Class NtDllFFM

java.lang.Object

oshi.ffm.ForeignFunctions

oshi.ffm.windows.WindowsForeignFunctions

oshi.ffm.windows.NtDllFFM

public final class NtDllFFM
extends WindowsForeignFunctions

FFM bindings for NtDll functions and structures used for process information queries.

Field Summary

Fields

Modifier and Type	Field	Description
static final StructLayout	CURDIR
static final long	PBI_PEB_BASE_ADDRESS_OFFSET
static final StructLayout	PEB
static final long	PEB_PROCESS_PARAMETERS_OFFSET
static final int	PROCESS_BASIC_INFORMATION
static final StructLayout	PROCESS_BASIC_INFORMATION_STRUCT
static final StructLayout	RTL_DRIVE_LETTER_CURDIR
static final StructLayout	RTL_USER_PROCESS_PARAMETERS
static final StructLayout	STRING
static final StructLayout	UNICODE_STRING
static final long	UNICODE_STRING_BUFFER_OFFSET
static final long	UNICODE_STRING_LENGTH_OFFSET
static final long	UPP_COMMAND_LINE_OFFSET
static final long	UPP_CURRENT_DIRECTORY_OFFSET
static final long	UPP_ENVIRONMENT_OFFSET
static final long	UPP_ENVIRONMENT_SIZE_OFFSET

Fields inherited from class ForeignFunctions

CAPTURE_CALL_STATE, CAPTURED_STATE_LAYOUT, ERRNO_HANDLE, LIBRARY_ARENA, LINKER, NATIVE_LONG_SIZE, NATIVE_POINTER_SIZE, NATIVE_SIZE_T_SIZE, SYMBOL_LOOKUP

Constructor Summary

Constructors

Constructor	Description
NtDllFFM()

Method Summary

Modifier and Type	Method	Description
static int	NtQueryInformationProcess(MemorySegment processHandle, int processInformationClass, MemorySegment processInformation, int processInformationLength, MemorySegment returnLength)	Retrieves information about the specified process.
static String	readUnicodeString(MemorySegment processHandle, MemorySegment unicodeString, Arena arena)	Reads a UNICODE_STRING from process memory.

Methods inherited from class WindowsForeignFunctions

checkSuccess, isSuccess, readAnsiString, readWideString, setupTokenPrivileges, toWideString

Methods inherited from class ForeignFunctions

downcall, getByteArrayFromNativePointer, getErrno, getStringFromNativePointer, getStructFromNativePointer, lib, libraryLookup

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PROCESS_BASIC_INFORMATION

public static final int PROCESS_BASIC_INFORMATION

See Also:

• Constant Field Values

UNICODE_STRING

public static final StructLayout UNICODE_STRING

UNICODE_STRING_LENGTH_OFFSET

public static final long UNICODE_STRING_LENGTH_OFFSET

UNICODE_STRING_BUFFER_OFFSET

public static final long UNICODE_STRING_BUFFER_OFFSET

CURDIR

public static final StructLayout CURDIR

STRING

public static final StructLayout STRING

RTL_DRIVE_LETTER_CURDIR

public static final StructLayout RTL_DRIVE_LETTER_CURDIR

PROCESS_BASIC_INFORMATION_STRUCT

public static final StructLayout PROCESS_BASIC_INFORMATION_STRUCT

PBI_PEB_BASE_ADDRESS_OFFSET

public static final long PBI_PEB_BASE_ADDRESS_OFFSET

PEB

public static final StructLayout PEB

PEB_PROCESS_PARAMETERS_OFFSET

public static final long PEB_PROCESS_PARAMETERS_OFFSET

RTL_USER_PROCESS_PARAMETERS

public static final StructLayout RTL_USER_PROCESS_PARAMETERS

UPP_CURRENT_DIRECTORY_OFFSET

public static final long UPP_CURRENT_DIRECTORY_OFFSET

UPP_COMMAND_LINE_OFFSET

public static final long UPP_COMMAND_LINE_OFFSET

UPP_ENVIRONMENT_OFFSET

public static final long UPP_ENVIRONMENT_OFFSET

UPP_ENVIRONMENT_SIZE_OFFSET

public static final long UPP_ENVIRONMENT_SIZE_OFFSET

Constructor Details

NtDllFFM

public NtDllFFM()

Method Details

NtQueryInformationProcess

public static int NtQueryInformationProcess(MemorySegment processHandle,
 int processInformationClass,
 MemorySegment processInformation,
 int processInformationLength,
 MemorySegment returnLength)

Retrieves information about the specified process.

Parameters:

processHandle - A handle to the process

processInformationClass - The type of process information to be retrieved

processInformation - Buffer to receive the requested information

processInformationLength - Size of the buffer

returnLength - Pointer to receive the actual size of the information returned

Returns:

NTSTATUS code (0 indicates success)

readUnicodeString

public static String readUnicodeString(MemorySegment processHandle,
 MemorySegment unicodeString,
 Arena arena)

Reads a UNICODE_STRING from process memory.

Parameters:

processHandle - Handle to the process

unicodeString - The UNICODE_STRING segment containing Length and Buffer pointer

arena - Arena for memory allocation

Returns:

The string content, or empty string on failure