Hello everyone, I am using the API function NtQuerySystemInformation in acquiring process by the memory of time have a question want to ask!

The question is: in the process of xp system with the above function to obtain the memory is consistent in task manager and xp, but in the Windows 7 (64) (32) win10 (64) in all different?

My solution: because the environment is not the same as in this function is called when there is error, the function is in the (NtQuerySystemInformation) NtDll. DLL encapsulation, so I put the load the DLL path changes, the path of change after LoadLibrary (" C: \ \ Windows \ \ SysWOW64 \ \ NtDll DLL "); I had to check the system environment variable path to C: \ Windows \ system32 so there change the idea for the DLL path, but the results of the modified or is the same as before,

CodePudding user response:

https://blogs.msdn.microsoft.com/tianlin/2011/10/26/syswow64/

CodePudding user response:

http://www.cnblogs.com/jiake/articles/4956218.html

CodePudding user response:

http://www.cnblogs.com/jiake/p/4981555.html

CodePudding user response:

GetProcessMemoryInfo

CodePudding user response:

VMMap is process of virtual and physical memory analysis utility, http://technet.microsoft.com/zh-cn/sysinternals/dd535533

CodePudding user response:

A GetProcessMemoryInfo () function can be directly used