ホーム › System.WindowsProgramming › SYSTEM_PROCESS_INFORMATION
SYSTEM_PROCESS_INFORMATION
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| NextEntryOffset | DWORD | 4 | +0 | +0 | 次のプロセスエントリへのバイトオフセット。0で末尾を示す。 |
| NumberOfThreads | DWORD | 4 | +4 | +4 | プロセス内のスレッド数。 |
| Reserved1 | BYTE | 48 | +8 | +8 | 予約バイト配列。 |
| ImageName | UNICODE_STRING | 16/8 | +56 | +56 | プロセスのイメージ名を表すUNICODE_STRING。 |
| BasePriority | INT | 4 | +72 | +64 | プロセスの基本優先度。 |
| UniqueProcessId | HANDLE | 8/4 | +80 | +68 | プロセスを一意に識別するハンドル(PID)。 |
| Reserved2 | void* | 8/4 | +88 | +72 | 予約ポインタ。 |
| HandleCount | DWORD | 4 | +96 | +76 | プロセスが保持するハンドル数。 |
| SessionId | DWORD | 4 | +100 | +80 | プロセスが属するセッションのID。 |
| Reserved3 | void* | 8/4 | +104 | +84 | 予約ポインタ。 |
| PeakVirtualSize | UINT_PTR | 8/4 | +112 | +88 | 仮想メモリ使用量のピーク値(バイト)。 |
| VirtualSize | UINT_PTR | 8/4 | +120 | +92 | 現在の仮想メモリ使用量(バイト)。 |
| Reserved4 | DWORD | 4 | +128 | +96 | 予約DWORD。 |
| PeakWorkingSetSize | UINT_PTR | 8/4 | +136 | +100 | ワーキングセットサイズのピーク値(バイト)。 |
| WorkingSetSize | UINT_PTR | 8/4 | +144 | +104 | 現在のワーキングセットサイズ(バイト)。 |
| Reserved5 | void* | 8/4 | +152 | +108 | 予約ポインタ。 |
| QuotaPagedPoolUsage | UINT_PTR | 8/4 | +160 | +112 | ページプール割り当てクォータ使用量(バイト)。 |
| Reserved6 | void* | 8/4 | +168 | +116 | 予約ポインタ。 |
| QuotaNonPagedPoolUsage | UINT_PTR | 8/4 | +176 | +120 | 非ページプール割り当てクォータ使用量(バイト)。 |
| PagefileUsage | UINT_PTR | 8/4 | +184 | +124 | ページファイル使用量(バイト)。 |
| PeakPagefileUsage | UINT_PTR | 8/4 | +192 | +128 | ページファイル使用量のピーク値(バイト)。 |
| PrivatePageCount | UINT_PTR | 8/4 | +200 | +132 | プライベートページ数。 |
| Reserved7 | LONGLONG | 48 | +208 | +136 | 予約LONGLONG配列。 |
各言語での定義
#include <windows.h>
// UNICODE_STRING (x64 16 / x86 8 バイト)
typedef struct UNICODE_STRING {
WORD Length;
WORD MaximumLength;
LPWSTR Buffer;
} UNICODE_STRING;
// SYSTEM_PROCESS_INFORMATION (x64 256 / x86 184 バイト)
typedef struct SYSTEM_PROCESS_INFORMATION {
DWORD NextEntryOffset;
DWORD NumberOfThreads;
BYTE Reserved1[48];
UNICODE_STRING ImageName;
INT BasePriority;
HANDLE UniqueProcessId;
void* Reserved2;
DWORD HandleCount;
DWORD SessionId;
void* Reserved3;
UINT_PTR PeakVirtualSize;
UINT_PTR VirtualSize;
DWORD Reserved4;
UINT_PTR PeakWorkingSetSize;
UINT_PTR WorkingSetSize;
void* Reserved5;
UINT_PTR QuotaPagedPoolUsage;
void* Reserved6;
UINT_PTR QuotaNonPagedPoolUsage;
UINT_PTR PagefileUsage;
UINT_PTR PeakPagefileUsage;
UINT_PTR PrivatePageCount;
LONGLONG Reserved7[6];
} SYSTEM_PROCESS_INFORMATION;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct UNICODE_STRING
{
public ushort Length;
public ushort MaximumLength;
public IntPtr Buffer;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct SYSTEM_PROCESS_INFORMATION
{
public uint NextEntryOffset;
public uint NumberOfThreads;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 48)] public byte[] Reserved1;
public UNICODE_STRING ImageName;
public int BasePriority;
public IntPtr UniqueProcessId;
public IntPtr Reserved2;
public uint HandleCount;
public uint SessionId;
public IntPtr Reserved3;
public UIntPtr PeakVirtualSize;
public UIntPtr VirtualSize;
public uint Reserved4;
public UIntPtr PeakWorkingSetSize;
public UIntPtr WorkingSetSize;
public IntPtr Reserved5;
public UIntPtr QuotaPagedPoolUsage;
public IntPtr Reserved6;
public UIntPtr QuotaNonPagedPoolUsage;
public UIntPtr PagefileUsage;
public UIntPtr PeakPagefileUsage;
public UIntPtr PrivatePageCount;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)] public long[] Reserved7;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure UNICODE_STRING
Public Length As UShort
Public MaximumLength As UShort
Public Buffer As IntPtr
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure SYSTEM_PROCESS_INFORMATION
Public NextEntryOffset As UInteger
Public NumberOfThreads As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=48)> Public Reserved1() As Byte
Public ImageName As UNICODE_STRING
Public BasePriority As Integer
Public UniqueProcessId As IntPtr
Public Reserved2 As IntPtr
Public HandleCount As UInteger
Public SessionId As UInteger
Public Reserved3 As IntPtr
Public PeakVirtualSize As UIntPtr
Public VirtualSize As UIntPtr
Public Reserved4 As UInteger
Public PeakWorkingSetSize As UIntPtr
Public WorkingSetSize As UIntPtr
Public Reserved5 As IntPtr
Public QuotaPagedPoolUsage As UIntPtr
Public Reserved6 As IntPtr
Public QuotaNonPagedPoolUsage As UIntPtr
Public PagefileUsage As UIntPtr
Public PeakPagefileUsage As UIntPtr
Public PrivatePageCount As UIntPtr
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=6)> Public Reserved7() As Long
End Structureimport ctypes
from ctypes import wintypes
class UNICODE_STRING(ctypes.Structure):
_fields_ = [
("Length", ctypes.c_ushort),
("MaximumLength", ctypes.c_ushort),
("Buffer", ctypes.c_void_p),
]
class SYSTEM_PROCESS_INFORMATION(ctypes.Structure):
_fields_ = [
("NextEntryOffset", wintypes.DWORD),
("NumberOfThreads", wintypes.DWORD),
("Reserved1", ctypes.c_ubyte * 48),
("ImageName", UNICODE_STRING),
("BasePriority", ctypes.c_int),
("UniqueProcessId", ctypes.c_void_p),
("Reserved2", ctypes.c_void_p),
("HandleCount", wintypes.DWORD),
("SessionId", wintypes.DWORD),
("Reserved3", ctypes.c_void_p),
("PeakVirtualSize", ctypes.c_size_t),
("VirtualSize", ctypes.c_size_t),
("Reserved4", wintypes.DWORD),
("PeakWorkingSetSize", ctypes.c_size_t),
("WorkingSetSize", ctypes.c_size_t),
("Reserved5", ctypes.c_void_p),
("QuotaPagedPoolUsage", ctypes.c_size_t),
("Reserved6", ctypes.c_void_p),
("QuotaNonPagedPoolUsage", ctypes.c_size_t),
("PagefileUsage", ctypes.c_size_t),
("PeakPagefileUsage", ctypes.c_size_t),
("PrivatePageCount", ctypes.c_size_t),
("Reserved7", ctypes.c_longlong * 6),
]#[repr(C)]
pub struct UNICODE_STRING {
pub Length: u16,
pub MaximumLength: u16,
pub Buffer: *mut core::ffi::c_void,
}
#[repr(C)]
pub struct SYSTEM_PROCESS_INFORMATION {
pub NextEntryOffset: u32,
pub NumberOfThreads: u32,
pub Reserved1: [u8; 48],
pub ImageName: UNICODE_STRING,
pub BasePriority: i32,
pub UniqueProcessId: *mut core::ffi::c_void,
pub Reserved2: *mut core::ffi::c_void,
pub HandleCount: u32,
pub SessionId: u32,
pub Reserved3: *mut core::ffi::c_void,
pub PeakVirtualSize: usize,
pub VirtualSize: usize,
pub Reserved4: u32,
pub PeakWorkingSetSize: usize,
pub WorkingSetSize: usize,
pub Reserved5: *mut core::ffi::c_void,
pub QuotaPagedPoolUsage: usize,
pub Reserved6: *mut core::ffi::c_void,
pub QuotaNonPagedPoolUsage: usize,
pub PagefileUsage: usize,
pub PeakPagefileUsage: usize,
pub PrivatePageCount: usize,
pub Reserved7: [i64; 6],
}import "golang.org/x/sys/windows"
type UNICODE_STRING struct {
Length uint16
MaximumLength uint16
Buffer uintptr
}
type SYSTEM_PROCESS_INFORMATION struct {
NextEntryOffset uint32
NumberOfThreads uint32
Reserved1 [48]byte
ImageName UNICODE_STRING
BasePriority int32
UniqueProcessId uintptr
Reserved2 uintptr
HandleCount uint32
SessionId uint32
Reserved3 uintptr
PeakVirtualSize uintptr
VirtualSize uintptr
Reserved4 uint32
PeakWorkingSetSize uintptr
WorkingSetSize uintptr
Reserved5 uintptr
QuotaPagedPoolUsage uintptr
Reserved6 uintptr
QuotaNonPagedPoolUsage uintptr
PagefileUsage uintptr
PeakPagefileUsage uintptr
PrivatePageCount uintptr
Reserved7 [6]int64
}type
UNICODE_STRING = record
Length: Word;
MaximumLength: Word;
Buffer: Pointer;
end;
SYSTEM_PROCESS_INFORMATION = record
NextEntryOffset: DWORD;
NumberOfThreads: DWORD;
Reserved1: array[0..47] of Byte;
ImageName: UNICODE_STRING;
BasePriority: Integer;
UniqueProcessId: Pointer;
Reserved2: Pointer;
HandleCount: DWORD;
SessionId: DWORD;
Reserved3: Pointer;
PeakVirtualSize: NativeUInt;
VirtualSize: NativeUInt;
Reserved4: DWORD;
PeakWorkingSetSize: NativeUInt;
WorkingSetSize: NativeUInt;
Reserved5: Pointer;
QuotaPagedPoolUsage: NativeUInt;
Reserved6: Pointer;
QuotaNonPagedPoolUsage: NativeUInt;
PagefileUsage: NativeUInt;
PeakPagefileUsage: NativeUInt;
PrivatePageCount: NativeUInt;
Reserved7: array[0..5] of Int64;
end;const UNICODE_STRING = extern struct {
Length: u16,
MaximumLength: u16,
Buffer: ?*anyopaque,
};
const SYSTEM_PROCESS_INFORMATION = extern struct {
NextEntryOffset: u32,
NumberOfThreads: u32,
Reserved1: [48]u8,
ImageName: UNICODE_STRING,
BasePriority: i32,
UniqueProcessId: ?*anyopaque,
Reserved2: ?*anyopaque,
HandleCount: u32,
SessionId: u32,
Reserved3: ?*anyopaque,
PeakVirtualSize: usize,
VirtualSize: usize,
Reserved4: u32,
PeakWorkingSetSize: usize,
WorkingSetSize: usize,
Reserved5: ?*anyopaque,
QuotaPagedPoolUsage: usize,
Reserved6: ?*anyopaque,
QuotaNonPagedPoolUsage: usize,
PagefileUsage: usize,
PeakPagefileUsage: usize,
PrivatePageCount: usize,
Reserved7: [6]i64,
};type
UNICODE_STRING {.bycopy.} = object
Length: uint16
MaximumLength: uint16
Buffer: pointer
SYSTEM_PROCESS_INFORMATION {.bycopy.} = object
NextEntryOffset: uint32
NumberOfThreads: uint32
Reserved1: array[48, uint8]
ImageName: UNICODE_STRING
BasePriority: int32
UniqueProcessId: pointer
Reserved2: pointer
HandleCount: uint32
SessionId: uint32
Reserved3: pointer
PeakVirtualSize: uint
VirtualSize: uint
Reserved4: uint32
PeakWorkingSetSize: uint
WorkingSetSize: uint
Reserved5: pointer
QuotaPagedPoolUsage: uint
Reserved6: pointer
QuotaNonPagedPoolUsage: uint
PagefileUsage: uint
PeakPagefileUsage: uint
PrivatePageCount: uint
Reserved7: array[6, int64]struct UNICODE_STRING
{
ushort Length;
ushort MaximumLength;
void* Buffer;
}
struct SYSTEM_PROCESS_INFORMATION
{
uint NextEntryOffset;
uint NumberOfThreads;
ubyte[48] Reserved1;
UNICODE_STRING ImageName;
int BasePriority;
void* UniqueProcessId;
void* Reserved2;
uint HandleCount;
uint SessionId;
void* Reserved3;
size_t PeakVirtualSize;
size_t VirtualSize;
uint Reserved4;
size_t PeakWorkingSetSize;
size_t WorkingSetSize;
void* Reserved5;
size_t QuotaPagedPoolUsage;
void* Reserved6;
size_t QuotaNonPagedPoolUsage;
size_t PagefileUsage;
size_t PeakPagefileUsage;
size_t PrivatePageCount;
long[6] Reserved7;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; SYSTEM_PROCESS_INFORMATION サイズ: 184 バイト(x86)
dim st, 46 ; 4byte整数×46(構造体サイズ 184 / 4 切り上げ)
; NextEntryOffset : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; NumberOfThreads : DWORD (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; Reserved1 : BYTE (+8, 48byte) varptr(st)+8 を基点に操作(48byte:入れ子/配列)
; ImageName : UNICODE_STRING (+56, 8byte) varptr(st)+56 を基点に操作(8byte:入れ子/配列)
; BasePriority : INT (+64, 4byte) st.16 = 値 / 値 = st.16 (lpoke/lpeek も可)
; UniqueProcessId : HANDLE (+68, 4byte) st.17 = 値 / 値 = st.17 (lpoke/lpeek も可)
; Reserved2 : void* (+72, 4byte) st.18 = 値 / 値 = st.18 (lpoke/lpeek も可)
; HandleCount : DWORD (+76, 4byte) st.19 = 値 / 値 = st.19 (lpoke/lpeek も可)
; SessionId : DWORD (+80, 4byte) st.20 = 値 / 値 = st.20 (lpoke/lpeek も可)
; Reserved3 : void* (+84, 4byte) st.21 = 値 / 値 = st.21 (lpoke/lpeek も可)
; PeakVirtualSize : UINT_PTR (+88, 4byte) st.22 = 値 / 値 = st.22 (lpoke/lpeek も可)
; VirtualSize : UINT_PTR (+92, 4byte) st.23 = 値 / 値 = st.23 (lpoke/lpeek も可)
; Reserved4 : DWORD (+96, 4byte) st.24 = 値 / 値 = st.24 (lpoke/lpeek も可)
; PeakWorkingSetSize : UINT_PTR (+100, 4byte) st.25 = 値 / 値 = st.25 (lpoke/lpeek も可)
; WorkingSetSize : UINT_PTR (+104, 4byte) st.26 = 値 / 値 = st.26 (lpoke/lpeek も可)
; Reserved5 : void* (+108, 4byte) st.27 = 値 / 値 = st.27 (lpoke/lpeek も可)
; QuotaPagedPoolUsage : UINT_PTR (+112, 4byte) st.28 = 値 / 値 = st.28 (lpoke/lpeek も可)
; Reserved6 : void* (+116, 4byte) st.29 = 値 / 値 = st.29 (lpoke/lpeek も可)
; QuotaNonPagedPoolUsage : UINT_PTR (+120, 4byte) st.30 = 値 / 値 = st.30 (lpoke/lpeek も可)
; PagefileUsage : UINT_PTR (+124, 4byte) st.31 = 値 / 値 = st.31 (lpoke/lpeek も可)
; PeakPagefileUsage : UINT_PTR (+128, 4byte) st.32 = 値 / 値 = st.32 (lpoke/lpeek も可)
; PrivatePageCount : UINT_PTR (+132, 4byte) st.33 = 値 / 値 = st.33 (lpoke/lpeek も可)
; Reserved7 : LONGLONG (+136, 48byte) varptr(st)+136 を基点に操作(48byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; SYSTEM_PROCESS_INFORMATION サイズ: 256 バイト(x64)
dim st, 64 ; 4byte整数×64(構造体サイズ 256 / 4 切り上げ)
; NextEntryOffset : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; NumberOfThreads : DWORD (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; Reserved1 : BYTE (+8, 48byte) varptr(st)+8 を基点に操作(48byte:入れ子/配列)
; ImageName : UNICODE_STRING (+56, 16byte) varptr(st)+56 を基点に操作(16byte:入れ子/配列)
; BasePriority : INT (+72, 4byte) st.18 = 値 / 値 = st.18 (lpoke/lpeek も可)
; UniqueProcessId : HANDLE (+80, 8byte) qpoke st,80,値 / qpeek(st,80) ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; Reserved2 : void* (+88, 8byte) qpoke st,88,値 / qpeek(st,88) ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; HandleCount : DWORD (+96, 4byte) st.24 = 値 / 値 = st.24 (lpoke/lpeek も可)
; SessionId : DWORD (+100, 4byte) st.25 = 値 / 値 = st.25 (lpoke/lpeek も可)
; Reserved3 : void* (+104, 8byte) qpoke st,104,値 / qpeek(st,104) ※IronHSPのみ。3.7/3.8は lpoke st,104,下位 : lpoke st,108,上位
; PeakVirtualSize : UINT_PTR (+112, 8byte) qpoke st,112,値 / qpeek(st,112) ※IronHSPのみ。3.7/3.8は lpoke st,112,下位 : lpoke st,116,上位
; VirtualSize : UINT_PTR (+120, 8byte) qpoke st,120,値 / qpeek(st,120) ※IronHSPのみ。3.7/3.8は lpoke st,120,下位 : lpoke st,124,上位
; Reserved4 : DWORD (+128, 4byte) st.32 = 値 / 値 = st.32 (lpoke/lpeek も可)
; PeakWorkingSetSize : UINT_PTR (+136, 8byte) qpoke st,136,値 / qpeek(st,136) ※IronHSPのみ。3.7/3.8は lpoke st,136,下位 : lpoke st,140,上位
; WorkingSetSize : UINT_PTR (+144, 8byte) qpoke st,144,値 / qpeek(st,144) ※IronHSPのみ。3.7/3.8は lpoke st,144,下位 : lpoke st,148,上位
; Reserved5 : void* (+152, 8byte) qpoke st,152,値 / qpeek(st,152) ※IronHSPのみ。3.7/3.8は lpoke st,152,下位 : lpoke st,156,上位
; QuotaPagedPoolUsage : UINT_PTR (+160, 8byte) qpoke st,160,値 / qpeek(st,160) ※IronHSPのみ。3.7/3.8は lpoke st,160,下位 : lpoke st,164,上位
; Reserved6 : void* (+168, 8byte) qpoke st,168,値 / qpeek(st,168) ※IronHSPのみ。3.7/3.8は lpoke st,168,下位 : lpoke st,172,上位
; QuotaNonPagedPoolUsage : UINT_PTR (+176, 8byte) qpoke st,176,値 / qpeek(st,176) ※IronHSPのみ。3.7/3.8は lpoke st,176,下位 : lpoke st,180,上位
; PagefileUsage : UINT_PTR (+184, 8byte) qpoke st,184,値 / qpeek(st,184) ※IronHSPのみ。3.7/3.8は lpoke st,184,下位 : lpoke st,188,上位
; PeakPagefileUsage : UINT_PTR (+192, 8byte) qpoke st,192,値 / qpeek(st,192) ※IronHSPのみ。3.7/3.8は lpoke st,192,下位 : lpoke st,196,上位
; PrivatePageCount : UINT_PTR (+200, 8byte) qpoke st,200,値 / qpeek(st,200) ※IronHSPのみ。3.7/3.8は lpoke st,200,下位 : lpoke st,204,上位
; Reserved7 : LONGLONG (+208, 48byte) varptr(st)+208 を基点に操作(48byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global UNICODE_STRING
#field short Length
#field short MaximumLength
#field intptr Buffer
#endstruct
#defstruct global SYSTEM_PROCESS_INFORMATION
#field int NextEntryOffset
#field int NumberOfThreads
#field byte Reserved1 48
#field UNICODE_STRING ImageName
#field int BasePriority
#field intptr UniqueProcessId
#field intptr Reserved2
#field int HandleCount
#field int SessionId
#field intptr Reserved3
#field intptr PeakVirtualSize
#field intptr VirtualSize
#field int Reserved4
#field intptr PeakWorkingSetSize
#field intptr WorkingSetSize
#field intptr Reserved5
#field intptr QuotaPagedPoolUsage
#field intptr Reserved6
#field intptr QuotaNonPagedPoolUsage
#field intptr PagefileUsage
#field intptr PeakPagefileUsage
#field intptr PrivatePageCount
#field int64 Reserved7 6
#endstruct
stdim st, SYSTEM_PROCESS_INFORMATION ; NSTRUCT 変数を確保
st->NextEntryOffset = 100
mes "NextEntryOffset=" + st->NextEntryOffset