NtQuerySystemInformation - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
    _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
    _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
    _In_ ULONG SystemInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
    _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
    _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
    _In_ ULONG SystemInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif

View code on GitHub

This function is documented in Windows SDK.


NtQuerySystemInformation is used to check some system information available only in KernelMode (above 0x80000000).
All available (or all known) information classes are described in SYSTEM_INFORMATION_CLASS.

SystemInformationClass

Information class (see SYSTEM_INFORMATION_CLASS).

SystemInformation

User-allocated buffer for results. Sometimes this parameter can be NULL (OPTIONAL), if you check required buffer size (see below).

SystemInformationLength

Length of SystemInformation buffer (in bytes).

ReturnLength

Required length of SystemInformation buffer.

Documented by

See also