64

And correspondingly two structs: SYSTEM_HANDLE_INFORMATION and SYSTEM_HANDLE_INFORMATION_EX.
The definitions for these structs are:

    struct SYSTEM_HANDLE_INFORMATION
    {
        short UniqueProcessId;
        short CreatorBackTraceIndex;
        char ObjectTypeIndex;
        char HandleAttributes; // 0x01 = PROTECT_FROM_CLOSE, 0x02 = INHERIT
        short HandleValue;
        size_t Object;
        int GrantedAccess;
    }

    struct SYSTEM_HANDLE_INFORMATION_EX
    {
        size_t Object;
        size_t UniqueProcessId;  
        size_t HandleValue;  
        int GrantedAccess;
        short CreatorBackTraceIndex;
        short ObjectTypeIndex;
        int HandleAttributes;
        int Reserved;
    }

As You can see, the first struct really can only contain 16-bit process id-s...

See for example ProcessExplorer project's source file ntexapi.h for more information.
Note also that the field widths for SYSTEM_HANDLE_INFORMATION_EX in my struct definitions might be different from theirs (that is, in my definition some field widths vary depending on the bitness), but I think I tested the code both under 32-bit and 64-bit and found it to be correct.
Please recheck if necessary and let us know if You have additional info.

Upvotes: 3

Michael Burr
Michael Burr

Reputation: 340476

From Raymond Chen's article Processes, commit, RAM, threads, and how high can you go?:

I later learned that the Windows NT folks do try to keep the numerical values of process ID from getting too big. Earlier this century, the kernel team experimented with letting the numbers get really huge, in order to reduce the rate at which process IDs get reused, but they had to go back to small numbers, not for any technical reasons, but because people complained that the large process IDs looked ugly in Task Manager. (One customer even asked if something was wrong with his computer.)

Upvotes: 0

Related Questions