#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQuerySystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub
#ifndef _NTZWAPI_H
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
_In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
_Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
_In_ ULONG SystemInformationLength,
_Out_opt_ PULONG ReturnLength
);
View code on GitHub
This function is documented in Windows SDK.
NtQuerySystemInformation
is used to check some system information available only in KernelMode (above 0x80000000).
All available (or all known) information classes are described in SYSTEM_INFORMATION_CLASS
.
Information class (see SYSTEM_INFORMATION_CLASS
).
User-allocated buffer for results. Sometimes this parameter can be NULL (OPTIONAL
), if you check required buffer size (see below).
Length of SystemInformation
buffer (in bytes).
Required length of SystemInformation
buffer.