get process info

[820815]

How can I get "I/O Write Bytes" info for process?

[Static_VoiD]

Oh, man. You can read some manual on this at MSDN.
Them use System plugin to call the DLL and function required.

[820815]

MSDN

If I could understand what is written there, I would not have to ask here

[820815]

So... http://msdn.microsoft.com/en-us/libr...(v=VS.85).aspx

System::Call 'kernel32::OpenProcess(i 1040, i 0, i $PID)i .r0'

System::Alloc 48 ;6 counters * 8 bytes?
Pop $1

System::Call 'kernel32::ProcessGetIOCounters(i r0, p r1)' ???

[Animaether]

hmmm... good question - seems like it should work (except that 'p' is incorrect... that's the online docs vs included docs mismatch thing.. you'd want 'i')...

...except that it doesn't seem to. Perhaps the struct size isn't quite right - but doesn't seem to be anything wrong with it...

PHP Code:

OutFile "test.exe"

!define PROCESS_QUERY_INFORMATION 0x0400
!define PROCESS_VM_READ 0x0010

Section
    System::Call "kernel32::GetCurrentProcessId(v)i.r0"
    System::Call "kernel32::OpenProcess(i${PROCESS_QUERY_INFORMATION}|${PROCESS_VM_READ}, i0, ir0) i.r1 ? e"
    Pop $7


    System::Call "*(l, l, l, l, l, l) i.r2"

    System::Call "kernel32::GetProcessIoCounters(ir1, i.r2) i.r5 ? e"
    Pop $6
    System::Call "*$2(l.R1, l.R2, l.R3, l.R4, l.R5, l.R6)"
    MessageBox MB_OK "GetCurrentProcessId: $0$\nGetOpenProcess: $1$\nBuffer: $2$\nGetProcessIoCounters result: $5$\nGetLastError: $6$\n$\n[$R1][$R2][$R3][$R4][$R5][$R6]"
    System::Free $2
SectionEnd 


PHP Code:

---------------------------
Name Setup
---------------------------
GetCurrentProcessId: 5420
GetOpenProcess: 248
Buffer: 0 <--- should remain pointer to struct address
GetProcessIoCounters result: 0 <--- should be non-zero
GetLastError: 998

[0][0][0][0][0][0]
---------------------------
OK   
--------------------------- 


No idea.. some System plugin wizard will hopefully step in %)

[gringoloco023]

At least the following line should have a dot less on the second parameter. (it's a buffer 'out' so one has to supply the buffer handle)

PHP Code:

System::Call "kernel32::GetProcessIoCounters(ir1, ir2) i.r5 ? e" 


Results:

PHP Code:

GetCurrentProcessId: 700
GetOpenProcess: 204
Buffer: 1371680
GetProcessIoCounters result: 1
GetLastError: 80

[82][3][2529][66090][11408][98746] 


I'm not sure what I'm exactly looking for, so it's a bit hard to confirm the shape of IO_COUNTERS Structure to be right

[Animaether]

Originally Posted by gringoloco023

At least the following line should have a dot less on the second parameter. (it's a buffer 'out' so one has to supply the buffer handle)

PHP Code:

System::Call "kernel32::GetProcessIoCounters(ir1, ir2) i.r5 ? e" 


Oh pish. Go figure.. I correlated the __out type as out in the System syntax, and not in.

Originally Posted by gringoloco23

I'm not sure what I'm exactly looking for, so it's a bit hard to confirm the shape of IO_COUNTERS Structure to be right

Open up Task Manager, add the IO columns if needed, compare to those

so, corrected code without the debuggery bits...

PHP Code:

OutFile "test.exe"

!define PROCESS_QUERY_INFORMATION 0x0400
!define PROCESS_VM_READ 0x0010

Section
    System::Call "kernel32::GetCurrentProcessId(v)i.r0"
    System::Call "kernel32::OpenProcess(i${PROCESS_QUERY_INFORMATION}|${PROCESS_VM_READ}, i0, ir0) i.r1"

    System::Call "*(l, l, l, l, l, l) i.r2"

    System::Call "kernel32::GetProcessIoCounters(ir1, ir2)"

    System::Call "*$2(l.R1, l.R2, l.R3, l.R4, l.R5, l.R6)"

    MessageBox MB_OK "PID: $0$\n$\nI/O Reads: $R1$\nI/O Writes: $R2$\nI/O Other: $R3$\nI/O Read Bytes: $R4$\nI/O Write Bytes: $R5$\nI/O Other Bytes: $R6"
    System::Free $2
SectionEnd 


PHP Code:

---------------------------
Name Setup
---------------------------
PID: 3460

I/O Reads: 75
I/O Writes: 3
I/O Other: 505
I/O Read Bytes: 66122
I/O Write Bytes: 11408
I/O Other Bytes: 157458
---------------------------
OK   
--------------------------- 


[820815]

Thank you!