[process] add a more efficient method to search for processes

* As suggested in #773
* Don't switch to using this method though, as it requires a handle to the disk or volume
  to be obtained, and we use the process search in case there is an issue doing so.
This commit is contained in:
dmex 2017-05-05 17:55:52 +01:00 committed by Pete Batard
parent 867177c5cd
commit 302f108d79
3 changed files with 107 additions and 6 deletions

View file

@ -47,7 +47,8 @@
#define STATUS_INSUFFICIENT_RESOURCES ((NTSTATUS)0xC000009AL)
#define STATUS_NOT_SUPPORTED ((NTSTATUS)0xC00000BBL)
#define SystemExtendedHandleInformation 64
#define SystemExtendedHandleInformation 64
#define FileProcessIdsUsingFileInformation 47
#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
@ -118,6 +119,12 @@ typedef struct _OBJECT_TYPES_INFORMATION
ULONG NumberOfTypes;
} OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION {
ULONG NumberOfProcessIdsInList;
ULONG_PTR ProcessIdList[1];
} FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
#define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1))
#define ALIGN_UP(Address, Type) ALIGN_UP_BY(Address, sizeof(Type))