[C#/WIN32] NtQueryInformationProcess API 함수 선언하기

■ NtQueryInformationProcess API 함수를 선언하는 방법을 보여준다.

 

▶ 예제 코드 (C#)

using System;
using System.Runtime.InteropServices;

#region NT 프로세스 정보 질의하기 - NtQueryInformationProcess(processHandle, processInformationClass, processInformation, processInformationLength, returnLength)

/// <summary>
/// NT 프로세스 정보 질의하기
/// </summary>
/// <param name="processHandle">프로세스 핸들</param>
/// <param name="processInformationClass">프로세스 정보 클래스</param>
/// <param name="processInformation">프로세스 정보</param>
/// <param name="processInformationLength">프로세스 정보 길이</param>
/// <param name="returnLength">반환 길이</param>
/// <returns>처리 결과</returns>
[DllImport("ntdll")]
private static extern int NtQueryInformationProcess
(
    IntPtr                 processHandle,
    int                    processInformationClass,
    ref ProcessInformation processInformation,
    int                    processInformationLength,
    out int                returnLength
);

#endregion

/// <summary>
/// 프로세스 정보
/// </summary>
[StructLayout(LayoutKind.Sequential)]
public struct ProcessInformation
{
    //////////////////////////////////////////////////////////////////////////////////////////////////// Field
    ////////////////////////////////////////////////////////////////////////////////////////// Public

    #region Field

    /// <summary>
    /// 예약
    /// </summary>
    public IntPtr Reserved;

    /// <summary>
    /// PEB 기준 주소
    /// </summary>
    public IntPtr PEbBaseAddress;

    /// <summary>
    /// 예약 2-0
    /// </summary>
    public IntPtr Reserved2_0;

    /// <summary>
    /// 예약 2-1
    /// </summary>
    public IntPtr Reserved2_1;

    /// <summary>
    /// 고유 프로세스 ID
    /// </summary>
    public IntPtr UniqueProcessID;

    /// <summary>
    /// 프로세스 ID
    /// </summary>
    public IntPtr InheritedFromUniqueProcessID;

    #endregion
}